Curious, since used sales are in direct competition with new sales, and retailers pay for the UKARA scheme.
I don't think there's much of a GDPR (as was) compliance issue with a yes/no confirmation of details provided. That's the very purpose that the person who provided them wanted them used for. Notionally, you could use this to confirm that Joe Bloggs lives at 62 West Wallaby Street for purposes other than flogging them a RIF, but since you also need the UKARA number then it's
almost certain that Joe has given it to you specifically to allow you to do this.
One thing: if UKARA did leak your data, who would you go after? The site provides absolutely zero contact details, no address, no company number, only the ICO number of ZA031959.
https://ico.org.uk/ESDWebPages/Entry/ZA031959
This (as a matter of public record) give the address of a farmhouse in Cornwall nowhere near any airsoft site or retailer, but not the name of an individual or business.
Data controller: UNITED KINGDOM AIRSOFT RETAILERS ASSOCIATION
Address:
Hollygrove
Woodford
BUDE
CORNWALL
EX23 9JL
Companies House has an entry for a "UKARA LIMITED", involved in "94120 - Activities of professional membership organisations"
https://find-and-update.company-information.service.gov.uk/company/12865652
This was incorporated on 8 September 2020 by one Mr Haroon Al-Rashid Dawood Atchia of 20 Eversley Road, Bexhill-On-Sea, East Sussex, England, TN40 1HE, but it claimed to have gone dormant in 2021, then filed accounts for FY 2022 showing £15,000+ of debt.
All somewhat opaque. I mean, how can you trust someone with your details if you don't know who they are, or how to obtain relief?