What we collect, and what we don't.

1. Who we are

StationeryHub Ltd (companies house number 15038389) is the data controller for the personal data described in this notice. 48 High Street, Walthamstow, London E17 7LD, United Kingdom. We're registered with the Information Commissioner's Office under reference pending.

2. What data we collect

• Account & contact data — name, email, phone, company name, role.
• Trade-account data — Companies House number, VAT number, registered business address, estimated monthly spend, the business contact who applied.
• Order data — items, quantities, prices, ship-to and bill-to addresses, fulfilment and tracking events.
• Payment data — handled entirely by Stripe; we never see card numbers. We store a Stripe Customer ID linked to your account.
• Technical data — IP address, browser type, pages visited, errors. Used for security and reliability.

3. How we use it

We process your data to (a) fulfil your orders and run your account, (b) communicate operationally (order confirmations, delivery updates, account changes), (c) improve the service, and (d) meet legal obligations (HMRC, Companies House, Distance Selling Regulations).

We do not sell your data. We do not use it to train AI models. We do not share it with marketing third parties without your explicit consent.

4. Lawful basis

• Contract — for fulfilling your orders and managing your account.
• Legitimate interest — for security, fraud prevention, and improving the service.
• Legal obligation — for tax records, accounting, and regulatory compliance (we keep transactional records for 7 years per HMRC requirements).
• Consent — for any marketing communications, only when you opt in.

5. Who we share data with

• Stripe (payments) — Ireland-based subsidiary processing card transactions on our behalf.
• Resend (transactional email) — hosts the template engine and outbound mail server.
• Cloudflare (CDN, security) — sits in front of our infrastructure for DDoS protection and edge caching.
• Royal Mail / DPD / equivalent couriers for delivery only.
• HMRC, Companies House, our accountants as required by law.

6. Where data lives

Our application servers are hosted in the UK (Hetzner). Stripe operates in the EEA. Cloudflare operates globally with EU/UK data residency for our routes. Where data is transferred outside the UK, we rely on the UK Adequacy Regulations or Standard Contractual Clauses where required.

7. How long we keep it

• Account data — for as long as your account is open, plus 12 months
• Order and invoice data — 7 years (HMRC)
• Web logs — 90 days
• Marketing consent records — until you withdraw, plus 12 months

8. Your rights

Under UK GDPR you have the right to access, correct, delete, or port your personal data, and to object to processing or restrict it. To exercise any of these, email [email protected]. We respond within 30 days.

You also have the right to complain to the ICO (ico.org.uk, 0303 123 1113).

9. Cookies

See our Cookies notice for the list of cookies we use, what they do, and how to opt out.

Changes to this notice

We'll update this page when we change anything material and email active accounts at least 14 days before changes take effect.