Privacy notice

To buy a shipping label we have to tell a carrier who is sending a parcel and who is receiving it. That is the heart of what we do with personal data, and this notice explains the rest of it.

1. Who we are

ParcelPointPro Ltd is the data controller for the personal data described in this notice. You can reach us about anything on this page at support@parcelpointpro.com.

2. What we collect

Account details

The name, work email address, telephone number and job role of the people who use the account, the business name, trading and collection addresses, and VAT number where you give one. We also record which team member did what in the platform, so that account activity can be explained later.

Shipment data

For every label you buy: the sender's name, address, postcode, telephone number and email address; the recipient's name, address, postcode, telephone number and email address; a description of the contents and their declared value; parcel weights and dimensions; the service chosen; and the tracking events the carrier returns as the parcel moves. Saved address books and CSV uploads are stored against your account until you delete them.

Billing data

Records of balance top-ups, label purchases, refunds and carrier adjustments. Card details are handled by our payment processor and are not stored on our systems; we keep only a payment reference and the last four digits, so a transaction can be identified.

Technical and support data

IP address, browser and device information, sign-in timestamps, security events, API request and response logs, and the content of any support message, email or contact form you send us.

We do not deliberately collect special category data. Please do not put health information, religious details or similar into contents descriptions or support messages.

3. Why we use it, and our lawful basis

• To buy labels from carriers on your behalf and to run your account, take payment and support you. Lawful basis: performance of our contract with you.
• To keep accounting, VAT and customs records and to answer lawful requests from HMRC, Border Force, the police or a regulator. Lawful basis: legal obligation.
• To prevent fraud and abuse, secure the platform and investigate incidents, and to understand how the product is used so we can improve it. Lawful basis: our legitimate interests in operating a safe and workable service, balanced against your rights.
• To send marketing email about services you do not already use. Lawful basis: consent, or the soft opt-in for existing customers. Every message carries an unsubscribe link and withdrawing is free.

We do not sell personal data, and we do not use it for automated decisions that produce legal or similarly significant effects.

4. Data about the people you send to

Most of the personal data flowing through the platform is not yours: it belongs to the people you are sending parcels to. You decide who those people are and what is sent to them, so you are responsible for having a lawful basis to give us their details, and for telling them how their data is used. We process recipient details on your instruction, for the purpose of getting the parcel delivered and for the records the law requires us to keep.

If a recipient contacts us directly about their data, we will help where we can and, where the request is properly yours to answer, pass it to you.

5. Who we share it with

• The carriers. DHL, Evri, Royal Mail and DPD, and any carrier we add later, receive the sender and recipient details, parcel details and contents description needed to print the label and deliver the parcel. Each carrier is an independent controller of that data and handles it under its own privacy notice.
• Customs and border authorities for shipments leaving or entering the UK, where a declaration is legally required.
• Our payment processor, to take top-ups and issue refunds.
• Our suppliers — hosting, email delivery, error monitoring and customer support tooling — who act as our processors under written contracts and may only use the data to provide the service to us.
• Professional advisers, insurers and authorities, where we are required to disclose data by law or need advice on a claim or dispute.
• A buyer, if the business or its assets are ever sold, on terms that keep this notice's protections in place.

6. Sending data outside the UK

Our platform and its data are hosted in the United Kingdom or the European Economic Area. Some of our suppliers, and the carriers themselves, process data outside the UK — unavoidably so when you send a parcel abroad, because the destination network needs the address to deliver it.

Where data leaves the UK we rely on the UK government's adequacy regulations, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with additional safeguards where a transfer risk assessment calls for them.

7. How long we keep it

• Shipment and billing records: seven years from the end of the accounting period, which is the period HMRC requires for VAT and company records.
• Account and user records: for as long as the account is open, then seven years alongside the billing records they explain.
• Label images and manifests: 12 months, after which the shipment record remains but the printable label does not.
• API request logs: 30 days, then deleted.
• Support and contact form messages: 24 months from the last message in the thread.
• Marketing contacts: until you unsubscribe, plus a suppression record so we do not contact you again by mistake.

8. Your rights under UK GDPR

Under the UK GDPR and the Data Protection Act 2018 you have the right to:

• Be informed about how your data is used, which is what this notice is for.
• Access a copy of the personal data we hold about you.
• Rectification of data that is inaccurate or incomplete. Most account and address data can be corrected in the platform straight away.
• Erasure — to have your data deleted where we no longer need it. We will delete what we can, but we cannot erase records we are legally required to keep, such as shipment and billing records within their seven-year period; those are restricted from further use instead and deleted when the period ends.
• Restrict processing while a dispute about accuracy or legitimate interests is resolved.
• Data portability — to receive the data you gave us in a machine-readable format. Shipments, statements and address books export to CSV from the platform without needing to ask.
• Object to processing based on legitimate interests, and to object to direct marketing at any time, which we will always honour.
• Withdraw consent where we relied on it, without affecting anything done before you withdrew it.

Email support@parcelpointpro.com to exercise any of these. We respond within one month and will not charge you. We may ask for proof of identity before releasing data, so that we do not hand it to the wrong person.

9. Cookies

We use strictly necessary cookies to keep you signed in, to protect forms against cross-site request forgery and to remember your light or dark theme preference. These do not require consent because the service cannot work without them.

We do not use advertising cookies and we do not permit third-party tracking on this site. If we ever add analytics beyond aggregate server-side counts, we will ask for consent first and update this notice.

10. How we protect it

Traffic is encrypted in transit, data is encrypted at rest, passwords are stored hashed, and access is limited to staff who need it for their work and logged when used. API keys are scoped and can be revoked instantly. Card details never touch our servers.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to people's rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours and tell affected customers where the law requires it.

11. Children

The platform is sold to businesses and is not directed at children. We do not knowingly create accounts for anyone under 18. If you believe a child's data has reached us, tell us and we will remove it.

12. Changes to this notice

We update this notice as the service changes, for instance when a carrier or supplier is added. The date at the top always shows the current version. Where a change materially affects how your data is used, we will tell account holders by email before it takes effect.

13. Contacting us and the ICO

Ask us first: support@parcelpointpro.com. We would rather fix a problem than have you take it elsewhere unresolved.

You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office, at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, by telephone on 0303 123 1113, or through ico.org.uk.