Customer privacy notice

Version 1.0 · 14 October 2026

1. Who is responsible?

Cashinadash is currently operated by BOOM (MANAGEMENT) LIMITED, company number 14704236. It is the controller responsible for the information covered by this notice.

Registered office and correspondence address: 108 St. Leonards Gate, Lancaster, Lancashire, LA1 1NN, United Kingdom. Telephone: 01524 66660. Email: zm@mistergroup.co.uk.

This notice covers customer transactions, related enquiries and shop CCTV at our Lancaster, Morecambe and Preston branches. Employment and staff administration require separate privacy information. If the business operator changes, we will update this notice and explain any relevant change in responsibility for your information.

2. Information we use and where it comes from

• Customer and transaction details: name, contact details, address, goods and serial numbers, condition, valuations, agreements and signatures, payments, credit balances, renewals, redemptions, sales and refunds.
• Identity checks: the type and expiry date of the document checked, a check reference, the staff check record and a photograph or scan of the identity document when collected. An ID copy may contain your photograph, date of birth, address, signature and document number. We do not use it for automated facial recognition.
• Communications and security records: enquiries, complaints, relevant correspondence, ownership concerns and records of access and changes to our systems.
• CCTV: images of people in the areas covered by shop cameras. Signs identify where CCTV operates.

Most information comes directly from you and from staff recording your transaction. Where relevant, we may receive payment confirmation from a payment provider, delivery information from a courier, or information about an ownership concern from an affected owner, insurer or authority. Such information is used only where relevant and lawful.

Please remove personal files and accounts from devices before handing them over, and discuss any required erasure with staff. Do not put full payment-card details or unrelated sensitive information in messages or transaction notes.

3. Why we use your information

• Arrange and carry out a transaction: to respond to your request and perform purchases, sales, buybacks, renewals, redemptions, payments and refunds. Our basis is steps you request before a contract and performance of that contract.
• Identity, ownership and security checks: to identify sellers, investigate stolen goods, prevent and investigate fraud, resolve disputes and protect customers, staff and property. Our basis is our legitimate interests in safe trading and protecting the business and the people who use it. CCTV supports these security purposes. Checks and the use of copies must be necessary and proportionate.
• Accounting and legal duties: to keep required financial records and comply with applicable tax, court and other legal requirements. Our basis is legal obligation where a duty applies.
• Optional marketing: where we offer this and obtain the required consent, to send the communications you choose. You can withdraw consent by contacting us. Agreeing to a transaction is not marketing consent.

We need the relevant contact, transaction and identity information to administer a transaction and carry out our checks. Without it, we may be unable to proceed. Staff can explain which information is needed for your transaction. Optional marketing choices do not affect your ability to trade with us.

4. Access, sharing and service providers

Authorised staff access information needed for their duties. Our application and its customer records are hosted on our IONOS server. Hosting, IT support and communications providers may process information to run, maintain and secure the services we use. We may share relevant details with payment providers, couriers, professional advisers, insurers, police or other authorities where this is necessary and lawful. We do not give every recipient every customer's record, or sell customer contact lists.

Supplier processing can involve locations outside the UK. Where a restricted international transfer is involved, we require an applicable UK adequacy arrangement or appropriate safeguards, such as approved contractual transfer terms, unless a lawful exception applies. Contact us for information about the recipient, location and safeguards relevant to your information, including how to obtain a copy of applicable safeguards. This notice does not promise that every supplier's processing takes place solely in the UK.

5. How long information is kept

Identity photographs and check details

Our standard rule is to keep each ID photograph or scan through the expiry date printed on that document. A replacement copy has its own expiry date; replacing it does not extend the old copy's deadline. The system blocks access after expiry and removes expired copies from the live application and managed server backups during scheduled hourly cleanup. Related expired check details are also removed; the commercial transaction remains.

New ID uploads require a valid expiry date. If a legacy record has no usable expiry date, it is flagged for review rather than assigned an invented date. Staff must apply the same expiry rule to any separately exported copies. A request for earlier deletion or an objection is considered on its circumstances and any applicable duties; expiry is not a reason to ignore your privacy rights.

Transactions, agreements and accounting

Company accounting records are normally retained for six years after the end of the financial year they relate to, and longer when an applicable tax or other legal requirement requires this. Associated transaction and agreement records are kept while an agreement or balance is outstanding and for the relevant accounting period afterwards. Records needed for a live dispute, investigation or reasonably anticipated legal claim may be retained until that need ends. This separate rule does not automatically extend the ID-photo deadline.

Enquiries, complaints and security records

Retention depends on whether an enquiry is still being answered, a complaint or incident is unresolved, information is needed to explain a transaction, or a continuing legal duty or claim requires it. At closure or review, information no longer needed for those purposes should be deleted or anonymised. A complaint or incident forming part of a transaction follows the relevant transaction or case-retention criteria. These records require an administrative review; the ID-expiry cleanup does not automatically delete all business records.

CCTV

Routine footage is retained for 90 days at each shop before it is overwritten. Relevant incident footage may be isolated and retained for an investigation, insurance matter or legal claim until that matter and any continuing requirement are resolved. Access is restricted to authorised people. CCTV is managed on the shop recording systems; deleting a record from this application does not delete camera footage.

Backups and exported records

Protected backups support recovery from loss or damage. They must be considered alongside the underlying retention rules and kept out of ordinary day-to-day use. The managed server-backup cleanup specifically removes expired ID copies. Separately exported files and other backup copies require the same retention rules to be applied by the people responsible for them; records are not kept indefinitely simply because they are in a backup.

6. Market research and product photographs

Staff may use historic sales and optional AI-assisted market research to estimate resale value. The AI market-research service uses OpenAI and web sources. The integration sends product description, specification and condition, rather than customer-account or identity-document fields. Staff must keep personal information out of the product fields. Product photographs can be processed by our hosted image service to remove backgrounds and apply branding; staff should photograph goods without people, documents or personal details in view.

A staff member reviews the goods and decides the offer. We do not use this valuation feature to make a solely automated decision with legal or similarly significant effects on you. Estimates are not guaranteed offers or resale prices.

7. Your rights

Depending on the circumstances, you can ask for access to your information, correction of inaccuracies, erasure, restriction of processing or a portable copy. Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

We may request proportionate evidence of identity to protect your information. Some rights are subject to exceptions, including where records must be kept by law; we will explain any applicable restriction.

You can raise a concern with us or complain directly to the Information Commissioner's Office, telephone 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You do not have to complain to us first.

8. This page and staff sign-in

This notice page contains no advertising or analytics trackers. Visiting the service produces ordinary web-server records, such as the requested address, IP address and access time, used to operate and secure it. Staff sign-in uses essential session, account-setup and authorised-device cookies. Session cookies last up to 12 hours, setup cookies up to 20 minutes and authorised-device cookies up to 90 days; inactivity can lock a staff session sooner.