Last updated: 2026-9-21

This Privacy Policy explains how LWT Shop ("LWT Shop", "we", "us") collects, uses, shares and protects personal data when you use lwtshop.com and its related services (the "Platform").

We are the data controller for the personal data described here. You can reach us at [email protected].

1. Data we collect

1.1 Information you give us

• Account data — name, username, email address, password (stored hashed, never in readable form), and optionally a profile photo.
• Identity verification data — where we need to verify who you are before a transaction, this may include government-issued identification, proof of address, or business registration documents.
• Listing data — details of assets you list for sale, including traffic statistics, revenue figures, screenshots and supporting documentation you choose to upload.
• Transaction data — records of purchases, sales, escrow deposits, releases, refunds and payout details.
• Communications — messages you exchange with other users through the Platform, and any correspondence with our support team, including dispute submissions.

1.2 Information we collect automatically

• Technical data — IP address, browser type and version, device type, operating system, and time zone.
• Usage data — pages viewed, listings visited, search terms, referring URLs, and interaction timestamps.
• Cookie data — as described in our Cookie Policy.

1.3 Information from third parties

We may receive data from payment processors confirming transaction status, from fraud prevention services, and from identity verification providers where applicable. We do not receive or store your full payment card details.

2. Why we use your data, and our legal basis

Where data protection law requires a legal basis for processing, we rely on the following:

• To provide the Platform — creating and maintaining your account, displaying listings, enabling messaging, processing transactions. Basis: performance of a contract.
• To process payments and escrow — holding, releasing and refunding funds. Basis: performance of a contract.
• To verify identity and prevent fraud — confirming users are who they claim to be, investigating suspicious activity, enforcing our Terms. Basis: legitimate interests in maintaining a safe marketplace, and legal obligation where applicable.
• To resolve disputes — reviewing evidence submitted through our reporting system. Basis: legitimate interests and performance of a contract.
• To communicate with you — service notifications, transaction updates, security alerts. Basis: performance of a contract.
• To send marketing — newsletters and promotional messages, where you have opted in. Basis: consent, which you may withdraw at any time.
• To improve the Platform — analysing usage patterns to fix problems and develop features. Basis: legitimate interests, or consent where analytics cookies require it.
• To comply with law — retaining transaction records, responding to lawful requests. Basis: legal obligation.

3. Who we share data with

We do not sell your personal data. We share it only as follows:

• Other users — when you transact, the counterparty sees your username, profile information and the messages you send them. They do not see your email address, payment details or identity documents unless you choose to share them.
• Payment and escrow providers — Direct Bank Transfer to process deposits, releases and payouts.
• Hosting and infrastructure providers — our servers are operated by Contabo, located in USA.
• Analytics providers — Google Analytics, subject to your cookie preferences.
• Email delivery providers — to send transactional and, where consented, marketing messages.
• Professional advisers — lawyers, accountants and auditors, where necessary.
• Authorities — where we are legally required to disclose, or where disclosure is necessary to protect our rights, our users, or the public.

Each provider is permitted to process your data only for the purposes we specify, and is bound by confidentiality obligations.

4. International transfers

We operate from Sri Lanka and our service providers may be located in other countries, including outside the European Economic Area and the United Kingdom. Where we transfer personal data internationally, we take steps to ensure an appropriate level of protection, which may include Standard Contractual Clauses approved by the European Commission or transfers to countries recognised as providing adequate protection.

5. How long we keep data

• Account data — for as long as your account is active, and for 14 Days after closure.
• Transaction records — for 2 Years, as required for tax, accounting and legal purposes.
• Dispute records — for 14 Days after the dispute is resolved.
• Identity verification documents — for the period required by applicable law, then deleted.
• Marketing data — until you withdraw consent.
• Technical logs — typically 14 Days.

6. Your rights

Depending on where you live, you may have some or all of the following rights:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion, subject to our legal obligation to retain certain transaction records.
• Restriction — ask us to limit how we use your data while a concern is investigated.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent — where processing is based on consent, without affecting processing carried out beforehand.

If you are a California resident, you additionally have the right to know what personal information is collected, to request deletion, and not to be discriminated against for exercising these rights. We do not sell personal information as that term is defined under California law.

To exercise any right, email [email protected]. We will respond within the period required by applicable law, ordinarily within one month. You also have the right to complain to your local data protection authority.

7. Security

We use HTTPS across the Platform, store passwords using industry-standard hashing, restrict internal access to personal data on a need-to-know basis, and hold transaction funds through third-party escrow rather than in general operating accounts.

No online service can guarantee absolute security. You are responsible for keeping your password confidential and for enabling any additional security features we make available. Notify us immediately at [email protected] if you believe your account has been compromised.

8. Children

The Platform is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

9. Cookies

We use cookies and similar technologies as described in our Cookie Policy, which explains each category and how to change your preferences.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version here and update the "Last updated" date. Where changes are significant, we will notify you by email or through a notice on the Platform.

11. Contact us

LWT Shop
Email: [email protected]