Privacy Policy & Data Protection

1. Introduction

FLEX SHOP LTD ("we", "our", or "us") is dedicated to safeguarding the personal data of our website visitors, clients, and store partners. We adhere strictly to the United Kingdom General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and Privacy and Electronic Communications Regulations (PECR).

This Privacy Policy explains what information we gather when you browse flexshopltd.com, request our marketplace audit, enter into a store management retainer, or communicate with our eCommerce specialists.

2. Personal Data We Collect

Depending on your interaction with us, we collect and process the following categories of data:

• Contact & Identity Data: Full name, corporate email address, telephone/WhatsApp number, company name, website domain, and postal billing address.
• eCommerce Store & Catalog Information: Marketplace storefront links (eBay, Amazon, Shopify, Walmart), brand names, product SKUs, catalog feeds, and listing variation details provided for audits or optimization.
• Communication Records: Enquiries, consultation notes, support messages, email exchanges, and phone call notes.
• Technical & Browsing Data: IP address, browser user agent, operating system, referrer URL, pages visited, time spent per page, and session cookies.
• Transaction & Billing Data: Invoicing history, bank transfer reference numbers, or payment tokens processed securely by authorized PCI-DSS compliant gateways. (We do not store complete debit/credit card numbers on our servers).

3. Lawful Basis for Processing

Under UK GDPR Article 6, we process your personal information under the following lawful bases:

• Contractual Necessity: To deliver marketplace store management, product listing creation, pricing automation, and catalog support services requested by you.
• Legitimate Interests: To optimize our website performance, evaluate sales conversion performance, protect against fraud or cyber threats, and provide business-to-business communications.
• Legal Obligation: To maintain statutory financial records, tax invoices, and accounting documentation mandated by HMRC and the UK Companies Act 2006.
• Explicit Consent: Where you have opted in to receive promotional newsletters or optional marketing updates. You may withdraw consent at any time.

4. Confidentiality of Client Marketplace Credentials & Catalogs

We recognize that marketplace seller accounts, supplier lists, pricing structures, and sales reports represent confidential commercial assets. All client files, API tokens, and delegative user permissions are handled under strict non-disclosure obligations:

• We require clients to grant access via official multi-user delegation (e.g. eBay Multi-User Account Access / Amazon Secondary Permissions) rather than sharing primary master passwords whenever supported.
• Staff members operate through encrypted virtual workstations with restricted copy/export permissions.
• We never sell, rent, license, or trade client catalogs, customer buyer records, or supplier contacts to any third-party competitor.

5. Sharing Information with Service Providers

We only share data with vetted, contractually bound technology providers necessary to run our agency operations:

• Hosting & Cloud Infrastructure: High-security ISO-27001 certified cloud servers located in the UK and European Economic Area (EEA).
• Communication & CRM Systems: Professional transactional email relays and customer support ticketing software.
• Accounting & Legal Counsel: Qualified UK chartered accountants, auditors, and legal advisors for statutory compliance.

6. International Data Transfers

Where our specialized marketplace coordinators operate across international centers outside the UK/EEA, data transfers are strictly secured by UK International Data Transfer Agreements (IDTAs) or European Commission Standard Contractual Clauses (SCCs), ensuring equivalent protection standards.

7. Data Retention Policy

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected. Transactional and invoice records are archived for 6 years to satisfy UK statutory tax obligations. Client store work files are securely purged 12 months after the termination of active retainers unless requested sooner in writing.

8. Your Statutory GDPR Rights

As an individual in the United Kingdom or EU, you hold key statutory rights regarding your personal data:

• Right of Access (Subject Access Request): Request a copy of the personal information we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete information.
• Right to Erasure ("Right to be Forgotten"): Request deletion of data where no overriding legal requirement exists to retain it.
• Right to Restriction & Objection: Object to processing based on legitimate interests or direct marketing.
• Right to Data Portability: Request transmission of your data in a structured, machine-readable format.

To exercise any of these rights, email our Data Protection Officer at sales@flexshopltd.com. We respond to all verified requests within 30 calendar days free of charge.

9. Right to Lodge a Complaint with the ICO

If you believe our processing of your personal information infringes UK data protection regulations, you have the statutory right to lodge a complaint with the UK Information Commissioner's Office (ICO):

10. Contact Us

For inquiries regarding this Privacy Policy, our data handling procedures, or to exercise your rights, please reach out to: