Privacy Policy

5and20to is the trading name of 5and20to Limited, a company registered in England under company number 17370482

Our registered office is:

The Corner House, 2 High Street, Aylesford, Kent. ME20 7BG

You can contact us at:

Email: Info@5and20to.co.uk
Telephone: +44 1732 44 4567

References in these terms to “5and20to”, “we”, “us” or “our” mean 5and20to Limited.

​

For the purposes of UK data protection law, 5and20to Limited is the controller of the personal information described in this policy.

This policy explains how we collect, use, retain and share personal information when you:

• Visit our website;

• Create an account or contact us;

• Purchase, reserve or enquire about a watch;

• Ask us to source a watch;

• Sell or part-exchange a watch;

• Visit our premises;

• Subscribe to marketing;

• Enter a competition or promotion; or

• Otherwise interact with 5and20to.

This policy should be read alongside our Terms and Conditions, Returns and Refunds Policy and Cookie Policy.

Depending on how you interact with us, we may collect the following information.

Identity information

This may include your:

• Name;

• Title;

• Date of birth, where reasonably required;

• Username or account identifier;

• Signature; and

• Photographic identification.

Contact information

This may include your:

• Billing and delivery addresses;

• Email address;

• Telephone number; and

• Communication preferences.

Transaction information

This may include:

• Watches or services purchased, reserved, sourced, sold or part-exchanged;

• Order numbers;

• Dates and values of transactions;

• Deposits, refunds and payment status;

• Delivery and collection information;

• Warranty and repair history; and

• Communications relating to a transaction.

Payment information

We process card payments using a physical card terminal supplied and operated by our payment-service provider.

When you make a card payment, the terminal and payment provider may process:

• The cardholder’s name, where available;

• Card type and issuing network;

• A masked card number, normally showing only the final four digits;

• Transaction amount, date and time;

• Authorisation and transaction reference numbers;

• Payment, decline, chargeback and refund status; and

• Information used to detect or prevent fraudulent transactions.

Complete card numbers, PINs and card security codes are processed securely through the card terminal and payment provider. 5and20to does not retain this information.

We may retain merchant receipts and transaction records containing masked payment information where necessary for accounting, refunds, chargebacks, fraud prevention and legal compliance.

Card refunds will be returned to the card or payment method used for the original transaction. Our card-machine provider, acquiring bank and card network may act as separate controllers and process information under their own privacy policies.

Watch ownership and provenance information

Where you sell or part-exchange a watch, we may collect:

• Brand, model and serial number;

• Photographs and condition information;

• Purchase and service history;

• Proof of ownership;

• Previous transaction information;

• Warranty documentation; and

• Information relevant to authenticity or lawful provenance.

Verification and fraud-prevention information

For high-value transactions, we may collect or obtain:

• Proof of identity;

• Proof of address;

• Payment ownership information;

• Results of electronic identity checks;

• Fraud-prevention indicators;

• Sanctions or politically exposed person screening results, where appropriate;

• Source-of-funds information, where reasonably required or required by law; and

• Information indicating suspected theft, fraud or unlawful activity.

Website and technical information

When you use our website, we may collect:

• Internet Protocol address;

• Browser, device and operating-system information;

• Approximate location derived from an IP address;

• Pages viewed and links selected;

• Referring website;

• Login and account activity;

• Shopping-basket activity;

• Cookie identifiers; and

• Website error and security logs.

More information appears in our Cookie Policy.

Communications

We may retain emails, telephone notes, messages, website enquiries, social-media messages, complaints, reviews and other communications with you.

Telephone calls will only be recorded if we tell you that recording is taking place.

Marketing information

This may include:

• Whether you have agreed or objected to receiving marketing;

• Products or brands in which you have expressed an interest;

• Marketing messages opened or selected, where permitted;

• Competition or event participation; and

• Your communication preferences.

We obtain personal information:

• Directly from you;

• When you use our website or create an account;

• From payment, identity-verification and fraud-prevention providers;

• From delivery and insurance providers;

• From online marketplaces through which you contact or purchase from us;

• From publicly accessible sources;

• From stolen-watch, sanctions or fraud-prevention databases, where appropriate;

• From social media platforms;

• From a person acting on your behalf; and

• From previous owners or counterparties where relevant to a watch’s provenance.

If you provide information about another person—for example, a delivery recipient—you must ensure that you are authorised to do so.

UK data protection law requires us to have a lawful basis for each use of personal information.

Orders and contracts

We use identity, contact, payment and transaction information to:

• Respond to pre-purchase requests;

• Process and fulfil orders;

• Take payment;

• Arrange delivery or collection;

• Manage reservations, deposits and sourcing requests;

• Process returns and refunds;

• Provide warranty and repair services; and

• Communicate about a contract.

