Handled with care.
Used with purpose.

Who controls your personal information

Revante is the trading name used for the UK online device buyback service operated by WE BUY BACK LTD. WE BUY BACK LTD is the data controller for the personal information described in this policy, meaning we decide why and how it is used.

Our registered office is 11 The Crofts, Rotherham, England, S60 2DJ. It is a correspondence address and not a public drop-off point. You can contact us on 0114 698 4201 or at [email protected].

This policy applies when you visit revante.co.uk, request a quotation, create or manage a sell order, post a device, receive a payment, contact us, use an account or order-tracking feature, or otherwise interact with Revante.

The personal information we collect

The information needed depends on what you do. Browsing the website normally requires less information than creating an order, arranging a return or receiving payment.

We may also hold photographs or video of parcels, devices, labels and inspection findings; copies of ownership or identity evidence where reasonably required; and records of suspected fraud, blocked devices, loss, theft or other status concerns.

Please do not send passwords, passcodes, recovery keys, authentication codes, unnecessary identity documents, or special-category information such as medical details unless we specifically and lawfully ask for it.

Where information comes from

Most information comes directly from you when you use a form, create an order, select a device and condition, choose payment details, contact us or exercise a privacy right. We also create operational records while receiving, photographing, inspecting, grading, returning or paying for a device.

We may receive information from delivery companies, payment providers, technical service providers, fraud-prevention tools, CheckMEND or other device-status sources, mobile networks, insurers, finance providers, marketplaces, police or public authorities where lawful and relevant to an order.

If a business, authorised representative or another person creates an order for you, they may provide your contact or delivery information. They must have authority to do so and should make this policy available to you.

Why we use information and our lawful bases

UK data protection law requires a lawful basis for each use of personal information. We rely on the basis that best fits the particular purpose:

Contract and steps before a contract

To produce and hold a quotation, create and manage an order, arrange postage, identify and inspect a device, communicate a revised offer, process a return and make the chosen payment.

Legal obligations

To maintain tax, accounting and transaction records, respond to lawful requests, protect data rights, meet reporting duties and comply with court orders or other applicable legal requirements.

Legitimate interests

To operate and improve Revante, maintain order traceability, provide customer support, protect our systems, establish or defend legal claims, detect mistakes, prevent fraud and assess whether devices are lost, stolen, blocked or subject to another claim. We consider the necessity and impact on your rights before relying on this basis.

Consent

Where required, for optional marketing, non-essential cookies and any other activity for which we ask for a clear choice. You can withdraw consent at any time without affecting earlier lawful processing.

Aevum, device identifiers and inspection evidence

Revante uses the Aevum Recycling System to register and manage the device journey. Aevum was developed by World Business Software Solutions. The order record may contain customer details, order status, product information, IMEI or serial number, parcel contents, test results, grade, price, communications, returns and payment status.

We may photograph or record video of the parcel opening, device, identifiers, cosmetic condition, test process, faults, locks and accessories. This creates an accountable inspection trail, supports consistent grading and helps resolve a disagreement or investigate fraud, loss or damage.

IMEI and serial numbers may be screened through CheckMEND and other appropriate sources. If information suggests theft, fraud, blocking, finance, an insurance claim or another unlawful status, we may pause the order, request evidence and share relevant information with an appropriate organisation or authority where legally permitted.

Where a service provider hosts, supports or maintains systems for us, it may process limited personal information on our behalf under contractual confidentiality, security and data protection requirements.

Personal data left on a device

Before posting, back up anything you wish to keep, sign out of accounts, remove SIM and memory cards, remove passcodes and activation locks, and perform an appropriate factory reset. Revante does not need your password or authentication code.

Information stored on a device is different from the customer information used to manage an order. If residual content is encountered, authorised staff access it only where reasonably necessary to identify, secure, inspect or erase the device, deal with an account lock, investigate unlawful material, or comply with law. We do not browse it for curiosity, use it for marketing or sell it.

Where the device is accessible and the order can proceed, we may perform a controlled data-wipe process before reuse or recycling. This is an additional safeguard and does not replace your responsibility to erase the device before sending it.

SIM and memory cards should not be included. If received, they may be securely destroyed rather than returned. If a locked device cannot be lawfully accessed or wiped, we may ask you to remove the lock remotely or arrange a return.

Who we may share information with

We share only what is reasonably necessary for the relevant purpose. Recipient categories may include:

• postal, courier, fulfilment and returns providers handling a parcel or label;
• banks, PayPal, cheque, payment and fraud-prevention providers;
• Aevum and authorised hosting, email, communications, customer support, analytics, security and IT providers;
• CheckMEND, mobile networks, insurers, finance providers and device-status services;
• professional advisers, auditors, insurers and debt or dispute specialists where necessary;
• police, courts, regulators, HMRC and other public authorities where disclosure is required or lawfully justified; and
• a buyer, investor or successor if our business or relevant assets are reorganised or transferred, subject to appropriate confidentiality and data protection safeguards.

