1Who we are
CloudDespatch is provided by CloudDespatch Ltd, registered in England and Wales with company number 00000000. Our registered office is [registered address].
For anything about personal data, contact our data protection lead, [data protection contact name], at privacy@clouddespatch.com or by post to the registered office.
2Our two roles
We handle personal data in two different capacities, and the rules differ for each.
- Controller, for our customers’ data
- When a company signs up, we decide how account, billing and usage data about that company and its users is handled. For this data we are the controller.
- Processor, for buyers’ data
- When a company uses CloudDespatch to fulfil orders, the names, addresses and order details of its buyers are processed on that company’s instructions. The company is the controller and we are its processor, under the data processing terms in our terms of service.
3What we collect about our customers
- Account details: company name, web address, warehouse names, and each user’s name, work email and role.
- Sign-in data: hashed passwords, two-step sign-in settings, and which sign-in methods are switched on.
- Billing details: plan, invoices and payment status. Card details are handled by our payment provider; we keep only the last four digits.
- Usage and security logs: sign-ins, IP addresses, browser type and actions taken in the app, used to keep accounts secure and fix faults.
- Messages you send us: support requests and contact-form messages.
We use this to provide and bill for the service, keep it secure, answer support requests and tell you about changes to the service. Our lawful bases are performance of our contract with you, our legitimate interests in running a secure service, and legal obligations such as keeping tax records.
4Buyer data we process for our customers
To import, pick, pack and ship orders, CloudDespatch receives buyer data from the sales channels a customer connects: name, delivery address, phone number or email where the channel provides it, items ordered and the order value.
We only use buyer data to fulfil that customer’s orders, on that customer’s instructions. In particular:
- Buyer data is shared only with the courier chosen for the parcel and the sales channel the order came from.
- We never send marketing to marketplace buyers, and we don’t let buyer data be used for anyone else’s marketing.
- Buyer data is never used for model training, profiling or advertising.
- Marketplace buyer data is removed 30 days after the order ships, or sooner where a marketplace’s rules require it.
If you are a buyer and want to exercise your data rights, the quickest route is the seller you bought from. You can also contact us and we will pass your request to them.
5How long we keep data
| Data | How long |
|---|---|
| Marketplace buyer details | 30 days after shipment, then deleted automatically |
| Order records without buyer details | While the customer’s account is open |
| Security and access logs | 12 months, then deleted automatically |
| Account and user details | While the account is open, then 90 days after closing |
| Invoices and billing records | 6 years, to meet UK tax rules |
| Backups | Overwritten on a 35-day cycle |
7How we protect data
Data is encrypted in transit and at rest. Staff and administrators sign in with multi-factor authentication, access follows least privilege, and every administrative action is logged. Read the full security policy.
8Your rights
Under UK GDPR you can ask us to:
- give you a copy of the personal data we hold about you
- correct data that is wrong or incomplete
- delete your data where we no longer need it
- restrict or object to how we use it
- move data you gave us to another service
Email privacy@clouddespatch.com. We reply within one month. If you’re unhappy with how we handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We’d appreciate the chance to put things right first.
10Changes to this policy
When we change this policy we update the date at the top. If a change affects how we use your data, we email account owners at least 30 days before it takes effect.