01Who we are
Repark is an online retailer and wholesale distributor that sells and fulfils orders across multiple e‑commerce marketplaces. We operate an internal order and inventory management system (“Repark RMS”) to receive, organise, fulfil and account for those orders.
For the purposes of UK data protection law — the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 — the data controller is the legal entity set out in the controller record above.
02Scope of this policy
This policy explains how we handle personal data within the Repark RMS platform. It applies to:
- Customers whose orders we receive and fulfil through connected marketplaces (for example a buyer’s name, delivery address and contact details needed to ship an order).
- System users — our staff and authorised operators who log in to Repark RMS.
- Suppliers and business contacts whose details we hold for purchasing and logistics.
Where you buy through a marketplace such as Temu, B&Q, Amazon, eBay, Shopify or TikTok Shop, that marketplace is also a controller of your data and operates its own privacy policy. We process your order data to fulfil the purchase you made on that marketplace.
03The personal data we process
3.1 Customer / order data
- Recipient name and, where shown, a masked buyer reference (e.g. an***52).
- Delivery address and, where provided, billing address.
- Phone number and a marketplace‑provided (often virtualised) email address.
- Order details: order ID, items purchased, quantities, prices, order and shipping status, and shipping deadlines.
We do not receive or store full payment card numbers — payment is taken by the marketplace.
3.2 System user (staff) data
- Account email address and role/permissions.
- A securely hashed password (stored using the Argon2id algorithm — never in plain text) and, where enabled, a two‑factor authentication (TOTP) secret.
- Trusted‑device identifiers, login and device‑approval records, IP addresses, and security audit logs of actions taken in the system.
3.3 Supplier / business contact data
- Contact names, business email addresses, phone numbers and addresses used for purchase orders, containers and logistics.
04Where we get your data from
- From marketplaces, via their APIs: customer and order data is pulled automatically from the marketplace you ordered on — Temu Open Platform, B&Q (Mirakl), Amazon (Selling Partner API / EDI), eBay, Shopify and TikTok Shop — under our authorised seller connection.
- Directly from you: when staff or suppliers provide information to us.
- Generated by the system: audit logs, sync logs and device records created as you use the platform.
05Why we process your data and our lawful bases
| Purpose | Data used | Lawful basis (UK GDPR) |
|---|---|---|
| Receiving, picking, packing and shipping orders | Customer / order data | Performance of a contract; and our legitimate interests in fulfilling marketplace orders |
| Customer service, returns and queries | Customer / order data | Legitimate interests; performance of a contract |
| Inventory, supplier and logistics management | Supplier / order data | Legitimate interests |
| Operating, securing and auditing the RMS (logins, 2FA, access logs) | System user data | Legitimate interests in securing our systems; legal obligation (security of processing) |
| Keeping accounting and transaction records | Order / financial data | Legal obligation (UK tax and company law) |
| Responding to legal requests and protecting our rights | Any relevant data | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we have balanced those interests against your rights and only process the minimum data needed to fulfil the order or operate the service.
06Marketplace integrations
Repark RMS connects to marketplaces using authorised, token‑based connections (OAuth where the marketplace requires it). For each connected shop we store only the access credentials needed to retrieve orders, and the order data itself. We use this data solely to fulfil and account for the orders placed on that marketplace, in line with the marketplace’s developer and data‑processing terms. We do not use customer data for independent marketing.
07Who we share your data with
We share personal data only where necessary, with:
- Hosting / infrastructure: Amazon Web Services (AWS Lightsail), which hosts the platform and database in its Asia Pacific (Singapore) region, with encrypted backups copied to AWS Europe (London, eu-west-2) in the United Kingdom.
- Shipping and logistics carriers: to deliver orders (name, address and contact details only).
- The originating marketplace: to confirm shipment, tracking and order status.
- Email delivery provider: for transactional / operational email (Google — Gmail SMTP).
- Professional advisers: our accountant and, where needed, legal advisers.
- Authorities: regulators, law enforcement or government bodies where we are legally required to do so.
We do not sell your personal data. All processors act under written terms requiring them to protect your data and use it only on our instructions.
08International data transfers
Our platform and database are hosted by Amazon Web Services in its Asia Pacific (Singapore) region. Because we are a UK-based business, hosting your data in Singapore is a transfer of personal data outside the UK. This transfer is protected by an appropriate safeguard — the International Data Transfer Agreement (IDTA) / UK Addendum to the EU Standard Contractual Clauses that forms part of our agreement with AWS. Some marketplaces and delivery partners may also process data outside the UK under equivalent safeguards. We also hold encrypted backup copies in AWS Europe (London, eu-west-2), within the United Kingdom, so a copy of the data exists outside the live hosting region. We keep a record of these transfers and their safeguards.
