WESHOP PRIVACY POLICY
Last Updated: 2nd November 2026
WeShop Holdings Limited (“WeShop”, “we”, “us”, “our” or the “Company”) are committed to protecting your personal information when you are using WeShop's website (at we.shop, the “Website”), our mobile applications (available on iOS and Android) and any software provided on or in connection with our services (collectively, the “Service”).
In order to provide you with the Service, we will collect information about you. Your privacy is really important to us, and we understand how important it is to you. Our aim is to be as clear and open as possible about what we do and why we do it.
You agree to this Privacy Policy by accessing our Service. If you do not agree, you may not access or use the Service.
In this Privacy Policy, references to “you”, “your” and “Users” are references to the User, Visitor, guests and others who access the Service, whether end users or developers or operators of platform applications or websites or others.
When you use the Service, you are consenting to the practices included within this Privacy Policy. Unless otherwise stated, all definitions used in the Terms of Service shall apply to this Privacy Policy and for the purposes of this Privacy Policy.
To hold a WeShop Account, you will need to supply basic account details to use the Service and for us to verify your identity as part of our Know Your Customer (KYC) and Anti-Money Laundering (AML) checks. You may decide to voluntarily contribute additional data or permit us to access your data from third parties such as Apple or Google to improve your experience in using the Service. We also generate data about your usage of the Service, such as when you logged in, content you created and retailers you visited.
1.1 Data you provide to us:
- Account Data: we require you to supply mandatory account data including username, screen name, and email address. You can choose whether to enter and to permit your phone number to be discoverable for matching to other users’ contacts data.
- Profile Data: you can choose to add a profile picture and bio to your account.
- Identity Verification and Anti Money Laundering Data: to redeem your WePoints you must pass KYC and AML checks via our third-party provider Yoti and its sub-processors. WeShop does not undertake biometric checks, preferring a non-biometric, document-only approach. We process:
- Official Identity Documents - passports, driving licences or national ID cards (including document type, country of issue, expiry date, document number, and visual images of the document pages).
- Address Verification Data - proof of address documentation, current address history, and associated residency metadata.
- Extracted Identity Data - full name, date of birth, address and country.
- Technical Metadata - IP address, device information and timestamps.
- Screening and Compliance Data - results of checks against global sanctions lists and politically exposed persons (PEPs) registries.
- Content: you can choose to submit photos, videos, audio, text and other types of content in the posts, questions, comments or wishlists you create. You can decide whether to make your wishlists visible to other users or private.
- Purchase Data: when you make a purchase, we keep the details of the transaction: the retailer, the items you purchased, the time of the transaction and the price.
- Marketing, Survey and Research Data: you can choose to respond to WeShop surveys or questionnaires.
- Third Party Data: you can choose to refer a friend to WeShop, sync your device contacts in order to find your friends who are using the Service or you may need to report another user of the Service or flag their content.
- Customer Support Data: when you contact us, you provide us with information that may be necessary to help address your inquiry. Other people may also submit reports involving your account or content. We may also request information additional to your Account Data, by exception and only where necessary, to satisfy KYC and AML checks.
- Social Media Data: you may decide to share data with us through your accounts on other platforms (e.g. Google, Apple, Instagram), for instance if you decide to create and log into your account via these platforms.
1.2 Data generated or automatically collected:
- User ID: your user ID is assigned on account creation and links all of your WeShop activity and data together.
- Usage Data: using the Service generates data about your activity, including how you use it (e.g. when you logged in, features you have used, actions taken) and how you interact with others (e.g. searching, posting, commenting and visiting retailer sites). We use third-party analytics tools to help us measure traffic and anonymised usage trends for the Service. These tools collect information sent by your device to our Service, including the web pages you visit, add-ons, and other information that assists us in improving the Service. We may also receive data related to interactions you had with our ads on third parties’ websites or apps.
- Technical Data: using the Service involves the collection of data from and about the device(s) you use to access our service, including hardware and software information such as IP address, relative (non-precise) geolocation, device ID and type, app settings and characteristics, app crashes and identifiers associated with cookies or other technologies that may uniquely identify a device or browser. For more information about cookies, see section 6.
Personal information submitted to us (or which we collect from you) via the Service, will be used for the purposes specified in this Privacy Policy (or as specified in relevant parts of the Service where the information is collected).
- To enable you to use the Service: Account Data, KYC and AML Data are required for WeShop to verify your identity and provide the core Service to you, on the bases of legal obligation and contractual necessity. We may also need to contact you by email or via your social network accounts when necessary in connection with your use of the Service or changes to the Service. Note you may not opt out of service-related emails.
