Privacy and cookies policy

Effective date: 16 October 2026

Reverse POCO Limited ("us", "we", or "our") operates the ReversePoco.co.uk website (hereinafter referred to as the "Service").

This page informs you of our policies regarding the collection, use and disclosure of personal data when you use our Service, the cookies we use, and the choices and rights you have associated with that data. Unless otherwise defined in this Privacy Policy, the terms used in this Privacy Policy have the same meanings as in our Terms and Conditions.

Who we are

Reverse POCO Limited is the Data Controller of your Personal Data. We are a company registered in England and Wales with company number 11975836. Our registered office is 8 Deer Park Drive, Newport, Shropshire, TF10 7HB, UK. Our VAT number is GB330629029.

We have not appointed a Data Protection Officer. Please send any question about this policy or your Personal Data to Privacy@ReversePoco.co.uk.

Definitions

Service

Service is the ReversePoco.co.uk website operated by Reverse POCO Limited
Personal Data

Personal Data means data about a living individual who can be identified from those data (or from those and other information either in our possession or likely to come into our possession).
Usage Data

Usage Data is data collected automatically either generated by the use of the Service or from the Service infrastructure itself (for example, the IP address that requested a page).
Cookies

Cookies are small files stored on your device (computer or mobile device).
Data Controller

Data Controller means the natural or legal person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any personal information are, or are to be, processed.

For the purpose of this Privacy Policy, we are a Data Controller of your Personal Data.
Data Processors (or Service Providers)

Data Processor (or Service Provider) means any natural or legal person who processes the data on behalf of the Data Controller.

We use the Service Providers listed under "Service Providers" below.
Data Subject (or User)

Data Subject is any living individual who is using our Service and is the subject of Personal Data.

Information Collection and Use

Types of Data Collected

Personal Data

We collect the following Personal Data:

Account data: your email address, your password (stored only as a salted hash), your two-factor authentication settings if you enable them, and your email notification preferences.
Order and billing data: your first and last name, company name, billing address, country, VAT number, any purchase order number or reference you give us, the licences you have ordered and your order history.
Payment data: card details are entered directly into secure fields hosted by our payment processor and are never sent to or stored by us. We receive a transaction reference and the outcome of the payment.
Academic licence data: the email address you register with, which we check to confirm academic status, and any proof of status you send us.
Correspondence: emails you send us and our replies.
Usage Data: described below.

You must give us your name, email address and billing details to buy a licence, because we need them to perform our contract with you and to issue VAT invoices as UK law requires. If you do not provide them, we cannot sell you a licence.

Usage Data

Our servers record technical information about each request to the Service ("Usage Data"). This includes your computer's Internet Protocol address (e.g. IP address), browser type and version, the page requested, and the time and date of the request. We use it to run, secure and troubleshoot the Service, for example to block abusive traffic and to investigate errors. We do not use it to build profiles of visitors, and we do not use analytics or advertising services.

Emails we send you

We send service emails about your account and orders, such as email confirmations, password resets, quotes, invoices and licence files. We also send licence expiry reminders one month and one week before a licence ends. You can switch the reminders off at any time on the Notification preferences page of your account. If you leave items in your basket for three days without checking out, we send you one reminder email about them, which you can also switch off on the Notification preferences page. We do not send newsletters, and we do not sell your Personal Data or share it with third parties for their own marketing.

Cookies

We only use cookies that are strictly necessary to provide the Service you have asked for. Under the Privacy and Electronic Communications Regulations 2003 (PECR) these cookies do not need your consent. We do not use analytics, advertising or social media cookies, and we do not track you across other websites.

Cookie	Purpose	Duration
.AspNetCore.Identity.Application	Keeps you signed in to your account.	Until you close your browser, or 14 days if you tick "Remember me"
Identity.TwoFactorUserId, Identity.External	Carries you between the steps of signing in, such as entering a two-factor code.	Up to 5 minutes
Identity.TwoFactorRememberMe	Remembers that you chose not to be asked for a two-factor code on this device.	14 days
.AspNetCore.Antiforgery.*	Protects our forms against cross-site request forgery attacks.	Until you close your browser
.AspNetCore.Mvc.CookieTempDataProvider	Shows a one-off message on the next page, for example after a failed payment.	Until you close your browser; deleted once read
.AspNet.Consent	Remembers that you have dismissed our cookie notice.	1 year

Payment page. When you pay by card, our payment processor Braintree (a PayPal service) loads secure card entry fields and 3-D Secure authentication from its own servers. Braintree and your card issuer may set cookies or collect information about your device to authenticate the payment and prevent fraud. This is strictly necessary to take a payment you have asked to make, and is governed by Braintree's privacy policy.

You can instruct your browser to refuse or delete cookies. If you block the cookies above, you will not be able to sign in or buy a licence.

Use of Data and Legal Basis for Processing

We process your Personal Data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and under the EU GDPR where it applies to you. The table below sets out what we use your data for and the legal basis we rely on.

Purpose	Legal basis
Creating and managing your account; selling and delivering licences; sending quotes, invoices, licence files and order emails; providing customer support	Performance of a contract with you, or steps you have asked us to take before entering into one
Keeping accounting, tax and VAT records; applying the correct VAT treatment, including EU reverse charge	Legal obligation
Sending licence expiry reminders, and one reminder about items left in your basket	Legitimate interests: helping you avoid an interruption to your licence or finish a purchase you started, and retaining our customers
Checking eligibility for free academic licences	Legitimate interests: only granting academic licences to people who qualify for them
Keeping the Service secure: server logs, blocking abusive traffic, detecting automated sign-ups, investigating errors, and preventing payment fraud	Legitimate interests: protecting the Service, our customers and us from fraud and misuse
Establishing, exercising or defending legal claims, and responding to lawful requests from public authorities	Legitimate interests, or legal obligation where the law requires it

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms, and concluded they are not. You can object to this processing at any time (see "Your data protection rights" below).

