Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

TradeWind Shipping Limited
Company registered in England and Wales
Email: privacy@tradewind.express

For the purposes of this policy, “we”, “us”, and “our” refer to TradeWind Shipping Limited.

2. Data We Collect

We collect and process the following categories of personal data:

2.1 Account Information

• Full name and job title
• Email address
• Phone number
• Company name and registration number (where applicable)
• Business address
• VAT number (where applicable)
• EORI number (where applicable for customs purposes)
• Account login credentials (passwords are stored hashed and salted)

2.2 Shipping and Order Data

• Sender and recipient names and addresses
• Package dimensions and weights
• Goods descriptions, HS/tariff codes, and declared values
• Tracking numbers and shipment statuses
• Customs declarations and commercial invoice data
• Order reference numbers from connected platforms (Shopify, WooCommerce, eBay, BigCommerce, ShipStation)

2.3 Payment and Billing Data

• Billing name and address
• Stripe customer ID and payment method identifiers
• Transaction history and invoice records
• We do not store full card numbers, CVVs, or bank account details. All payment processing is handled by Stripe, which is PCI DSS Level 1 certified.

2.4 Technical and Usage Data

• IP address and approximate geolocation
• Browser type and version
• Device type and operating system
• Pages visited, features used, and session duration
• API request logs (for users of our API)
• Error and performance logs

2.5 Carrier Account Credentials (BYOA Users)

• If you connect your own carrier accounts (“Bring Your Own Account”), we store carrier API credentials, account numbers, and access tokens. These are encrypted at rest and used solely to process shipments on your behalf.

3. Legal Bases for Processing

We process your personal data under the following lawful bases:

4. How We Use Your Data

We use your personal data to:

• Create and manage your TradeWind account
• Generate shipping labels and customs documentation across our supported carriers
• Process per-label charges and manage your billing account via Stripe
• Import orders from connected e-commerce platforms
• Provide tracking information and delivery status updates
• Handle support queries and resolve disputes
• Detect and prevent fraudulent or prohibited use of the Service
• Improve the Service through aggregated, anonymised analytics
• Send transactional notifications (e.g. label confirmations, billing receipts)
• With your consent, send marketing communications about new features and services

5. Data Sharing and Third Parties

We share your personal data with the following categories of third parties, only to the extent necessary to provide the Service:

5.1 Shipping Carriers

When you book a shipment, we transmit the sender address, recipient address, package details, and customs data to the relevant carrier (UPS, Royal Mail, FedEx, DPD, Evri, DHL, or others as available).

Each carrier acts as an independent data controller in respect of the personal data we transmit to them — they process that data for their own purposes (transportation, customs clearance, regulatory record-keeping, fraud prevention, and the marketing of their own services where permitted by law) under their own privacy notice, and not as our processor. This is true both for shipments booked on TradeWind’s House Rates (where the carrier provides the underlying service on TradeWind’s behalf) and for shipments booked on Bring Your Own Account (BYOA).

For UPS specifically, that processing is governed by the UPS Privacy Notice, available at ups.com › Privacy Notice . UPS may transfer your shipment-related personal data outside the UK / European Economic Area, including to UPS systems in the United States, in accordance with that notice and the applicable safeguards described in Section 6 below. Where we book a shipment with UPS on your behalf under our reseller agreement, we will, on UPS’s behalf, signpost you to UPS’s notice (this paragraph satisfies that requirement).

5.2 Stripe (Payment Processing)

We use Stripe to process all payments. Stripe receives your billing name, email, and payment method details. Stripe’s privacy policy is available at stripe.com/gb/privacy .

5.3 XCover (Shipping Insurance)

If you purchase optional shipping insurance, we share relevant shipment data (parcel value, origin, destination, carrier) with XCover to underwrite and administer the policy.

5.4 Infrastructure Providers

• Neon (Database Hosting) — our PostgreSQL database is hosted on Neon’s infrastructure. Data is encrypted at rest and in transit.
• Replit (Application Hosting) — our application servers run on Replit’s cloud infrastructure.

5.5 E-commerce Platform Integrations

When you connect your Shopify, WooCommerce, eBay, BigCommerce, or ShipStation account, we access order data from those platforms on your behalf via their APIs. We do not share your data back with those platforms beyond what is required for order synchronisation.

We do not sell your personal data to any third party. We do not share your data for advertising purposes.

6. International Data Transfers

As a shipping platform, certain data transfers outside the UK are inherent to the Service:

• Carrier data — when you ship internationally, recipient addresses and customs data are transmitted to carrier systems which may be located globally (e.g. UPS systems in the United States, DHL systems in Germany).
• Stripe — Stripe processes payments through infrastructure primarily located in the United States, under Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement.
• Infrastructure — our hosting and database providers may process data in the United States or European Economic Area.

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses, adequacy decisions, or other approved transfer mechanisms under UK GDPR.

7. Data Retention

We retain your personal data for the following periods:

After the retention period, data is securely deleted or irreversibly anonymised.

8. Your Rights

Under UK GDPR, you have the following rights:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your data, subject to legal retention requirements (e.g. we must retain customs records for 7 years).
• Right to restriction — request that we limit how we process your data.
• Right to data portability — receive your data in a structured, commonly used, machine-readable format.
• Right to object — object to processing based on legitimate interest, including profiling.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please email privacy@tradewind.express. We will respond within one calendar month.

9. Cookies

We use cookies and similar technologies to operate and improve the Service. For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

10. Children’s Privacy

The Service is intended for use by businesses and individuals aged 18 or over. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be notified via email or an in-app notification at least 14 days before they take effect. The “Last updated” date at the top of this page indicates when the policy was last revised.

12. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK’s supervisory authority:

Information Commissioner’s Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113

We would appreciate the opportunity to address your concerns before you contact the ICO, so please reach out to us first.

13. Contact Us

For any privacy-related questions or to exercise your data rights, please contact:

TradeWind Shipping Limited
Email: privacy@tradewind.express