Privacy Policy

01Who we are

Repark is an online retailer and wholesale distributor that sells and fulfils orders across multiple e‑commerce marketplaces. We operate an internal order and inventory management system (“Repark RMS”) to receive, organise, fulfil and account for those orders.

For the purposes of UK data protection law — the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 — the data controller is the legal entity set out in the controller record above.

02Scope of this policy

This policy explains how we handle personal data within the Repark RMS platform. It applies to:

• Customers whose orders we receive and fulfil through connected marketplaces (for example a buyer’s name, delivery address and contact details needed to ship an order).
• System users — our staff and authorised operators who log in to Repark RMS.
• Suppliers and business contacts whose details we hold for purchasing and logistics.

Where you buy through a marketplace such as Temu, B&Q, Amazon, eBay, Shopify or TikTok Shop, that marketplace is also a controller of your data and operates its own privacy policy. We process your order data to fulfil the purchase you made on that marketplace.

03The personal data we process

3.1 Customer / order data

• Recipient name and, where shown, a masked buyer reference (e.g. an***52).
• Delivery address and, where provided, billing address.
• Phone number and a marketplace‑provided (often virtualised) email address.
• Order details: order ID, items purchased, quantities, prices, order and shipping status, and shipping deadlines.

We do not receive or store full payment card numbers — payment is taken by the marketplace.

3.2 System user (staff) data

• Account email address and role/permissions.
• A securely hashed password (stored using the Argon2id algorithm — never in plain text) and, where enabled, a two‑factor authentication (TOTP) secret.
• Trusted‑device identifiers, login and device‑approval records, IP addresses, and security audit logs of actions taken in the system.

3.3 Supplier / business contact data

• Contact names, business email addresses, phone numbers and addresses used for purchase orders, containers and logistics.

04Where we get your data from

• From marketplaces, via their APIs: customer and order data is pulled automatically from the marketplace you ordered on — Temu Open Platform, B&Q (Mirakl), Amazon (Selling Partner API / EDI), eBay, Shopify and TikTok Shop — under our authorised seller connection.
• Directly from you: when staff or suppliers provide information to us.
• Generated by the system: audit logs, sync logs and device records created as you use the platform.

05Why we process your data and our lawful bases

Where we rely on legitimate interests, we have balanced those interests against your rights and only process the minimum data needed to fulfil the order or operate the service.

06Marketplace integrations

Repark RMS connects to marketplaces using authorised, token‑based connections (OAuth where the marketplace requires it). For each connected shop we store only the access credentials needed to retrieve orders, and the order data itself. We use this data solely to fulfil and account for the orders placed on that marketplace, in line with the marketplace’s developer and data‑processing terms. We do not use customer data for independent marketing.

07Who we share your data with

We share personal data only where necessary, with:

• Hosting / infrastructure: Amazon Web Services (AWS Lightsail), which hosts the platform and database in its Europe (London, eu-west-2) region in the United Kingdom.
• Shipping and logistics carriers: Royal Mail and Evri, to deliver orders (name, address and contact details only).
• The originating marketplace: to confirm shipment, tracking and order status.
• Email delivery provider: for transactional / operational email (Google — Gmail SMTP).
• AI drafting provider: Anthropic, which we use to draft replies to customer‑service messages. It receives the customer’s name, the text of the message and the related order details (order reference, items, status and tracking). Postal addresses, phone numbers and email addresses are removed before anything is sent. This processing takes place in the United States.
• Professional advisers: our accountant and, where needed, legal advisers.
• Authorities: regulators, law enforcement or government bodies where we are legally required to do so.

We do not sell your personal data. All processors act under written terms requiring them to protect your data and use it only on our instructions.

08International data transfers

Our platform and database are hosted by Amazon Web Services in its Europe (London, eu-west-2) region, within the United Kingdom. Hosting your data therefore does not involve a transfer of personal data outside the UK.