International data transfers

Some technology, communications or payment providers may store or access information outside the United Kingdom. Where that happens, we use a lawful transfer mechanism and safeguards appropriate to the destination and provider.

These may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another mechanism permitted by UK law. We also consider security, access controls and the provider's contractual obligations.

You can contact us if you would like further information about the safeguards relevant to a particular transfer.

Service messages, marketing and cookies

We may email, call or text you about a quotation, parcel, inspection, revised offer, return, verification, payment, complaint or privacy request. These are service communications, not marketing, and are necessary to manage the matter you asked us to handle.

We send optional electronic marketing only where consent or another lawful permission under UK privacy and electronic communications rules applies. You can unsubscribe through the message or contact us at any time. We may keep a minimal suppression record so we remember not to contact you again.

The website may use strictly necessary cookies and similar technologies to provide security, remember choices and make features work. Analytics, personalisation or advertising technologies will be used only with consent where required. Our dedicated Cookie Policy explains the current technologies, providers, purposes and durations.

How long we keep information

We keep information only for as long as reasonably needed for the purpose collected, then delete, anonymise or securely destroy it. The exact period can depend on whether an order completed, the type of record and whether a complaint, fraud concern, legal claim or regulatory requirement remains open.

• Incomplete quotations and abandoned enquiries are normally retained for up to 12 months.
• Completed order, payment, accounting and tax records are normally retained for up to six years after the relevant transaction or financial period.
• IMEI, serial, inspection, photograph, video, device-status and return evidence linked to an order may be retained for up to six years to maintain traceability and handle claims.
• Standalone customer-service or complaint records are normally retained for up to three years after closure, or longer where linked to a transaction or unresolved legal matter.
• Marketing preferences remain until withdrawn or no longer needed; a limited suppression record may be kept afterwards.
• Security logs, cookie choices and technical records have shorter periods set according to their purpose and risk.

We may retain a record for longer where law requires it or it is reasonably necessary to investigate fraud, protect ownership, resolve a dispute, enforce an agreement or establish, exercise or defend a legal claim.

How we protect information

We use technical and organisational measures appropriate to the nature of the information and the risks involved. These may include role-based access, account controls, encryption in transit, secure systems and backups, staff confidentiality, audit trails, physical controls, supplier checks, secure disposal and incident-response procedures.

Access to customer, payment and device evidence is limited to people and providers who need it for an authorised task. We review safeguards as our service and technology develop.

No internet transmission or storage system can be guaranteed completely secure. If a personal-data breach creates a risk requiring notification, we will notify the Information Commissioner's Office and affected individuals as required by law.

Your UK data protection rights

Depending on the circumstances and lawful basis, you may have the right to:

• ask for access to your personal information;
• correct incomplete or inaccurate information;
• ask us to erase information;
• restrict how information is used;
• object to processing based on legitimate interests or to direct marketing;
• receive certain information in a portable, machine-readable format;
• withdraw consent at any time; and
• ask for safeguards relating to solely automated decisions where the law provides them.

Rights are not absolute. For example, we may need to keep transaction information required by law or evidence needed to defend a claim. We will explain if an exemption or restriction applies.

To make a request, email [email protected] with the subject “Privacy Request”. We may ask for proportionate information to confirm your identity and locate the record. We normally respond within one month, subject to the rules allowing clarification, extension or a paused response period in certain circumstances.

Automated quotations and decisions

The website may calculate a starting quotation automatically from the product, specification, network and condition you select. That quotation is not a final purchase decision and is checked against the physical device after it arrives.

Revante does not currently make decisions based solely on automated processing that produce legal or similarly significant effects for customers. A technician or authorised team member reviews inspection differences, fraud concerns, revised offers and exceptional cases.

If this changes, we will update this policy and provide the information and safeguards required by law before the new processing begins.

Children's information

Revante's device-selling service is for people aged 18 or over. We do not knowingly accept sell orders from children or intentionally collect their information for the buyback service.

If you believe a child has provided personal information or an order has been created in their name, please contact us so we can investigate and take appropriate action.

Questions, complaints and policy changes

If you have a concern about how we use personal information, contact us first. Please include enough detail for us to identify the relevant order or interaction. We will investigate and provide an outcome in accordance with applicable data protection law.

You may also complain to the Information Commissioner's Office, the UK supervisory authority for data protection. We would appreciate the opportunity to address the issue first, but your right to contact the ICO is not affected.

We may update this policy where our service, suppliers, technology or legal duties change. The latest version will appear here with a revised date. If a change materially affects how we use existing information, we will provide further notice where required.