Privacy policy

Last updated Apr 1, 2026

We process your personal data in line with the UK GDPR and Data Protection Act 2018.

Who we are

Click2Send Ltd., trading as Click2Shop, is the data controller. Our ICO registration number is ZA000000.

What we collect

• Account data: name, email, password hash, phone (if added for 2FA).
• Order data: delivery address, items purchased, payment tokens (not card numbers).
• Device data: IP, user agent, device ID for fraud prevention.
• Seller data: business name, Companies House number, VAT number, verification documents via Onfido.

Legal bases

• Performance of a contract — to fulfil your orders.
• Legal obligation — for tax, fraud, and dispute records.
• Legitimate interests — to improve the service and prevent abuse.
• Consent — for marketing emails and non-essential cookies (you can withdraw at any time).

Sharing

We share data with payment providers (Revolut), shipping carriers (via Click2Send), identity verification (Onfido), email provider (Postmark), and with HMRC as required. We never sell personal data.

Retention

We keep order records for 7 years to meet HMRC requirements. Marketing preferences are kept until you withdraw consent. Account data is deleted within 30 days of account deletion, except where law requires retention.

Your rights

You have the right to access, correct, port, restrict, object, and delete your personal data. You can exercise most of these directly from Privacy settings, including a machine-readable data export and an account deletion request. You can also complain to the ICO at ico.org.uk.

International transfers

Some of our processors operate outside the UK. Where they do, transfers are protected by UK Adequacy Regulations or the International Data Transfer Agreement.

Cookies

See our Cookie policy.

Data protection enquiries: privacy@click2shop.co.uk.