Legal

Privacy Policy

Last updated 3 August 2026

Packfox Limited (“we”, “us”, “our”) is a company registered in England and Wales (company no. 17000715), with its registered office at 124 City Road, London EC1V 2NX. We are the controller of the personal information described in this policy, and we are registered with the Information Commissioner’s Office (ICO) under reference ZC160725. This policy covers our website at packfox.co.uk, the report pages we host at audit.packfox.co.uk, and the personal information we handle in running our business. For any question about your information, or to exercise any of the rights set out below, email info@packfox.co.uk.

What we collect, and why

Website visitors. We collect only what our hosting and the site itself need to run securely. This site sets no cookies. If we ever introduce non-essential cookies, they will be described in our Cookie Policy and set only with your consent. Lawful basis: our legitimate interest in running a secure website.

When you contact us. If you email us or complete a form, we process your name, contact details and message so we can reply and keep a record of the enquiry. Lawful basis: our legitimate interest in responding to enquiries.

Business contacts (our outreach). We research brands whose products are sold on Amazon UK, and may process limited business contact information: name, role, business email and company details, obtained from public sources and specialist business data services, such as Amazon storefronts, company websites, the Companies House public register and business contact databases. We use it to send relevant, one-to-one business correspondence to limited companies about their Amazon channel, and we always include a clear way to opt out. Lawful basis: legitimate interests (UK GDPR Article 6(1)(f)) in offering a relevant business service, using minimal data in a way the recipient can reasonably expect.

Clients. If you engage us, we process the information needed to deliver the service: your contact and billing details, and marketplace data about your own products. Lawful basis: performance of our contract with you (UK GDPR Article 6(1)(b)).

How we access your Amazon data. With your authorisation, we connect to your Amazon Selling Partner account through Amazon’s official Selling Partner API, using Amazon’s own secure authorisation process. We request access only to non-personal product and performance data: your listings, pricing, competing offers and aggregated sales metrics. We use it only to read and monitor your listings; we do not make changes to your account. We do not request or access your customers’ personal data, such as buyer names or addresses. We process each client’s data solely to deliver that client’s service, we never combine it with or feed it into any other Amazon account (including our own), and we never share it with other clients. During your initial audit we may also review historical pricing through Keepa, a third-party Amazon price-data service. You can withdraw our access at any time from within Amazon, which stops any further data collection.

Payments. If you become a client, we collect recurring payment by Direct Debit through Stripe, a global payments provider whose UK regulated entity, Stripe Payments UK Ltd, is authorised by the Financial Conduct Authority as an electronic money institution (reference 900461). You set up the Direct Debit mandate on Stripe’s own secure payment pages; your bank details go directly to Stripe and are never stored on our systems. Stripe acts partly as our service provider and partly as a controller of your personal data in its own right, for example for fraud prevention and its own legal compliance, and its privacy policy is at stripe.com/privacy. We also share billing details with our accounting provider so we can raise invoices and meet our legal record-keeping obligations.

Client portal. Our client portal at portal.packfox.co.uk uses one first-party cookie, set when you sign in and kept for up to 30 days. It is strictly necessary to keep you signed in, so it needs no consent banner, and it is not used for tracking. Sign-in and invitation emails are sent to your account contact address when requested. The portal’s Get started form collects your name, company and email so we can answer your enquiry; prospect information follows the retention schedule below.

How we produce reports

Our audits and monitoring reports are produced from marketplace data about products, prices and listings, not about people. We use software, including AI drafting tools from Anthropic, to help turn that data into report text; a person reviews every audit report before it is sent, and we do not use AI to make automated decisions about individuals. Report pages we share with you are hosted at audit.packfox.co.uk on unguessable addresses and are excluded from search-engine indexing.

Who we share it with

We share personal information only with the service providers who help us run the business, and only so they can perform those services for us.

Our website and email run on a UK/EEA hosting provider. Our monitoring systems run on a major cloud infrastructure provider in its London region, with our database hosted in London by a specialist database provider; the contact details we hold there are stored encrypted. Our report pages at audit.packfox.co.uk are served by a content delivery provider. Anthropic provides the AI drafting tools described above; it receives report and marketplace text, not your contact details. Stripe collects and holds Direct Debit mandates and bank details on its own payment pages under its own privacy notice (stripe.com/privacy); they never touch our systems. An accounting provider handles our business records. We will provide the current named list of providers on request.

We do not sell or trade personal information, and we do not share it for anyone else’s marketing.

Sending data outside the UK

Our website and email are hosted in the UK and EEA, and our monitoring systems and database run in London. Some of the providers we use are US companies or process data in the United States, including Anthropic, Cloudflare and Stripe. Where personal data leaves the UK, we rely on appropriate safeguards: the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, a UK adequacy decision for the country concerned, or the ICO’s International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses). Email us if you would like more detail about a specific transfer.

How long we keep it

Enquiries and contact-form messages: up to 3 years. Wider business correspondence: up to 6 years. Outreach contact data: removed on request, and routinely removed where there has been no engagement within 6 months. Client records: we keep engagement data for the life of the engagement plus up to 6 months, then delete it, except records UK law requires us to keep longer (business, financial and tax records, generally six years).

Your rights

You can ask us at any time to access, correct, delete, or restrict our use of the personal information we hold about you, to receive a copy of it, or to object to any processing we carry out on the basis of legitimate interests, including our outreach. Where we rely on your consent, you can withdraw it at any time. One email to info@packfox.co.uk is enough.

Complaints

If you are unhappy with how we have handled your personal information, you can complain to us directly: email info@packfox.co.uk, use our complaints form at audit.packfox.co.uk/complaints/, or use the form on our contact page. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk at any time.

What we don’t do

We do not sell or trade personal information. We do not send bulk marketing email. We do not make automated decisions about individuals: our monitoring assesses product listings, not people.

Changes to this policy

We may update this policy from time to time; the date at the top shows when it last changed. Our Cookie Policy sets out our position on cookies.