Our lawful basis is that the processing is necessary to take steps at your request before entering a contract or to perform our contract with you.

Selling and part-exchanging watches

We use identity, contact, watch, ownership, provenance and payment information to:

• Assess a watch;

• Provide or revise a valuation;

• Verify ownership and authenticity;

• Complete a purchase or part-exchange;

• Make payment; and

• Keep a record of the transaction.

Our lawful bases are performance of a contract, steps requested before entering a contract, compliance with legal obligations and our legitimate interests in purchasing authentic, lawfully owned goods.

Identity checks and fraud prevention

We may use identity, payment, technical, watch and verification information to:

• Confirm identity and payment ownership;

• Protect customers and our business;

• Detect and prevent fraud;

• Identify stolen or unlawfully obtained watches;

• Protect high-value deliveries;

• Establish, exercise or defend legal claims; and

• Report suspected criminal activity where appropriate.

Our lawful bases are compliance with legal obligations and our legitimate interests in preventing fraud, protecting property, securing transactions and maintaining accurate provenance records.

Where applicable, we may also rely on a recognised legitimate interest permitted by UK data protection law.

Legal and regulatory compliance

We use and retain information where necessary to:

• Maintain accounting and tax records;

• Respond to lawful requests from regulators or law-enforcement bodies;

• Comply with court orders;

• Meet applicable anti-money-laundering or sanctions obligations;

• Protect consumer rights; and

• Demonstrate compliance with applicable law.

Our lawful basis is compliance with a legal obligation. We may also rely on our legitimate interests in maintaining appropriate business and legal records.

Website operation and security

We use technical information to:

• Operate and maintain our website;

• Keep accounts and transactions secure;

• Diagnose errors;

• Prevent misuse and cyberattacks;

• Analyse website performance; and

• Improve navigation and customer experience.

We rely on our legitimate interests in operating a secure and effective business for essential website processing.

Where cookies or similar technology require consent, we rely on your consent.

Customer service and business administration

We use identity, contact, transaction and communication information to:

• Answer enquiries;

• Handle complaints;

• Maintain business records;

• Train staff;

• Improve our products and services; and

• Manage disputes.

We rely on performance of a contract, compliance with legal obligations and our legitimate interests in providing customer service and managing our business.

Marketing

We may use your contact details and purchasing interests to send information about watches, events, services and offers.

We will send electronic marketing where:

• You have consented; or

• The law permits us to contact an existing customer about similar products and we gave that customer an opportunity to opt out.

You can unsubscribe at any time by selecting the unsubscribe link in a marketing email or contacting Customer.Service@5and20to.co.uk

We rely on consent or legitimate interests as appropriate, together with the requirements of the Privacy and Electronic Communications Regulations.

We will not use legitimate interests for electronic marketing where the law requires consent.

Where we rely on legitimate interests, those interests include:

• Operating and improving our business;

• Providing effective customer service;

• Maintaining accurate transaction and provenance records;

• Protecting customers, staff and property;

• Preventing fraud, theft and misuse;

• Securing our website and payment processes;

• Understanding how customers use our website;

• Establishing, exercising and defending legal claims; and

• Promoting relevant products where permitted.

We consider whether using personal information is necessary and balance these interests against your rights and reasonable expectations.

Some personal information is needed to enter into or perform a contract, comply with legal requirements, verify a high-value transaction or arrange secure delivery.

If you do not provide requested information, we may be unable to:

• Accept or complete an order;

• Release or deliver a watch;

• Process a refund;

• Purchase or accept a part-exchange watch;

• Provide a warranty service; or

• Complete required verification checks.

We will explain when providing particular information is mandatory.

Where necessary, we may share personal information with:

• Website hosting and ecommerce providers;

• Payment processors, banks and finance providers;

• Accountants, auditors and professional advisers;

• Delivery, logistics and insurance providers;

• Identity-verification and fraud-prevention providers;

• Watchmakers, repair centres and manufacturers;

• Customer-service and communications providers;

• Analytics and marketing providers;

• Cloud-storage and information-technology providers;

• Online marketplaces through which a transaction occurs;

• Government bodies, regulators, courts and law-enforcement agencies;

• Prospective purchasers or advisers involved in a sale or restructuring of our business; and

• Other organisations where disclosure is required or permitted by law.

Where a service provider processes information on our behalf, we require it to protect that information and use it only for authorised purposes.

Certain organisations, such as banks, payment providers, marketplaces and delivery companies, may act as separate controllers. Their own privacy policies will explain how they use personal information.

