1. Who we are
Prep Online Ltd is a company registered in England and Wales, company number 14354300. Our registered office is 18 Lumen Road, Wembley, HA9 7RE, United Kingdom. We provide Amazon FBA preparation, 3PL order fulfilment, storage and wholesale. We also sell products through our own shops on online marketplaces, including Amazon and Temu.
We decide how and why we use your personal data, so we are its “controller” under UK data protection law (the UK GDPR and the Data Protection Act 2018). We are registered with the Information Commissioner’s Office (ICO) as a data controller.
Contact us about your data: support@prep-online.co.uk, phone 07432 623138, or write to us at the address above.
2. The personal data we collect
| Who you are | What we collect | Where it comes from |
|---|---|---|
| A business customer, or someone who asks us for a quote (prep, fulfilment, storage, wholesale, brand partnership) | Name, business name, job title, email, phone, business address, what you tell us about your stock and needs, orders, invoices and payments, and our messages with you (email, phone, Slack for Priority members) | From you |
| A trade customer with an account on our website | Your sign-in details (name, email address) and your account activity | From you |
| A shopper who buys from one of our marketplace shops | Name, delivery address, phone number if the marketplace gives it, what you ordered, delivery tracking, returns, refunds and messages about your order | From the marketplace (for example Amazon or Temu) |
| A customer of a business that uses our fulfilment service | Name, delivery address, phone number if given, and what was ordered | From that business (see section 4) |
| A supplier, or someone who works for one | Name, business contact details, and our messages and orders | From you or your company |
| A visitor who uses our contact form | Your name, your company (optional), your email address and your message | From you |
We do not collect special category data (for example health information) about you. We do not sell your personal data, and we do not use shoppers’ details for marketing.
3. Why we use it, and our legal basis
| Why | Legal basis |
|---|---|
| To give a quote, set up an account, prepare and store stock, and fulfil, deliver and invoice orders | Contract: we need it to do what you asked or agreed |
| To deliver marketplace orders and handle returns, refunds, delivery problems and claims | Contract with the shopper, and our legitimate interest in running our shops |
| To answer your messages and keep a record of them | Legitimate interest in running and improving our business |
| To keep accounting and tax records | Legal obligation |
| To prevent fraud, keep our systems and accounts secure, and defend legal claims | Legitimate interest |
Where we rely on legitimate interest, we have checked that it does not override your rights. You can object at any time (section 8).
4. When we fulfil orders for another business
When a business uses our fulfilment service, we receive its customers’ delivery details only to pick, pack and ship their orders. For that data, the business is the controller and we are its “processor”: we use the data only on its instructions and under our contract with it. If you are one of its customers, its privacy notice explains how your data is used. Contact that business first; we will help it answer you.
5. Who we share it with
We share personal data only with organisations that help us run the business, and only what each one needs:
- Marketplaces that send us your order and handle your payment: Amazon and Temu.
- Order and stock management: Base.com (BaseLinker), which holds order and delivery details so we can process and ship orders.
- Delivery: Amazon Shipping and Royal Mail deliver the parcels we send. Amazon delivers the orders it fulfils from its own warehouses.
- Our website: it is hosted by Vercel. Sign-in for trade accounts is run by Clerk.
- Email, files and chat: Microsoft (Microsoft 365 email), Google (Gmail and Google Drive) and Slack (support for Priority members).
- Our own business systems: our server is hosted by Hostinger in the United Kingdom, and our database by Supabase in Ireland (on Amazon Web Services). These hold order numbers, order totals and stock records. They do not hold shoppers’ names or addresses.
- AI services that help us sort incoming email and draft replies: Anthropic and OpenAI. We use them only under terms that do not let them train their models on our data. A member of our team approves every reply before it is sent.
- Our bank and our accountants, for payments and accounting.
- Public bodies such as HMRC, when the law requires it.
Each provider that handles personal data for us does so under a written contract that requires it to keep the data secure and to use it only for the service it provides to us.
6. Data sent outside the UK
Some providers process data outside the UK: Supabase and Base.com in the European Union, and Microsoft, Google, Slack, Amazon, Vercel, Clerk, Anthropic and OpenAI partly in the United States. The UK recognises the European Union as giving adequate protection. For the United States, we rely on the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or on standard contractual clauses with the UK International Data Transfer Addendum.
7. How long we keep it
| Data | How long |
|---|---|
| Invoices, payments and other accounting records | 6 years after the end of the financial year they belong to (HMRC) |
| Business data: business customer, trade account and supplier records | While we work together, then 6 years |
| Consumer data: shoppers’ names, delivery addresses and phone numbers | Deleted within 30 days after the order is complete (delivered, and any return, refund or claim closed). The order record itself (order number, items and amounts, with no name or address) is an accounting record and is kept for 6 years |
| Delivery details we hold for a fulfilment client | As our contract with that client says, and never longer than we need to ship the order and handle problems with it |
| Contact form messages and enquiries that do not lead to business | 2 years after our last contact |
After that, we delete the data or remove the details that identify you.
8. Your rights
You have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct data that is wrong or incomplete;
- ask us to delete your data;
- ask us to limit how we use it;
- object to our use of it where we rely on legitimate interest;
- ask us to send data you gave us to another organisation (data portability).
To use a right, email support@prep-online.co.uk. We answer within one month. We may need to confirm who you are first. These rights have limits: for example, we must keep accounting records for the time the law sets.
Complaints. If you are unhappy with how we use your data, please tell us first. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, phone 0303 123 1113.
9. Cookies
Our website uses only the cookies it needs to work, such as the sign-in cookies that our sign-in provider, Clerk, sets when a trade customer logs in. It does not use analytics, advertising or tracking cookies.
10. Keeping your data safe
We limit who can see personal data to the people and systems that need it. Our websites and business systems use encrypted connections, and the keys that open them are kept in a secure secrets store, not in files or emails. We have a written process for data breaches, including telling the ICO and the people affected where the law requires it.
11. Changes to this policy
We will update this policy when the way we use personal data changes. The date at the top shows when it last changed.