Privacy Policy

Merchant Packaging is committed to safeguarding customer, supplier, and visitor data. This document explains our data collection, usage, and protection practices.

Information we collect

• Contact details submitted via forms or email
• Usage analytics from our public marketing pages, collected via Google Analytics 4 only after you accept analytics cookies. Google Analytics 4 does not log or store IP addresses, and advertising signals are disabled. Pages inside the application are not tracked. See our cookie policy to change or withdraw your choice.
• Supplier and packaging data shared by Merchant Packaging subscribers

How we use data

We use the information to deliver the Merchant Packaging platform, respond to enquiries, provide support, and meet legal obligations such as EPR reporting.

Our legal basis

• Contract: Providing the platform to subscribers and their users.
• Consent: Analytics cookies on our public marketing pages. You may withdraw this at any time via our cookie policy, with no effect on the service.
• Legitimate interests: Responding to enquiries and keeping the platform secure.
• Legal obligation: Records we are required to keep, including for EPR reporting.

Data sharing

We do not sell data. We only share information with processors that help us deliver Merchant Packaging, under written data processing agreements:

• Microsoft Azure: Hosting and data storage.
• Google: Website analytics on our marketing pages, and only if you have accepted analytics cookies.
• Email delivery: Sending transactional messages such as sign-in and notification emails.

International transfers

Some processors operate outside the UK and EEA. Where personal data is transferred, we rely on the relevant adequacy decisions or, where those do not apply, on standard contractual clauses together with the UK International Data Transfer Addendum. Analytics data accepted via cookies is transferred to Google LLC in the United States on that basis.

Your rights

You have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict processing, and to withdraw consent where we rely on it. To exercise any of these, email hello@merchantpackaging.co.uk. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Retention and security

Operational data is retained only as long as necessary. Website analytics event records are retained for 2 months and then deleted automatically. We employ Azure Key Vault, encryption in transit and at rest, and role-based access controls for protection.