Privacy policy
What we do with personal data — yours, and your customers'. Written to be read, not to be skipped.
The short version. Our website sets one optional cookie — a Meta advertising pixel — and only if you accept it on the banner. Reject it, or ignore the banner, and nothing is set and nothing goes to Meta. We run no analytics and no session recording. If you ask us for a quote we use your details to send you a quote and nothing else. Our mailing list is strictly opt-in — you are only on it if you ticked the box yourself, and one line in any email takes you off it. When we pack and ship orders for a client, the customer data inside those orders belongs to the client, not to us, and we only ever act on their instructions.
1. Who we are and how to contact us
Angler Fulfilment is a UK order-fulfilment provider. We are the data controller for the personal data described in Section 3 — except for the order data we handle on behalf of our clients, where we act as a processor (see Section 9).
- Legal entity: [REGISTERED COMPANY NAME] (Company No. [COMPANY NUMBER])
- Registered address: [REGISTERED ADDRESS]
- ICO registration number: [ICO REGISTRATION NUMBER]
- Privacy contact: [email protected]
Email us at that address with any question about this policy or about your data. We aim to reply within 5 working days, and in any case within one month.
2. The two roles we play
Because we fulfil orders on behalf of other businesses, we handle personal data in two different ways and the law treats them differently.
As a controller — for people who visit this website, ask us for a quote, run a client account with us, or apply for a job. We decide how and why that data is used, and this policy governs it.
As a processor — for the personal data inside the orders we pick, pack and ship, such as the name and delivery address of a client's customer. There, our client is the controller and we act only on their documented instructions. That relationship is governed by our Data Processing Agreement with the client, not by this policy. See Section 9.
3. The personal data we collect (as controller)
Website visitors
We do not run analytics, so we do not build any profile of your visit. Our hosting provider automatically records standard server log data — IP address, the page requested, timestamp, browser and device type — to serve the page and to protect the site from abuse. We do not use those logs for marketing or measurement.
People who ask for a quote or contact us
- Name and email address
- Business or store name, and store link
- Approximate monthly order volume and product type
- Anything you choose to tell us in the message field
- Phone number, if you contact us by phone or WhatsApp
Clients
- Account and contact details for the people we deal with
- Billing and payment information, and invoice history
- Correspondence and support history
- Business verification details we are required to hold under HMRC's Fulfilment House Due Diligence Scheme, where it applies — including VAT and EORI numbers and company details
People who subscribe to our mailing list
- Your email address
- A record of your consent — the date and time you subscribed, and the exact wording you agreed to
That is the whole list. We do not ask for your name, we do not append anything to your record from other sources, and we do not track whether you open or click.
Job applicants
- Name and contact details, CV, work history, and anything else in your application
We do not intentionally collect special-category data such as health or ethnicity, and we ask that you do not send it to us.
4. Where we get it
Directly from you — through the quote form, by email, WhatsApp or phone, and during onboarding. From your use of this website, in the form of the server logs described above. And, for clients, from the sales channels you connect to us, such as your Shopify, Amazon, eBay, Etsy or TikTok Shop store, so that orders can reach us automatically.
5. Why we use it, and our lawful basis
Under UK GDPR we need a lawful basis for each use of personal data. Ours are:
| What we do | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Reply to your quote request or enquiry | Legitimate interests — responding to a business enquiry you made |
| Provide our fulfilment, prep and returns services to a client | Performance of a contract |
| Send invoices and keep financial records | Legal obligation (tax), and performance of a contract |
| Keep our systems and premises secure and prevent fraud | Legitimate interests |
| Carry out due-diligence checks required by HMRC's Fulfilment House Due Diligence Scheme | Legal obligation |
| Send you our mailing list, if you subscribed to it | Consent (Art. 6(1)(a)), given by ticking the box on the signup form. You can withdraw it at any time and every message tells you how |
| Reply to an existing client about their own account and service | Performance of a contract. This is service correspondence, not marketing, and is not affected by whether you are on the mailing list |
| Handle a job application | Legitimate interests, and steps taken at your request before a contract |
Our mailing list, in full
There is a newsletter signup in the footer of every page. It is worth being precise about it, because email marketing in the UK is governed by the Privacy and Electronic Communications Regulations (PECR) as well as the UK GDPR.
- It is opt-in only. The consent box is not pre-ticked and the form will not submit without it. We never add anyone to the list because they asked for a quote, because they became a client, or because we met them somewhere.
- What we send: at most one email a month, covering rate-card changes, peak-season deadlines and write-ups of how our operation actually runs.
- How to leave: reply “unsubscribe” to any email, or write to [email protected]. We action it the same working day. Withdrawing consent is as easy as giving it, and it does not affect anything else we do for you.
- No tracking: we do not use open-tracking pixels or click-tracking links, so we cannot tell whether you read a message. That is deliberate.
- Where it is stored: subscriptions are submitted through Cloudflare, who host this site, delivered to us by Resend, and we send from our own mailbox. See Sections 7 and 8. We do not use a third-party marketing platform, and if we ever adopt one we will update this policy and name it before your address is transferred to it.
- We never sell, rent or share the list.
6. Cookies, analytics and tracking
This website sets one non-essential cookie, and only if you accept it. It is a Meta advertising pixel, used to measure whether our advertising reaches the right sellers. It is off until you press Accept on the banner, and if you reject it or ignore the banner it is never set. We run no analytics platform, no session recording, no A/B testing and no fingerprinting.
