Privacy Notice

Last updated: 24 October 2026

Who is responsible for your information?

The Parcel Store Ltd is responsible for the personal information described in this notice. We are registered in England and Wales under company number 11269590. Our registered office is The Parcel Store, Unit 1056 Moulton Park, Deer Park Road, Northampton NN3 6RX.

Our ICO registration reference is ZC205831.

For privacy questions or requests, email support@theparcelstore.com, marked “Privacy”, call 01604 945 445, or write to our registered office.

What this notice covers

This notice covers visitors to this website and people who contact us about our services by phone, email, WhatsApp or the enquiry form on this website. It does not describe how we handle parcel recipients’ information or order data as part of a shipping or fulfilment service; that is covered separately when services are set up.

Information we collect

When you contact us. If you call, email or message us, we receive the information you give us, such as your name, company, email address, phone number and what you ask about. We keep a record of the contact itself, such as the date and the content of an email or message.

Enquiry form. If you use the enquiry form on this website, we receive what you type into it: your name, company, email address, phone number (optional), the service you are interested in and your message, together with the page of this website you sent it from. The form is provided through our website host, Netlify. Netlify receives your submission, checks it for spam using Akismet, a spam-filtering service provided by Automattic Inc. in the United States that Netlify lists as one of its sub-processors, keeps it in our Netlify account and emails it to us, after which it is also held in our email system as described below. The colleague who handles incoming email reads each enquiry and either answers it, passes it to another colleague or enters the details in our customer records (CRM) by hand. Please do not put payment details, passwords or sensitive personal information in the form.

Phone calls. Our calls are handled by our phone provider, HiHi VoIP. We do not record calls. Our phone system keeps a log of calls showing the number, date and duration. That log is held by our phone provider under its own retention settings.

Email. Emails sent to us are held in our email system, which is managed for us by our IT provider, Keba Computer Services Ltd, and which we use through Microsoft Outlook. Incoming email is routed through an email-filtering service operated by AppRiver before it reaches us. The colleague who handles incoming email reads each enquiry and either answers it, passes it to another colleague or enters the details in our customer records (CRM) by hand. Enquiries are currently handled by people; automatic transfer of enquiries into our CRM is not active.

WhatsApp. The WhatsApp number shown on this website is operated by one of our directors using the standard WhatsApp app. If you message it, WhatsApp (provided by Meta) processes your messages under its own terms and privacy policy. Messages are held on the device used for that number and are backed up to the account holder’s iCloud account (Apple).

When you visit the website. This website does not use analytics. Our hosting provider, Netlify, receives the technical information needed to deliver and protect the site, such as your IP address, the page requested and your browser type, and keeps it under its own retention settings. When a page loads, your browser also requests fonts from Google’s font service. Google receives your IP address, the address of the page and your browser and device details; Google states that this service does not set or log cookies and that it does not use this information to profile you or target advertising.

Advertising cookies (optional). We advertise on Google Ads. The first time you visit, the site asks whether you accept advertising cookies. Until you press Accept, the site does not contact Google’s advertising tag and sets no advertising cookies. If you press Reject, that stays the case. If you press Accept, the page loads Google’s tag from Google, which may set cookies on this site (such as _gcl_aw), recording the Google advert click that brought you here, and receives your IP address, browser and device details and the page you are on. If you then click a phone, email or WhatsApp link on the site, the tag tells Google that a contact click happened so we can see which adverts lead to contact. We do not send Google your name, phone number, email address or any message, and the click does not tell us who you are. Google may also use this information under its own privacy policy, including to measure and improve its advertising services. We store your choice in your browser’s local storage (key tps_ads_consent) so we do not ask on every page. You can change your mind at any time with the “Ad cookie settings” button at the bottom left of any page; choosing Reject there deletes the Google advertising cookies this site has set and stops further contact-click measurement. Your browser may keep other cookies set by Google when you use Google services; you manage those through your browser and your Google account settings.

Embedded video (YouTube). The Technology page has a customer-story video made by Access Mintsoft and hosted on YouTube. The video does not load until you press its play button, so your browser makes no connection to YouTube or Google because of it before then. When you press play, your browser loads the video from YouTube’s privacy-enhanced address (youtube-nocookie.com). YouTube (Google) then receives your IP address, your browser and device details and the address of the page you are on, and it may set cookies or use similar storage on your device. YouTube states that in this mode views of the embedded video are not used to personalise your YouTube experience and that any ads shown in it are non-personalised. Pressing play is your choice; if you prefer, the “Watch it on YouTube” link beside the video opens YouTube in a new tab instead, and YouTube’s own privacy policy then applies. This does not use the advertising-cookie choice described above.

Links to other services. The site links to WhatsApp, our customer portal (oms.theparcelstore.com), Mintsoft and a Google search for our reviews. Those services have their own privacy arrangements.

Please do not send payment details, passwords or sensitive personal information to us by email, message or the enquiry form.

