Privacy notice

1. Who is responsible

We Buy Mobile Phones is a trading name of I AM DROID LTD, a company registered in England and Wales under company number 12062250. Our registered office and business address is 58 James Street, Bradford, BD1 3PZ, United Kingdom.

I AM DROID LTD, trading as We Buy Mobile Phones, is the data controller for personal information used to run this phone-buying service. Write to the Privacy Team, I AM DROID LTD, 58 James Street, Bradford, BD1 3PZ, United Kingdom. Email info@webuymobilephones.com for support or privacy matters, or telephone 07716 509343.

2. Information used

For a business or education bulk enquiry, we collect your organisation and sector, representative name, work email and telephone, device-location postcode, inventory groups and quantities, requirements and notes. No sign-in is required. We store the enquiry, authority/privacy acknowledgement, staff review notes and any links to individual purchases. These details are used to review and respond to your request, not to enrol you in marketing. Do not include staff or student records, passwords, IMEIs or serial numbers in this initial form. Hosting and security services process connection information; application abuse controls store dated hashed connection/email keys and counts rather than raw IP addresses. When you create a customer account, we store your name, email address or telephone login identifier, a salted password hash and a hashed recovery code. Passwords and recovery codes are not stored in readable form. Email and telephone identifiers are not automatically verified and no email or SMS verification or password-reset delivery is connected. Account recovery uses the code shown when creating or recovering your account. Existing customers may explicitly connect prior sales while authenticated with their previous ChatGPT account; matching contact details alone do not transfer sales. Staff and administrator sign-in remain separate. When you submit a sale, we collect your name, telephone number, postal address, device model, storage, optional IMEI, condition and repair answers, ownership declaration, notes and preferred payment method. Older sale records may also contain a PayPal payment email where that method was previously selected. New sales use bank transfer.

Authorised admin and staff can share internal team messages, photos and PDF documents. We store the posting account identifier, displayed account name and role, message text, attachments and posting time. This room is accessible to authorised admin/staff and is separate from customer conversations. Files require staff sign-in to retrieve; PDFs are delivered as downloads. These records are subject to the retention review described below.

Optional device photos can be attached to sale messages by customers or authorised staff. Photos are stored privately with the sale and require sign-in and order access to view. Photos attached to internal staff notes are not visible to customers. The upload form resizes photos and removes image metadata before sending. Avoid faces, identity documents, banking information and unrelated personal content. Photos follow the sale record retention review described below.

We also hold sale messages, staff inspection notes, status history, tracking references, offer amounts, payment references and the terms version and declaration time. Hosting and security services may process IP addresses, browser information, access logs and authentication information. For bank-transfer payments, we collect the account holder name, six-digit UK sort code and eight-digit account number. These payout details are encrypted when stored and full details are accessible only to authorised staff for arranging your agreed payment. Customer account summaries show only the last four account-number digits. We also record whether you are a personal or business seller and the business name where applicable. We never collect online-banking passwords, card PINs or one-time security codes.

If you allow optional statistics, we count public page views and quote requests in aggregate daily totals. We do not store visitor identifiers, full URLs, search terms, referrers, IP addresses or device fingerprints in our analytics tables, and do not link those totals to customer accounts. Operational reports also summarise sales and payment references already held to provide our service. Use Privacy choices to stop optional statistics; your choice does not affect selling a phone.

You provide most sale information. Sign-in information comes from the identity service. Device-lookup results, inspection findings, payment confirmations and carrier updates may come from the relevant provider or team member. Do not include unrelated sensitive personal information in notes or messages.

3. Purposes and lawful bases

• Steps at your request before a contract and performance of the purchase agreement: identifying the device, reviewing your request, arranging inspection, communicating about your sale, paying you and arranging a return.
• Legitimate interests: protecting the service against misuse and fraud, checking proportionate ownership concerns, managing disputes and keeping a reliable audit trail. These interests must be balanced against your rights.
• Legal obligations: records or disclosures required by applicable tax, accounting, regulatory or law-enforcement duties. We do not rely on a blanket legal-obligation claim for all processing.
• Consent: an optional external IMEI lookup is requested separately. You can decline and use model search. Withdrawing consent does not undo a lookup already performed or affect processing supported by another lawful basis. The site does not currently run a marketing-signup programme.

4. Providers and sharing

The site uses OpenAI Sites/ChatGPT sign-in and Cloudflare hosting/database infrastructure to operate the service. Authorised staff access information for their work. Where used for your sale, carriers receive delivery details and payment providers receive the information necessary to make a payment. Professional advisers or public authorities receive information only where justified or required.

The homepage IMEI/TAC lookup runs in your browser using a locally hosted community TAC database. It uses the first eight digits to suggest a model and does not send the full IMEI for identification. The browser requests a database file using only a three-digit prefix. This is not a storage, battery-health, ownership or blacklist check. You can use model search instead. Any separately requested external IMEI service requires explicit consent before the IMEI is sent to IMEI.org. Catalogue and price-source requests ordinarily use model/variant details rather than customer names or postal addresses.

Fonts and site images are served from this website. Loading the typefaces does not make a request to Google Fonts. This is separate from sign-in or other Google services you choose to use.

We do not sell customer contact lists. Hosting, security and AI providers may process information outside the UK, including in the United States. OpenAI’s published data-processing terms include Standard Contractual Clauses with the UK Addendum for UK personal information. Cloudflare operates the hosting/security infrastructure and publishes its processing and transfer information. The relevant terms depend on each provider’s role in supplying the service; we do not promise UK-only storage. Email info@webuymobilephones.com for information or a copy of applicable transfer safeguards.