What changed. Until August 2026 this site set no cookies at all and this section said so. We began advertising, and we added the pixel. It sits behind a consent banner rather than firing on arrival, and this paragraph exists so the change is stated rather than buried.
The Meta pixel. If you consent, Meta Platforms Ireland Ltd sets a _fbp cookie lasting three months and receives the page you are viewing, your IP address, your browser and device type, and the fact that a page view or a quote request happened. It does not receive the contents of your quote form. Our lawful basis is your consent (UK GDPR Art. 6(1)(a)), given through the banner and withdrawable at any time from the Cookie settings link in the footer. Meta is a joint controller with us for this data; its own terms are at facebook.com/privacy/policy.
The consent cookie. Recording your answer requires one first-party cookie, af_consent, lasting six months. It stores nothing but the word granted or denied. It is strictly necessary and therefore does not itself need consent.
Fonts. The typeface used across the site is served by Google Fonts. Your browser makes a request to Google's servers, and Google sees your IP address and browser type. Google Fonts sets no cookies for this. Blocking third-party requests falls back to a standard system typeface and the site works normally.
The full detail, including a table of both cookies, is in our cookie notice.
7. Who we share data with
We share personal data only where it is necessary to run the service, with:
- Delivery carriers — Royal Mail, Evri, DPD, DHL and similar, to deliver orders. They receive recipient name, address and contact details, and act as controllers in their own right for delivery.
- Cloudflare — hosts this website and processes quote-form and newsletter-signup submissions at the point of delivery. Cloudflare is a US company; see Section 8.
- Resend — delivers form submissions to our inbox as email. The sending infrastructure for this domain is in Ireland (eu-west-1). Resend Inc. is a US company; see Section 8.
- Meta Platforms Ireland Ltd — receives advertising and conversion data, but only from visitors who have accepted the advertising cookie. See Section 6.
- Our email and communications providers, including WhatsApp Business where you choose to contact us that way.
- Our order-management and accounting software providers, who process client and order data on our instructions under written data-protection terms.
- Professional advisers — accountants, insurers and lawyers, where needed.
- HMRC and other authorities, where we are legally required to disclose, including under the Fulfilment House Due Diligence Scheme.
We do not sell personal data and we do not share it with data brokers. We do share advertising and conversion data with Meta, as an advertising network, but only for visitors who have given consent — see Section 6. A current list of the sub-processors we use is available on request from [email protected], and forms part of the Data Processing Agreement we sign with every client.
8. Sending data outside the UK
Our warehouse operation and our records are in the UK. Two flows leave it:
- Quote-form and newsletter-signup submissions are processed by Cloudflare, a US company, and delivered by Resend, a US company whose sending infrastructure for this domain is located in Ireland.
- Advertising and conversion data, for consenting visitors only, goes to Meta Platforms Ireland Ltd, which is in the EEA but may transfer onward to Meta Platforms, Inc. in the United States under its own safeguards.
- Font files are served from Google's global network, as described in Section 6.
Where a supplier processes personal data outside the UK, we rely on the transfer safeguards in our written agreement with that supplier — an adequacy decision, the UK International Data Transfer Agreement or Addendum, or the UK version of the EU Standard Contractual Clauses — so that the data keeps an equivalent level of protection. If you would rather not send your details through the form, email us instead at [email protected].
9. Order data we handle for our clients (our processor role)
When we fulfil orders we process the personal data of our clients' customers — recipient name, delivery address, contact details, order contents and any delivery notes. For that data:
- Our client is the controller and is responsible for having a lawful basis and for giving their own customers privacy information.
- We act only on the client's documented instructions, under a Data Processing Agreement that meets Article 28 of the UK GDPR.
- If you are a shopper whose order we packed and you want your data corrected or deleted, please contact the shop you bought from. They are the controller, and we will support them in responding to you.
10. How long we keep it
| What | How long |
|---|---|
| Quote and enquiry data, where you don't become a client | 12 months from last contact |
| Client account, order and financial records | The life of the contract, then 6 years — to meet tax record-keeping and, where it applies, HMRC Fulfilment House Due Diligence Scheme requirements |
| Mailing-list subscriptions | Until you unsubscribe. We remove the address within one working day and keep only the consent record itself for 12 months afterwards, as evidence that the subscription was properly obtained |
| Other business-to-business contacts | Until you opt out, reviewed every 24 months |
| Unsuccessful job applications | 6 months, unless you ask us to keep them on file |
| Website server logs | As retained by our hosting provider for security and diagnostics, typically no more than 30 days |
11. How we keep it safe
We use technical and organisational measures appropriate to the size of our operation: access controls so staff only see what their role requires; encrypted connections for data in transit; access-controlled premises; regular backups; malware protection and prompt software updates; written confidentiality obligations and data-protection training for staff; and a documented breach-response procedure. No system is ever perfectly secure, but we work to keep the risk low, and we will notify you and the ICO of a personal-data breach where the law requires it.
12. Your rights
Under UK GDPR you have the right to be informed; to access your data; to have inaccurate data corrected; to have data erased; to restrict or object to processing; to data portability; and to withdraw consent at any time where we rely on it. Where we rely on legitimate interests, you have the right to object and we will stop unless we have compelling grounds not to.
Exercising these rights is free in normal cases and we will respond within one month. Email [email protected]. We may ask you to confirm your identity first.
13. Children
Our service is aimed at businesses, not children. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
14. Changes to this policy
We may update this policy as our service changes. The “last updated” date at the top shows the current version, and we will tell clients directly by email about any significant change.
15. Complaints
If you are unhappy with how we have handled your data, please tell us first at [email protected] so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113