Why we use it

• Responding to enquiries, discussing services and preparing quotations: our legitimate interests in answering business enquiries and managing prospective customer relationships. Where you personally ask us to take steps towards a contract with you, we may instead use the pre-contractual steps basis.
• Keeping business records: if we follow up with you, we may record your business contact details and notes in our CRM. Our legitimate interests are keeping accurate records and directing enquiries to the right team.
• Showing an embedded YouTube video, only if you press play: your choice to play it, after reading the note beside it. If you would rather not, do not press play.
• Measuring our Google advertising, only if you accept advertising cookies: your consent. You can withdraw it at any time with the “Ad cookie settings” button, and withdrawing it does not affect anything done before.
• Operating and protecting the website and our phone and email systems: our legitimate interests in secure, reliable services and preventing abuse.
• Meeting legal requirements: where a particular law requires us to keep or disclose information.

We consider your rights and reasonable expectations when relying on legitimate interests. Contacting us is voluntary, but we need enough information to answer you. We do not send promotional emails to people who contact us with an enquiry, and contacting us does not subscribe you to a marketing mailing list.

Who receives the information?

Our authorised staff and service providers receive the information they need for their work. These are: Netlify (website hosting, and receiving, spam-checking and storing enquiry-form submissions); Automattic Inc. (its Akismet spam-filtering service, which Netlify uses to check enquiry-form submissions); Keba Computer Services Ltd (email and IT management); Microsoft (Outlook and associated email services); AppRiver (incoming email filtering); HiHi VoIP (telephone service); Supabase (the database behind our CRM, hosted in the EU, in Paris); Google (fonts; a YouTube video, only if you press play on it; and our advertising measurement if you accept advertising cookies); and, if you message us on WhatsApp, WhatsApp/Meta and Apple (iCloud backup). We may also disclose information when legally required or needed to establish or defend legal claims.

International processing

Some of these providers process information outside the UK, including in the United States. Where we know the safeguard a provider relies on, it is:

• Netlify, Microsoft and Google: each participates in the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”), which UK law treats as providing adequate protection for transfers to certified US organisations. Netlify’s data processing agreement falls back to standard contractual clauses and the ICO’s UK addendum if that framework stops applying to it. That agreement also requires Netlify to bind its own sub-processors, such as Akismet below, to data-protection obligations no less strict than its own, and keeps Netlify responsible for them.
• Apple: its published privacy terms say international transfers are governed by standard contractual clauses.
• Supabase: our CRM database and its backups are held in the EU (Paris). Supabase says that its logs, support access and some other processing take place outside that region and that it relies on standard contractual clauses for those transfers.
• Automattic (Akismet): Netlify uses Akismet, run by Automattic Inc. in the United States, to check enquiry-form submissions for spam. Akismet states that transfers of data outside the European Economic Area take place under the EU standard contractual clauses, and that it deletes most spam-checking data within two weeks to 90 days. Our agreement with Netlify requires Netlify to bind Akismet to equivalent protections (see the Netlify entry above).
• WhatsApp/Meta: messages are processed under WhatsApp’s own privacy policy, which says information may be transferred to the United States and other countries.

Other providers we use may also process information outside the UK. You can ask us for information about the safeguards that apply to any provider.

How long information is kept

We decide how long to keep enquiry information by considering whether it is still needed for an active enquiry, a continuing business relationship, a legal obligation or a dispute.

Until now we have not applied a fixed deletion period to enquiries, so older enquiries, emails and messages may still be held. We have agreed to review the enquiry information we hold in email, WhatsApp and our CRM once a year. WhatsApp messages and CRM records are reviewed by one of our directors, and email by the colleague who handles incoming email. This process has been newly agreed and the first review has not yet taken place.

At each review we document any continuing need to keep personal information and delete or anonymise information that is no longer needed. Information may be removed sooner where appropriate, including following a valid request. An annual review is not a fixed one-year retention period, or a reason to keep information indefinitely.

Enquiry-form submissions. Once a month we delete the enquiry-form submissions held in our Netlify account that are more than two months old, so a submission stays there for at most about three months. Once a month we also delete the notification emails about form enquiries that are more than 12 months old, so those emails are kept for at most about 13 months. Replies and other correspondence with you are covered by the annual review described above. If an enquiry leads to us providing services to you, the details are kept with your customer record.

Technical logs, call histories, recoverable items and backups have separate retention arrangements, so deleting a record does not necessarily remove every backup or recovery copy immediately.

Your rights

Depending on the circumstances, you can ask us for access to, correction of, deletion of or restriction of your information. Data portability applies only in particular circumstances. If we ever rely on consent, you can withdraw it without affecting earlier lawful processing.

Right to object: you can object to processing based on legitimate interests for reasons relating to your situation. You can always object to use of your information for direct marketing.

Contact us using the details above. We may need proportionate information to verify your identity. We normally respond within one month; where the law allows extra time, we will explain why. You can complain to the Information Commissioner’s Office, whether or not you have contacted us first.

Changes

We will update this notice when our practices change and show the date of the current version. If call recording is switched on, or automatic processing of enquiries, other tracking or other data collection is added to the website, this notice will be updated first.