Privacy notice

This notice explains how Parcel Partner collects and uses personal data, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It covers our customers, the people whose addresses appear on the labels they buy, and visitors to our website.

Parcel Partner is a trading name of TBC, a company registered in England and Wales under company number TBC. Our registered office is TBC. We are the controller of your personal data. We are registered with the Information Commissioner's Office (ICO) under number TBC.

For any question about your data, or to use your rights, email us at hello@parcelpartner.co.uk.

Your account

Your name, email address and password (stored only in a scrambled form we can't read). For a business account, the business name and the members you invite. If you turn on two-step sign-in, the settings for it.

The labels you buy

The sender's name, address, phone number and email address. The recipient's name, address and, if you give them, their company, phone number and email address. A description of the contents, their value, the parcel size and weight, the label itself and its tracking number.

Payments

Stripe processes your payment. We receive the amount, the result, the card brand and last four digits, and the name and email address you gave Stripe. We never receive your full card number.

Support

The messages you send us through the support chat or by email, and our replies.

Technical data

Your IP address and browser details when you sign in or use your account, and records of important actions, such as sign-ins and refunds, to keep accounts secure. Cookies and similar technologies, described in our cookie policy.

If someone sends you a parcel using Parcel Partner, we get your name and address, and sometimes your phone number or email address, from the sender. We use them only to create the label, deliver the parcel and deal with any problem with it. Senders must only give us details they are allowed to share. You have the same rights over this data as our customers (see section 9).

The law only lets us use personal data when we have a lawful basis. Ours are:

• To provide our service: running your account, creating labels, taking payment, sending emails about your orders, refunds and claims, and answering support messages. Basis: performing our contract with you.
• To deliver parcels to recipients: passing the recipient's details to Royal Mail. Basis: our legitimate interest, and the sender's, in getting the parcel delivered.
• To keep the service safe: checking sign-ups are made by people, protecting accounts, and preventing fraud and the sending of prohibited items. Basis: our legitimate interest in a secure service.
• To meet our legal duties: keeping tax and accounting records, and responding to lawful requests from authorities. Basis: legal obligation.
• To understand how our website is used: analytics, only if you agree to analytics cookies. Basis: your consent, which you can withdraw at any time.

The support chat may first be answered by an automated assistant that draws on our help guides. A member of our team takes over whenever you need one. We don't make decisions about you by automated means that have legal or similarly significant effects.

We don't send marketing emails and we don't sell your data.

We share personal data only with organisations that help us run the service, and only what each one needs:

• Royal Mail receives the sender and recipient details on each label to deliver the parcel, and uses them under its own privacy notice.
• Our label provider, a company that creates Royal Mail labels for us, receives the same details to create the label. It acts only on our instructions.
• Stripe processes payments and refunds. It also uses payment data under its own privacy notice to prevent fraud and meet its legal duties.
• Cloudflare hosts our website, databases and files, runs the security check on sign-up, and runs the support chat's automated assistant.
• Resend sends our emails, such as sign-in codes, invitations and order updates.
• PostHog provides website analytics, only if you agree to analytics cookies.

We may also share data with our professional advisers, with the police or other authorities when the law requires it, and with a buyer if our business is ever sold, who would have to protect it in the same way.

Some of our providers, including Cloudflare, Stripe and Resend, process data in the United States or other countries outside the UK. When they do, the transfer is protected by UK adequacy regulations, by the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or by the ICO's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. Email us for more detail on any transfer.

• Your account: while it is open. We delete or anonymise it within 90 days of it closing, apart from the records below.
• Labels, orders and payments, including the addresses on each label: 6 years after the end of the financial year in which the label was bought, for tax and accounting rules and to deal with claims.
• Records of requests to our label provider: 90 days.
• Support conversations: 2 years after the last message.
• Security records of sign-ins and important actions: 90 days.
• Analytics: up to 12 months.

Data is encrypted between your browser and our servers, and access to it is limited to the people and systems that need it. Passwords are stored only in a scrambled form, and you can turn on two-step sign-in for extra protection. If a breach is likely to put you at risk, we will tell you and the ICO as the law requires.

You have the right to:

• get a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted, unless we must keep it by law;
• restrict or object to how we use it;
• receive data you gave us in a format you can take elsewhere;
• withdraw your consent at any time, where we rely on it.

To use any of these rights, email us at hello@parcelpartner.co.uk. It's free, and we reply within one month. We may need to confirm who you are first.

If you're unhappy with how we have used your data, please tell us first so we can try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or by phone on 0303 123 1113.

Our cookie policy lists the cookies and similar technologies we use and how to control them.

Our service is for adults. We don't knowingly collect data from anyone under 18, apart from the name and address of a recipient on a label.

We update this notice when the way we use data changes. The date at the top shows the latest version. If a change matters to you, we will email you before it takes effect.