Privacy Policy

1. Who controls what

Two different sets of data reach us, and we hold them in two different roles. The distinction matters, because it determines who you ask about what.

Your customers' personal data — you are the controller, we are the processor. Names, delivery addresses, contact details and order contents reach us so we can pick, pack and ship your orders. We process them only on your documented instructions, under our Data Processing Addendum. We do not decide what is collected or why, and we do not use it for our own purposes. If one of your customers wants to exercise their rights, the request belongs to you as controller; we will help you answer it.

Your own account and business data — we are the controller. The information you and our partners give us directly: contact names, business email addresses and phone numbers, company details, the operational answers on our intake forms, and the records of our correspondence. We use it to operate the service and to run our side of the relationship.

2. Why we hold it, and on what basis

• To perform our contract with you — delivering fulfilment services, quoting, onboarding, invoicing and support.
• Our legitimate interests — operating, securing and improving the service, keeping records of what was agreed and when, and responding to enquiries from prospective clients and partners. We consider these against your interests before relying on them.
• Legal obligation — accounting, tax and customs records we are required to keep.

Where we process your customers' personal data, the lawful basis for that processing is yours to determine as controller; we act on your instructions.

3. How long we keep it

Personal data is kept to what the purpose needs. End-customer personal data is retained while we are fulfilling for you and for as long afterwards as we need it to resolve queries, returns and disputes, then deleted or returned in line with our agreement with you.

Commercial and operational records are kept as history, not as personal data. Quotes, rates, invoices and the record of what changed and when are maintained on an append-only basis: a later version supersedes an earlier one rather than overwriting it. These records are about businesses and commercial terms. Where a person's name appears in one — as the author of a message or the approver of a change — it is retained as part of that record.

4. Who else sees it

We share personal data only with providers who need it to deliver the service, and each is bound by contractual data protection terms.

• Network Providers — the fulfilment partners who physically hold and ship your stock.
• Shipping carriers — including Royal Mail and the carriers reached through Click & Drop and Parcel2Go, to deliver your orders.
• Platform integrations — Shopify and similar e-commerce platforms, where you connect one.
• Infrastructure and tooling — Supabase, Airtable and our automation and hosting providers.
• Payments — Stripe, for invoicing and payment processing, once payment services are live for your account.

We do not sell personal data, and we do not share it for anyone else's marketing.

Some of these providers operate outside the UK. Where personal data is transferred internationally, we rely on the safeguards required by UK data protection law, such as adequacy regulations or standard contractual clauses.

5. Your rights

Where DropNest is the controller — your account and business data — you can ask us to give you a copy of it, correct it, delete it, restrict or object to how we use it, or provide it in a portable form. You can also object to processing we base on legitimate interests.

Where DropNest is the processor — your customers' personal data — those requests should go to the controller, which is you. Tell us and we will support you in responding.

We will respond within one month. There is no charge for a reasonable request.

6. Security

Access to client data is restricted to the people and systems that need it. Documents and uploads are held in private storage that is not publicly reachable and is served only through short-lived, authenticated links. Access to our systems requires an account we have issued.

7. Complaints and contact

Contact us at support@dropnestfulfilment.com with any question about this policy or about data we hold.

If you are not satisfied with our response, you can complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at ico.org.uk/make-a-complaint. We would rather you came to us first.