We do not sell personal information.

Some service providers may store or access personal information outside the United Kingdom.

Where a restricted international transfer occurs, we will ensure it is covered by a lawful transfer mechanism, such as:

• UK adequacy regulations;

• The UK International Data Transfer Agreement;

• The UK International Data Transfer Addendum;

• Another legally permitted safeguard; or

• A specific legal exception where appropriate.

Where required, we assess whether the transferred information will receive an appropriate standard of protection.

You can contact Customer.Service@5and20to.co.uk for more information about the safeguards applying to a particular transfer.

We retain personal information only for as long as reasonably necessary for its purpose, including legal, tax, accounting, fraud-prevention and reporting requirements.

Our usual retention periods are:

• Order, invoice and core transaction records: six years after the end of the relevant accounting period;

• Contract, warranty and repair records: six years after the transaction or completion of the service;

• Part-exchange, ownership and provenance records: six years after the transaction, or longer where reasonably necessary to preserve an ownership or authenticity history;

• General enquiries that do not result in a transaction: 24 months after the last communication;

• Unsuccessful identity-verification material: 90 Days unless longer retention is justified;

• Fraud and dispute records: for the duration of the investigation and up to six years after resolution;

• Marketing information: until you unsubscribe, withdraw consent or we determine that the information is no longer current;

• Marketing suppression records: for as long as reasonably necessary to ensure we respect your objection;

• Cookie information: for the periods stated in our Cookie Policy.

These periods should be adjusted where a longer or shorter period is required by law or justified by the circumstances.

We securely delete or anonymise information when it is no longer required.

We use appropriate organisational and technical measures intended to protect personal information against accidental loss, unauthorised access, alteration or disclosure.

These measures may include:

• Access controls;

• Multi-factor authentication;

• Encryption;

• Secure payment providers;

• Staff access restrictions;

• Supplier due diligence;

• Security monitoring; and

• Procedures for responding to personal-data breaches.

No internet or storage system is completely secure. You are responsible for keeping account passwords confidential and notifying us if you suspect unauthorised account use.

Our website may use cookies and similar technologies for:

• Essential website functions;

• Security and fraud prevention;

• Remembering preferences;

• Shopping-basket operation;

• Analytics; and

• Advertising or marketing measurement.

We will ask for consent before using non-essential cookies where required by law.

Further information, including the cookies used and their duration, appears in our Cookie Policy.

Payment, identity-verification and fraud-prevention providers may use automated systems to generate risk indicators or decide whether to provide their services.

5and20to does not make decisions based solely on automated processing that produce legal or similarly significant effects. Any Automated decisions are recommendations and are fully verified and agreed by human prior to any implementation 

Our website and services are not directed at children, and customers must be at least 18 years old to enter into a purchase contract with us.

If you believe a child has provided personal information without appropriate authority, contact Customer.Service@5and20to.co.uk

Depending on the circumstances and lawful basis, you may have the right to:

• Be informed about how we use your information;

• Request access to your personal information;

• Ask us to correct inaccurate or incomplete information;

• Ask us to erase information;

• Ask us to restrict processing;

• Object to processing based on legitimate interests;

• Object at any time to direct marketing;

• Receive certain information in a portable format;

• Withdraw consent at any time; and

• Raise concerns about qualifying automated decisions.

These rights are not absolute and exemptions may apply.

The right to object to direct marketing is absolute. If you object, we will stop using your information for that purpose.

Withdrawing consent does not affect processing carried out before consent was withdrawn.

To exercise a right, contact:

Email: Customer.Services@5and20to.co.uk

Please explain your request and identify the information concerned.

We may request information reasonably necessary to verify your identity. This helps prevent personal information being disclosed to an unauthorised person.

We normally respond within one month. If a request is complex or involves multiple requests, the law may permit additional time. We will tell you if an extension applies.

You will not normally be charged, although the law permits a reasonable fee or refusal in limited circumstances involving manifestly unfounded or excessive requests.

Please contact us first if you have concerns about how we use personal information:

Email: Customer.Services@5and205to.co.uk

You also have the right to complain to the Information Commissioner’s Office.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/

Our website may contain links to websites operated by manufacturers, marketplaces, payment providers or other third parties.

We do not control those websites or their privacy practices. You should read the relevant third party’s privacy policy before providing personal information.

We may update this policy to reflect changes in our business, service providers or legal obligations.

The current version will be published on our website with its revision date. Where a change materially affects how we use existing personal information, we will provide additional notice where required.

5and20to
5and20to Limited
Customer.Service@5and20to.co.uk
+44 1732 44 4567

These Terms and conditions were last updated in September 2026