Privacy Policy
Effective date: 10 July 2026
1. Who we are
PickPackTrack ("we", "us") provides order fulfilment software to retail merchants ("Merchants"). For privacy enquiries or to exercise your rights, contact privacy@pickpacktrack.com (data protection contact: Jamie Barke).
2. Our two roles
- Controller — for data about the Merchant and its users (account, billing, usage). This policy governs that processing.
- Processor — for the personal data of a Merchant's own customers (order names, addresses, contact details), which we process only on the Merchant's instructions to fulfil their orders. That processing is governed by our Data Processing Agreement with the Merchant; the Merchant is the controller and its own privacy notice applies to its customers.
3. Personal data we process
Merchant account data (as controller): name, work email, business details, authentication data, billing details, and app usage/audit logs.
Merchant customers' data (as processor, on the Merchant's behalf): order recipient name, shipping/billing address, email, phone, order contents and any buyer notes — imported from the Merchant's sales channels to produce shipping labels and delivery notifications.
4. Why we process it & legal basis
- Provide and operate the service (performance of contract / legitimate interests).
- Produce shipping labels and pass tracking to carriers/channels (processor, on instruction).
- Security, fraud prevention, and legal/tax compliance (legal obligation / legitimate interests).
We process the minimum data needed and use it only for these purposes.
5. Sharing & sub-processors
We share data only as needed to run the service, with vetted sub-processors under contract who are permitted to use it only to provide their service to us. We do not sell personal data.
| Sub-processor | Purpose | Location |
|---|---|---|
| DigitalOcean | Cloud hosting and infrastructure | EU / UK |
| Stripe | Subscription billing and payment processing | UK / EU / US |
| Backblaze B2 | Encrypted off-site database backups | EU / US |
| Carriers | Shipping labels and tracking (Royal Mail, DPD, Evri, DHL, UPS, DX) | UK / EU |
| Sales channels | Order import and tracking write-back (Shopify, WooCommerce, etc.) | Varies by channel |
6. Cookies
We use only strictly necessary cookies (to sign you in and keep the app secure) and no advertising or tracking cookies. See our Cookie Policy for details.
7. Marketing communications
We may send service and administrative messages (which you cannot opt out of while you have an account). Any marketing emails are sent only where permitted, and you can opt out at any time via the unsubscribe link or by emailing privacy@pickpacktrack.com.
8. International transfers
Where data leaves the UK/EEA, transfers are covered by an adequacy decision or appropriate safeguards (UK IDTA / Standard Contractual Clauses).
9. Retention
We keep personal data only as long as needed. Merchant customers' order PII is automatically anonymised after its retention window — Amazon within 30 days of shipment, own-store channels after 24 months — keeping only anonymised records.
10. Security
TLS in transit; encryption at rest (database and backups); encryption of stored credentials/tokens; multi-factor authentication; role-based access and strict tenant isolation; audit logging and access logging.
11. Your rights
Subject to UK GDPR, you may request access, correction, deletion, restriction, portability, or object to processing. If you are a Merchant's customer, please contact the Merchant (the controller); we will assist them. Requests to us: privacy@pickpacktrack.com. You may also complain to the ICO (ico.org.uk).
12. Changes
We may update this policy; material changes will be notified on this page with a revised effective date.