Legal · last updated 6 October 2026
Privacy policy
This document has not yet been reviewed by a solicitor, and should be before it is relied on.
Who we are
DispatchThread is a trading name of School Wear United Limited, a company registered in England and Wales (company number 07207802), with its registered office at 3 Crown Dale, London SE19 3PB, which is the data controller for everything described below. We are registered with the Information Commissioner’s Office under number C2033802. For questions about this policy, or to exercise any of the rights further down, email hello@dispatchthread.co.uk and a person rather than a queue will answer.
Two different roles
This matters, so it is first rather than buried.
Where we are the controller
For the people who run our customers' shops, and for people who enquire about the software, we decide what to collect and why. That is: names, business email addresses, phone numbers, the name of the shop, and the content of enquiries and support conversations.
Where we are the processor
For our customers' own shoppers, we act only on our customer's instructions. We hold delivery names, addresses, email addresses, phone numbers and order contents because the software cannot print a parcel label without them. We do not decide what happens to that data, we do not use it for anything of our own, and we never use it to market to anyone. The terms are in the data processing agreement.
What we collect, and why
| Data | Why | Lawful basis |
|---|---|---|
| Your name, business email, phone, shop name | To answer your enquiry, run your account and support you | Contract, and legitimate interests before one exists |
| Sign-in records and what your staff did in the app | Security, and answering "who despatched this order" | Legitimate interests |
| Your shoppers' delivery details and order contents | To print labels and record shipments | Processed on your instructions, not ours |
| Invoicing records | To take payment and meet accounting duties | Contract and legal obligation |
| How you use this website, only if you agree: pages read, how you arrived (including which of our adverts, if any), device and browser type, and an approximate location worked out by Google | To see which pages help and whether our adverts work | Your consent, which you can withdraw at any time with Cookie settings |
What we do not do
- We do not sell data to anyone, ever.
- We do not use one customer's data to build anything for another.
- We use Google Analytics and Google Ads on this website only if you agree to them. Until you do, and if you say no, neither is loaded. The cookies page lists exactly what they set.
- We put no analytics, advertising or tracking inside the DispatchThread app.
- We do not email your shoppers. Your store does that.
Who else sees it
Only the suppliers needed to run the service: our hosting provider, Railway Corporation, which holds the database; Royal Mail, which receives the delivery address in order to produce a label; and BigCommerce or Shopify, whichever is your own store. Each is bound by its own agreement with us or with you.
On this website only, and only if you agree: Google, for Google Analytics and Google Ads. Google receives what your browser sends when our pages load the tags. For Google Analytics, Google processes it for us under its data processing terms; for Google Ads, Google is responsible for its own use of it. Both are set out in Google's privacy policy. Google may process this information in the United States; the safeguards Google relies on for that are described there too.
How long we keep it
Account and contact data for as long as you are a customer and ninety days after. Order and despatch data for as long as you keep it in the service, and ninety days after your subscription ends. Postage labels for fourteen days by default, so they can be reprinted. Invoicing records for six years, because HMRC requires it. Website analytics linked to a visitor are kept by Google Analytics for fourteen months, then deleted; totals that cannot be traced to anyone, such as how many people read a page, may be kept longer.
Where it is held
On servers run by Railway Corporation in its EU West region, in Amsterdam. Railway Corporation is based in the United States, so any access from there is covered by the UK International Data Transfer Addendum to the Standard Contractual Clauses, which forms part of Railway’s data processing agreement. If the location changes we will tell affected customers before it happens.
Your rights
You can ask us for a copy of your data, ask us to correct it, ask us to delete it, object to processing, or ask for it in a portable form. Where we rely on your consent, such as for website analytics and advertising, you can withdraw it at any time with Cookie settings at the bottom of every page. Email us and we will answer within one month. If you are a shopper of one of our customers, your request belongs with that shop, and we will help them answer it. If you are unhappy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk.
Security
Each customer runs on their own instance with their own database. Passwords are stored hashed and salted, never in readable form. Access to production is limited to people who need it. Carrier and store credentials are held on the server and are never sent to a browser. If a breach affects your data we will tell you without undue delay, and in any event within seventy-two hours of becoming aware.