- To validate your purchases through the Service and enable us to award WePoints: Account Data, Technical Data, Purchase Data and Usage Data are needed to match WeShop data with retailer data and Third Party referrals data enables us to award WePoints for referred transactions. We also request your consent via the Service to post details of each of your purchases in our feed and you can change this consent any time in your Settings.
- To send you various confirmations and notifications, including marketing communications relating to WeShop or the businesses of carefully selected third parties which we think may be of interest to you: Account Data may be used to send you such notifications, but only where you have given your consent.
- To expose additional functionality of the Service to you: voluntarily-provided Profile Data, Content, Third Party Data and Social Media Data may be used to personalise your experience of the Service, granting you more functionality in e.g. accessing the Service, adding contacts, recommending products and creating wishlists.
- To deal with enquiries and complaints made by or about you relating to the Service: Account Data, Third Party Data and Customer Support Data may be used to assist in resolving the enquiry or provide evidence to support any resulting actions.
- To improve our Service and create new features: Account Data, Profile Data, Content, Purchase Data, Marketing, Survey and Research Data, Third Party Data, Customer Support Data and Social Media Data may all be used for the purpose of researching, targeting and delivering new features to the Service.
- To keep you and other users safe on our Service: Account Data, Profile Data and Content will be reviewed and may be used to detect and prevent use of the Service which contravenes our Community Guidelines or Terms Of Service. In cases where illegal activity is detected on the Service, this data may be shared with law enforcement as required.
As a core principle of our privacy commitment, WeShop does not currently exchange your personal information for monetary or other valuable consideration. This means that we don't pass any data elements we collect about you or your contacts to third parties for marketing, advertising, or any other commercial purpose. Should this position change we will only do so with your consent.
Where you submit personal information to us for publication on the Service, we will publish and otherwise use that information in accordance with the terms set out in the Terms of Service.
3. Who has access to your personal data?
Since WeShop is a community social Service, some of your information is visible to other users. We also share data with service providers and partners who assist us in operating the Service, with other WeShop Group companies and, in some cases, for legal and related reasons.
3.1 WeShop group companies
We may share your personal information with any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, in order to assist each other in data processing operations as Service providers and for other legitimate business purposes included corporate/ consolidated audit, analysis and reporting.
3.2 Vendor disclosure
We may disclose information about you to any of our employees, officers, agents, our partners or other selected third parties to enable you to use the Service. Selected third parties include, but are not limited to:
- Business partners, suppliers and sub-contractors for the performance of any contract we enter into with them or you.
- We require you to disclose personal information to perform necessary customer identification and anti-money laundering checks with our third party provider Yoti. WeShop acts as the data controller and Yoti acts as our primary processor, securely routing relevant data to its specialised sub-processors: Comply Advantage for AML searches; Experian for UK/EU address consistency, credit header records and fraud reporting registries, and; Aristotle for international identity document verification and cross border identity registry matches. Document scans are stored securely on Yoti’s servers for a period of 30 days before deletion. The Experian check is an identity check and is not a credit check. It does not affect your credit score and is not visible to lenders.
- We may disclose anonymised statistical information about our Users to organisations to produce social analytics dashboards and to provide insights on social activity created by Users of the Service. We use this aggregate data to offer reporting to third party retailers who are registered to use the Service, to help them better understand their visitors. We also provide these third-party retailers with personal information of Users who have recommended their products via the Service.
- We may share your personal and contact information to necessary third-party providers to enable direct communication via email, push notification or SMS.
3.3 Publicly shared information
Information you upload to the Service may also be viewed by other Users.
We may disclose your personal information to comply with laws:
- When we believe it necessary to comply with laws or regulations.
- To assist law enforcement.
- To enforce the terms under which you transact or communicate with or via the Service.
- To protect the rights, property or safety of WeShop, Users or third parties.
- In order to establish, exercise or defend our legal rights (including providing information to others for the purposes of fraud prevention and reducing credit risk, enforcing or applying our terms of use and other agreements and protecting the rights, property or safety of WeShop, our Users or third parties.
- To the purchaser (or prospective purchaser) of WeShop or its assets in the event that WeShop is sold or transfers some of its assets to another party. The personal information we hold about you will be one of the transferred assets.
3.4 Data sovereignty
To maintain jurisdictional compliance, where it is technically feasible, personal information that we collect will only be stored and processed in accordance with local data sovereignty requirements and best practice: UK users’ personal data will remain resident within the UK and US users’ personal data will remain resident in the US.
The only exceptions to this are:
- your username, phone number and email address, which are stored both in the UK and the US in support of our geographical routing functionality. Our Infrastructure provider is certified to the EU-U.S. Data Privacy Framework (DPF) and adheres to the DPF Principles.