OpenAI data-processing terms ↗ · ChatGPT Sites data-processing terms ↗ · Cloudflare privacy information ↗

Google Analytics and your choice

If you choose Allow statistics, Google Analytics 4 receives information about visits to our public pages, successful phone quote requests and accepted bulk-enquiry submissions, a pseudonymous browser identifier, session and device/browser information, and connection information needed to deliver the service. We send a public page path without query strings or fragments and a referrer origin without its full address. Google may use connection information to derive approximate location. This is personal-information processing; it is separate from our own aggregate daily counts.

We use Google Tag Manager (container GTM-T9Q9RGJJ) to manage website tags. The container is blocked until you allow statistics and is excluded from private account, login, staff and admin pages. Tag Manager does not itself set Analytics cookies; enabled tags can do so as described here.

We do not deliberately send customer names, contact details, IMEIs, sale references, messages or banking details to Google Analytics. The Google tag is not loaded on account, login, staff or admin pages. Advertising storage, advertising user data, personalised advertising and Google signals are disabled. Statistics are optional and consent is the lawful basis for this processing.

Our Google Analytics property is set to retain user-level and event-level data for two months. Reset on new user activity is turned off, so a new visit does not extend the user-data retention period. Google applies deletion through its retention processes. These settings do not limit standard aggregated reports. Analytics cookie expiry is separate: the cookie limit is up to 180 days from initial setting, as explained in Cookies.

Google Analytics is provided by Google and can involve international processing. Google’s published measurement/data-processing terms describe its transfer safeguards, including the UK Extension to the EU–US Data Privacy Framework where applicable and contractual safeguards. You can request information about applicable safeguards through our privacy contact. See Cookies for identifiers and expiry.

AI-assisted message wording

Authorised staff may use OpenAI to rewrite a draft customer reply in more professional language. Only the draft text entered by the staff member is sent for that request; the website does not automatically send the full conversation, device photos, PDF attachments or bank payout fields. A staff member reviews the suggestion and decides whether to use it and send the final message.

The API request disables storage of the generated response as an OpenAI response object. This is not a promise that the provider keeps no operational or security records. Drafts may contain personal information when the staff member has included it; staff should keep the draft limited to what is needed for the reply. The provider and international-transfer information above also applies to this processing.

5. Retention and security

Information is needed while a request is active, a device is in transit or custody, payment or return is outstanding, or a complaint is being resolved. Relevant transaction and payment records may need to be retained afterwards for applicable accounting obligations and legal claims. The appropriate period depends on the record type, applicable accounting and legal obligations, and any legal hold.

We use retention criteria by record type rather than one blanket period. Account information supports an open account and any linked transactions. Enquiries are needed while discussions and any resulting purchase are active. Sale messages, inspection photos and payout details are assessed against outstanding payment, return, support, fraud-prevention and dispute needs. Transaction evidence may be needed for accounting obligations or legal claims after a sale ends; only information necessary for that purpose should be retained. A legal hold can extend retention of relevant records. There is no automatic purge of sale records. Email info@webuymobilephones.com to request account closure, a retention review or erasure; we explain any lawful reason for keeping information and any restrictions applied.

The application checks sign-in and sale ownership before giving access to private sale records and restricts staff functions. No internet service is completely risk-free. Keep your sign-in secure. Never send banking passwords or a phone account password in a message.

6. Your information rights

Depending on the circumstances, you may request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent where consent is used. Rights can have legal exceptions; we explain a refusal and how you can challenge it. We may need proportionate information to verify identity. Requests are normally free and handled within the applicable statutory timeframe, usually one month, subject to lawful pauses or extensions.

Necessary sale information is required to arrange and complete a transaction. If you do not provide it, we may be unable to proceed. IMEI lookup is optional. You can ask for account closure, although this does not automatically delete records needed for a lawful ongoing purpose.

Indicative quotes may be calculated from variant, condition and pricing rules. The physical inspection and final offer are reviewed by the team and you decide whether to accept. The service does not complete a purchase solely through an automated quote.

Your right to object

You can object to use of your information based on our legitimate interests, explaining your particular situation. Email info@webuymobilephones.com with the subject Privacy objection. We assess your request and stop the affected processing unless a lawful exception applies, such as compelling overriding grounds or the establishment, exercise or defence of legal claims. You can withdraw optional-statistics consent at any time using Privacy choices.

7. Privacy questions and complaints

You can send a privacy question, rights request or complaint by post to the Privacy Team, I AM DROID LTD, 58 James Street, Bradford, BD1 3PZ, United Kingdom. For an existing sale, you may also use its message thread. You do not need an account or a sale to write to us. You can also email info@webuymobilephones.com or telephone 07716 509343.

We must acknowledge a data-protection complaint within 30 days, investigate without undue delay, keep you informed as appropriate and explain the outcome. You may complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint/. This does not remove other available remedies.

Contact the Information Commissioner’s Office ↗

8. Children and updates

The service is intended for sellers aged 18 or over. If you believe a child has provided personal information, contact us so it can be assessed and handled appropriately. Material privacy changes will be explained; we will not assume that agreement to sale terms supplies consent for unrelated marketing. See the Cookies notice for browser technologies.