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

Retention of Data

Reverse POCO Limited will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy:

Account data is kept while your account is open. You can delete your account at any time from the Personal data page of your account.
Order, invoice and VAT records are kept for as long as we need them to administer licences and run our business, and in any case for at least six years after the end of the financial year they relate to, as UK tax law requires. If you delete your account, these records are detached from it but kept.
Usage Data in server and security logs is kept for 180 days and then deleted.
Correspondence is kept for as long as needed to deal with your enquiry and any follow-up, and for up to six years where it relates to an order or a potential legal claim.

Transfer of Data

We are based in the United Kingdom. If you are located outside the United Kingdom and choose to provide information to us, we transfer your data, including Personal Data, to the United Kingdom and process it there.

Some of our Service Providers, or their sub-processors, may process Personal Data outside the United Kingdom, including in the European Economic Area (EEA) and the United States. Where that happens we make sure the transfer is protected, by relying on UK adequacy regulations (for example for the EEA, or for US organisations certified under the UK Extension to the EU-US Data Privacy Framework) or on the ICO's International Data Transfer Agreement or International Data Transfer Addendum to the EU Standard Contractual Clauses.

Disclosure of Data

We share Personal Data only with our Service Providers (see below), with professional advisers such as our accountants where needed to run our business, and in the circumstances described in this section.

Business Transaction

If Reverse POCO Limited is involved in a merger, acquisition or asset sale, your Personal Data may be transferred. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

Disclosure for Law Enforcement

Under certain circumstances, Reverse POCO Limited may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court, HM Revenue & Customs or another government agency).

Legal Requirements

Reverse POCO Limited may disclose your Personal Data in the good faith belief that such action is necessary to:

To comply with a legal obligation
To protect and defend the rights or property of Reverse POCO Limited
To prevent or investigate possible wrongdoing in connection with the Service
To protect the personal safety of users of the Service or the public
To protect against legal liability

Security of Data

We protect your data by serving the Service only over HTTPS, storing passwords only as salted hashes, offering two-factor authentication on accounts, and keeping card details off our servers entirely.

The security of your data is important to us but remember that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

"Do Not Track" and Global Privacy Control

We do not track visitors across other websites and we do not use analytics or advertising trackers, so the Service behaves the same whether or not your browser sends a Do Not Track or Global Privacy Control signal.

Your data protection rights

Under UK GDPR (and EU GDPR where applicable) you have certain data protection rights. Reverse POCO Limited aims to take reasonable steps to allow you to correct, amend, delete or limit the use of your Personal Data.

If you wish to see the Personal Data we hold about you, or to have it removed from our systems, please log in and click on the account link (top right). Once on the Manage your account page, click on the "Personal data" link, where you can download or delete your data.

In certain circumstances, you have the following data protection rights:

The right of access. You have the right to a copy of the Personal Data we hold about you.
The right of rectification. You have the right to have your information rectified if that information is inaccurate or incomplete.
The right to erasure. You have the right to ask us to delete your Personal Data, except where we must keep it, for example in order records that UK tax law requires us to retain.
The right to object. You have the right to object to our processing of your Personal Data where we rely on legitimate interests.
The right of restriction. You have the right to request that we restrict the processing of your personal information.
The right to data portability. You have the right to be provided with a copy of the information we have on you in a structured, machine-readable and commonly used format.
The right to withdraw consent. You also have the right to withdraw your consent at any time where Reverse POCO Limited relied on your consent to process your personal information.

To exercise any of these rights, email Privacy@ReversePoco.co.uk. We will respond within one month. We may extend this by up to two further months for complex requests, and we will tell you if we do. We may ask you to verify your identity before responding to such requests.

Complaints

If you are unhappy with how we have handled your Personal Data, please complain to us first at Privacy@ReversePoco.co.uk. We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed of our progress, and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk/make-a-complaint or on 0303 123 1113. If you are in the European Economic Area (EEA), you may also complain to your local data protection authority.

Service Providers

We employ third party companies to facilitate our Service ("Service Providers"). These third parties have access to your Personal Data only to perform these tasks on our behalf and are obligated not to disclose or use it for any other purpose.

Microsoft Azure hosts the Service, its database, file storage and server logs.
Amazon Web Services (Simple Email Service, Ireland region) delivers the emails we send you.
Braintree, a PayPal service, processes card payments (see "Payments" below).

Payments

We provide paid products and services within the Service, and we use a third-party payment processor to take payment.

We will not store or collect your payment card details. That information is provided directly to our third-party payment processors whose use of your personal information is governed by their Privacy Policy. These payment processors adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, MasterCard, American Express and Discover. PCI-DSS requirements help ensure the secure handling of payment information.

The payment processors we work with are:

Braintree

Their Privacy Policy can be viewed at https://www.braintreepayments.com/gb/legal/braintree-privacy-policy

Links to Other Sites

Our Service may contain links to other sites that are not operated by us. If you click a third party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Children's Privacy

The Service is intended for business users and is not directed to children. We do not knowingly collect personal data from children.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. When we do, we will post the new Privacy Policy on this page and update the "effective date" at the top. If we make a material change to how we use your Personal Data, we will also let you know by email and/or a prominent notice on our Service before the change takes effect.

You are advised to review this Privacy Policy periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy, please contact us:

By email: Privacy@ReversePoco.co.uk
By phone: +44 1952 410424
By mail: Reverse POCO Limited, 8 Deer Park Drive, Newport, Shropshire. TF10 7HB, UK