Some of the services we rely on do process data outside the UK:

• Google — transactional and operational email. United States / EEA, under the UK extension to the EU‑US Data Privacy Framework.
• Anthropic — AI‑assisted drafting of customer‑service replies. United States. Only the customer’s name, the text of the message and the related order details are sent; postal addresses, phone numbers and email addresses are removed first.
• Marketplaces and delivery partners may also process data outside the UK where an order is placed or delivered internationally, receiving only what is needed for that order.

We keep a record of these transfers and the safeguards that apply to them.

09How long we keep your data

No buyer personal data is retained beyond 30 days. The only order records we keep longer are the transaction and accounting records above, which carry no buyer name, address, phone number or email address. When data is no longer needed for these purposes, we delete it or irreversibly anonymise it.

Deletion is automated rather than left to manual housekeeping. A scheduled job runs daily and, once an order has passed the retention period above, irreversibly anonymises the buyer’s name, email address, delivery address, billing address and the underlying order payload, and unlinks the documents rendered from them — invoices, shipping labels and packing documents. Every run is recorded, including a run that fails, so a gap in the record is visible.

10How we protect your data

We apply technical and organisational measures appropriate to the risk, including:

• Encryption in transit — all traffic to and from the platform and to marketplace APIs uses TLS 1.3 (HTTPS).
• Encryption at rest — buyer personal data is encrypted with AES‑256‑GCM envelope encryption and stored on encrypted AWS storage; account passwords are hashed with Argon2id and are never stored or transmitted in plain text.
• Strong authentication and password policy — passwords must be at least 12 characters with upper and lower case, a number and a symbol; they are checked against known-breached-password lists, may not contain the user's name or email, cannot reuse the last 10 passwords, and expire after 365 days. Accounts lock after 5 failed attempts within 15 minutes. Login supports time‑based two‑factor authentication (2FA/TOTP), and new devices require explicit approval. Server (OS) access is by SSH key only — password authentication is disabled.
• Role‑based access control — access follows “need‑to‑know” and “least‑privilege” principles, so users can only reach the data their role requires; sensitive operations are restricted to administrators.
• Application hardening — rate limiting, input validation, security headers, a Content‑Security‑Policy, and blocking of sensitive paths.
• Logging and monitoring — a background monitor detects suspicious database and PII-exposure events and alerts our incident lead by email. Operational and error logs do not contain buyer PII: personal data is stripped from error output at the database-driver boundary before it can reach a log. Separately, a tamper-evident access-audit log records which record and field an operator accessed, together with their IP address, held securely for security purposes only. Logs are retained for 400 days.
• Access management — accounts and permissions are reviewed and revoked promptly when staff leave or change roles. An account’s access can also be disabled outright, which blocks sign‑in and stops any session it already holds at that account’s next request.
• Incident response — we operate a documented incident response process covering detection, containment, eradication, recovery and notification. Where a personal data breach is confirmed, we notify the Information Commissioner’s Office within 72 hours of becoming aware of it, and we notify the individuals affected where the law requires it.

11Your rights

Under UK data protection law you have the right to:

• Be informed about how we use your data (this policy).
• Access a copy of the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data where there is no overriding reason to keep it.
• Restrict or object to certain processing.
• Data portability, where applicable.
• Withdraw consent, where we rely on consent.

Because orders originate on a marketplace, you may also exercise rights directly with that marketplace. To make a request to us, contact us using the details in section 15. We will respond within one month. We may need to verify your identity, and certain data (such as accounting records) may need to be retained where the law requires it.

12Cookies and local storage

The Repark RMS application is an internal operational tool. It uses a secure, httpOnly session cookie to keep authorised users signed in, together with a matching security token that protects against forged requests. It does not use third‑party advertising or tracking cookies.

13Children’s data

Our services are intended for business operations and are not directed at children. We do not knowingly collect personal data relating to children.

14Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows when it last changed. Material changes will be made available through our usual channels.

15How to contact us & complain

For any privacy question or to exercise your rights, contact:

• Data protection contact: Muhammad Hamza
• Email: hamza@repark.co.uk
• Phone: 0116 260 7078
• Post: Repark LTD, Unit 2 Brook Street, Thurmaston, Leicester, LE4 8DA, United Kingdom