Data Protection Policy

Summary. This internal policy explains how we comply with UK data protection law when we handle personal data, as a controller for our own business and as a processor for our clients, including data received through online marketplace APIs.

Scope and roles

This policy applies to all personal data we handle and to all personnel. We are the controller for our own business data (for example website enquiries and client contacts). When we process personal data on behalf of clients or sellers, such as order and buyer data received through marketplace APIs, we act as a processor and follow their documented instructions.

The Director is responsible for data protection compliance and is our privacy contact. Because of the nature and scale of our processing, we are not required to appoint a statutory Data Protection Officer. We keep this under review.

Data protection principles

• Lawful, fair and transparent: we have a lawful basis for each use of data and explain it in our Privacy Policy.
• Purpose limitation: data is used only for the purpose it was collected or authorised for. Marketplace data is used only to provide the service the seller authorised, and never for advertising, profiling or resale.
• Data minimisation: we request only the API scopes and fields we need.
• Accuracy: data is kept up to date by syncing from the source system and correcting errors promptly.
• Storage limitation: data is deleted in line with the retention schedule below.
• Security: data is protected by the controls in our Information Security Policy.
• Accountability: we keep records of our processing activities and review this policy regularly.

Where data is stored

Production systems and data are hosted by our hosting provider in a data centre in Germany (European Economic Area), which the UK recognises as providing adequate protection. Personnel access data from the United Kingdom. We do not transfer personal data to other countries unless appropriate safeguards are in place.

Individuals’ rights and data requests

• We respond to requests to access, correct, delete, restrict, object to processing of, or port personal data within one month.
• Where we are a processor, we promptly pass any request we receive to the relevant client or seller. We then help them, and where relevant the marketplace platform, to find, update, provide or delete the data within their required timescales.
• Requests and their outcomes are logged.

Personal data breaches

Suspected breaches are reported and handled under the Incident Response Policy. Affected clients, sellers and marketplace partners are notified without undue delay, and within 24 hours of confirmation. The ICO is notified within 72 hours where required.

Retention schedule

End of contract

When a contract or seller authorisation ends, we stop processing, delete all personal data collected for that client or seller from live systems within 30 days (it then expires from backups within the backup retention period), and confirm deletion in writing on request. The only exception is data the law requires us to keep.

Suppliers and sub-processors

We use only suppliers that give sufficient guarantees about data protection, under written terms that meet UK GDPR requirements. We tell clients about our sub-processors on request and before making material changes.

Training and review

Personnel are briefed on this policy when they join and at least annually. This policy is reviewed at least annually and whenever the law or our processing changes.