- data collected via Yoti’s service for the purpose of KYC and AML checks are primarily hosted and processed within highly secure data centres located inside the United Kingdom and the European Economic Area (EEA). However, Yoti utilizes global support operations to flag or review suspected forged identity documents. This means limited visual document data may be securely reviewed by vetted personnel in India strictly for anti-fraud analysis. These international transfers are fully protected by Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum (IDTA) to ensure your information receives a SOC 2 certified level of protection.
By submitting data to the Service, you agree to this transfer, storing and processing of your personal information.
4. How do we protect your personal data?
We will take reasonable technical and organisational precautions to prevent the loss, misuse, alteration of or unauthorised access to your personal information. We will store all the personal information you provide on our highly secure servers, where it is encrypted at rest and in transit.
Please note that data transmission over the internet is not always secure, and although we will do our best to protect your personal data we cannot guarantee the security of data sent over the internet. Any transmission of data is at your own risk.
You are responsible for keeping your login details confidential. We will not ask you for your password (except when you sign in to the Services).
5. Lawful Bases for Processing
We will only collect and process personal data about you where we have lawful bases. Lawful bases include “consent” (where you have given consent), “contract,” where processing is necessary for the performance of a contract with you (e.g. to deliver the WeShop Services you have requested) and “legitimate interests”.
Where we rely on your consent to process personal data, you have the right to withdraw or decline your consent at any time and where we rely on legitimate interests, you have the right to object. If you have any questions about the lawful bases upon which we collect and use your personal data, please contact Customer Support.
You have choices about our use of your data. At any time, you can withdraw consent you have provided by going to your Settings.
6. Cookie Policy
The Service uses cookies. By using the Service, you consent to our use of cookies in accordance with our Cookie Policy. For information about cookies and how they are used by this Service, please visit our Cookie Policy.
7. Rights to Access and Control Your Personal Data
We provide many choices about the collection, use and sharing of your data, from deleting or correcting data you include in your profile and controlling the visibility of your content and communication controls. We offer you Settings to control and manage the personal data we have about you.
For personal data that we have about you:
- Delete Data: You can ask us to erase or delete all or some of your personal data (e.g. if it is no longer necessary to provide Services to you).
- Automated Decision Making: You can request a person review an automated decision, give your view and challenge it.
- Change or Correct Data: You can edit some of your personal data through your account. You can also ask us to change, update or fix your data in certain cases, particularly if it’s inaccurate.
- Object to, or Limit or Restrict, Use of Data: You can ask us to stop using all or some of your personal data (e.g. if we have no legal right to keep using it) or to limit our use of it (e.g. if your personal data is inaccurate or unlawfully held).
- Right to Access and/or Take Your Data: You can ask us for a copy of your personal data and can ask for a copy of personal data you provided in machine readable form.
8. Children’s privacy
If you are under the age of 18, you may not use our Service as defined in the Terms of Service. We do not knowingly collect or solicit any information from anyone under the age of 18 or knowingly allow such persons to register for the Service. The Service and its content are not directed at children under the age of 18. In the event that we learn that we have collected personal information from a child under the age of 18, we will delete that information as quickly as possible, notifying the individual concerned in the process. If you believe that we might have any information from or about a child under 18, please contact us immediately.
9. Other websites and services
We are not responsible for the practices employed by any websites or services linking to or from our Service, including the information or content contained within them. Please remember that when you use a link to go from our Service to another website or service, our Privacy Policy does not apply to those third-party websites or services. Your browsing and interaction on any third-party website or service, including those that have a link from any aspect of our Service, are subject to that third party's own rules and policies. In addition, you agree that we are not responsible and do not have control over any third parties that you authorise to access your user content. If you are using a third-party website or service and you allow them to access your user content you do so at your own risk.
10. Changes to this Privacy Policy
We may modify or update this Privacy Policy from time to time, so please review it periodically. We may provide you additional forms of notice of modifications or updates as appropriate under the circumstances. Your continued use of the Service after any modification to this Privacy Policy will constitute your acceptance of such modification.
Please contact us if the personal information which we hold about you needs to be corrected or updated.
If you have any questions about this Privacy Policy, our treatment of your personal information, including any complaints, please contact customer.relations.us@we.shop in the first instance. You will be provided with further details as to how to proceed.
Alternatively, you can write to us at:
WeShop Management UK Limited, 3 Hardman Street, Manchester, United Kingdom, M3 3HF
We are registered with the Information Commissioner (“ICO”) with registration number ZB794120