09How long we keep your data
| Data | Retention period |
|---|---|
| Buyer personal data — recipient name, delivery and billing address, phone number and marketplace email address. This includes any file rendered from that data, such as shipping labels, invoices and packing documents. | Deleted or irreversibly anonymised within 30 days of confirmed delivery. Where a carrier delivery confirmation is not available, the 30 days run from dispatch — which is earlier than delivery, and therefore stricter. |
| Transaction / accounting records — order identifier, dates, items, quantities, amounts and VAT. These contain no buyer name, address, phone number or email address. | Up to 6 years, to meet UK accounting and tax obligations (Companies Act 2006 / HMRC). |
| System user accounts | While the account is active; deactivated and deleted when staff leave or access is no longer required. |
| Security audit and sync logs | Retained for 400 days, then deleted or anonymised. |
No buyer personal data is retained beyond 30 days. The only order records we keep longer are the transaction and accounting records above, which carry no buyer name, address, phone number or email address. When data is no longer needed for these purposes, we delete it or irreversibly anonymise it.
10How we protect your data
We apply technical and organisational measures appropriate to the risk, including:
- Encryption in transit — all traffic to and from the platform and to marketplace APIs uses TLS 1.3 (HTTPS).
- Encryption at rest — buyer personal data is encrypted with AES‑256‑GCM envelope encryption and stored on encrypted AWS storage; account passwords are hashed with Argon2id and are never stored or transmitted in plain text.
- Strong authentication and password policy — passwords must be at least 12 characters with upper and lower case, a number and a symbol; they are checked against known-breached-password lists, may not contain the user's name or email, cannot reuse the last 10 passwords, and expire after 365 days. Accounts lock after 5 failed attempts within 15 minutes. Login supports time‑based two‑factor authentication (2FA/TOTP), and new devices require explicit approval. Server (OS) access is by SSH key only — password authentication is disabled.
- Role‑based access control — access follows “need‑to‑know” and “least‑privilege” principles, so users can only reach the data their role requires; sensitive operations are restricted to administrators.
- Application hardening — rate limiting, input validation, security headers, a Content‑Security‑Policy, and blocking of sensitive paths.
- Logging and monitoring — a background monitor detects suspicious database and PII-exposure events and alerts our incident lead by email. Operational and error logs do not contain buyer PII: personal data is stripped from error output at the database-driver boundary before it can reach a log. Separately, a tamper-evident access-audit log records which record and field an operator accessed, together with their IP address, held securely for security purposes only. Logs are retained for 400 days.
- Access management — accounts and permissions are reviewed and revoked promptly when staff leave or change roles.
11Your rights
Under UK data protection law you have the right to:
- Be informed about how we use your data (this policy).
- Access a copy of the personal data we hold about you.
- Request correction of inaccurate or incomplete data.
- Request erasure of your data where there is no overriding reason to keep it.
- Restrict or object to certain processing.
- Data portability, where applicable.
- Withdraw consent, where we rely on consent.
Because orders originate on a marketplace, you may also exercise rights directly with that marketplace. To make a request to us, contact us using the details in section 15. We will respond within one month. We may need to verify your identity, and certain data (such as accounting records) may need to be retained where the law requires it.
12Cookies and local storage
The Repark RMS application is an internal operational tool. It uses a secure, httpOnly session cookie to keep authorised users signed in, together with a matching security token that protects against forged requests. It does not use third‑party advertising or tracking cookies.
13Children’s data
Our services are intended for business operations and are not directed at children. We do not knowingly collect personal data relating to children.
14Changes to this policy
We may update this policy from time to time. The “Last updated” date at the top shows when it last changed. Material changes will be made available through our usual channels.
15How to contact us & complain
For any privacy question or to exercise your rights, contact:
- Data protection contact: Muhammad Hamza
- Email: hamza@repark.co.uk
- Phone: 0116 260 7078
- Post: Repark LTD, Unit 2 Brook Street, Thurmaston, Leicester, LE4 8DA, United Kingdom
If you are not satisfied with our response, you can complain to the UK Information Commissioner’s Office (ICO) — ico.org.uk/make-a-complaint · Helpline 0303 123 1113.