Legal · last updated 7 September 2026

Data processing agreement

This document has not yet been reviewed by a solicitor, and should be before it is relied on.

This agreement forms part of the terms of service between DispatchThread, a trading name of School Wear United Limited, a company registered in England and Wales (company number 07207802), with its registered office at 3 Crown Dale, London SE19 3PB ("the processor"), and the customer ("the controller"), and applies whenever we process personal data on the customer's behalf under UK GDPR.

1. Subject matter and duration

We process personal data only to provide DispatchThread, for as long as the subscription runs and for ninety days after it ends.

2. Nature and purpose

Reading orders from the controller's store; producing packing slips and postage labels; transmitting delivery details to Royal Mail in order to buy a label; recording shipments and tracking numbers back to the controller's store; and keeping a record of despatch activity.

3. Types of personal data

• Recipient name, delivery address and postcode.
• Recipient email address and telephone number, where the store holds them.
• Order contents, order value and any delivery instructions the shopper left.
• The controller's own staff: name, username and sign-in activity.

No special category data is processed. The service is not designed to hold it, and it should not be entered.

4. Categories of data subject

The controller's shoppers, and the controller's own staff.

5. Our obligations

• We process personal data only on the controller's documented instructions, which include these terms and the ordinary use of the software.
• Everyone with access is bound by a duty of confidence.
• We keep appropriate technical and organisational measures, including per-customer database separation, hashed passwords, credentials held only on the server, and restricted production access.
• We assist the controller with data subject requests, with security and breach obligations, and with any assessment they must carry out.
• We notify the controller without undue delay, and within seventy-two hours of becoming aware, of any personal data breach affecting their data.
• At the end of the contract we delete the data, or return it first if the controller asks within the ninety day window.
• We make available the information needed to demonstrate compliance and allow reasonable audit.

6. Sub-processors

The controller gives general authorisation for the sub-processors listed below. We will give at least thirty days' notice before adding or replacing one, and the controller may object on reasonable data protection grounds.

Royal Mail, BigCommerce and Shopify are not our sub-processors. The controller has its own relationship with each, and personal data reaches them under that relationship, not ours.

7. International transfers

Personal data is held in the European Union, in Railway’s EU West region in Amsterdam. Railway Corporation is based in the United States, so any access to it from there is made under the UK International Data Transfer Addendum to the Standard Contractual Clauses, incorporated in Railway’s data processing agreement. We will not transfer it anywhere else without a lawful transfer mechanism and notice to the controller.

8. Liability

Liability under this agreement is subject to the limits in the terms of service.