Privacy Policy

Who we are

Oakmont 3PL Ltd, trading as Oakmont Logistics (“we”, “us”), is the data controller for personal data collected through this website and the client portal. Our registered details are at the foot of this page, and [email protected] reaches the person responsible for data protection.

What we collect and why

• Enquiry data - name, business name, email and message contents when you use our contact or quote forms. Used to respond to you. Legal basis: legitimate interest.
• Client account data - contact details, the email you sign in with, your Discord username where you join your client channel, and a record of actions taken in the portal. Used to operate your account and to keep an auditable history of what was done to your stock. Legal basis: contract.
• Forwarded retailer email - only if you switch on Email import, which is off unless you turn it on. You create a rule in your own mailbox that forwards retailer order and delivery emails to a private address we give you. Your rule decides what reaches us- we have no access to your mailbox and cannot read anything you have not forwarded. From each message we take the delivery code, the order number, the products and quantities, what you paid, the expected delivery date and the name you gave the delivery address. Used to tell the warehouse a delivery code before the driver leaves, and to save you typing in stock you have already bought. Legal basis: contract. Stop it at any time by deleting the rule in your mailbox.
• Stock and shipment records - what arrived, what was prepped, what shipped, and what it was charged. This is business data about goods rather than personal data, though it carries the name of whichever member of staff handled each step.

What we do not collect

We prep stock for Amazon FBA. Prepped cartons go to Amazon fulfilment centres, and Amazon ships to your customers - so we never receive your end customers’ names, addresses or order details, and we do not hand consumer data to carriers. If you are comparing us with a direct-to-consumer fulfilment provider, that is a real difference in what each of us holds about your buyers.

We also do not sell personal data, do not buy marketing lists, and do not send marketing email to people who have not asked for it.

Who processes it with us

We use a small number of suppliers as processors, each under contract and each with access limited to what its job needs:

• Hosting and database - running this site and the portal.
• Authentication - sign-in links and session handling, which means your email address.
• Google Workspace - each client’s working records live in a Google spreadsheet we control.
• Discord - your private client channel. Messages there sit on Discord’s systems under their own terms as well as ours.
• Transactional email - account and notification email.
• Email routing - receives forwarded mail at the address Email import gives you, and hands it to the portal. Only used if you switch that feature on.
• Amazon Selling Partner API - creating and updating your inbound shipments, reached through an integration provider.

Several of these are based outside the UK, mainly in the United States. Where personal data is transferred out of the UK we rely on the safeguards in each supplier’s data processing terms, such as the International Data Transfer Addendum. Ask us and we will tell you which supplier is which and where your data sits.

Retention

Enquiries are kept for up to two years. Client account, stock and billing records are kept for six years to meet UK tax obligations. Portal activity records are kept for the life of the account and for six years afterwards, because they are the audit trail behind charges you may need to query. Discord channel history persists until the channel is deleted, which happens when an account closes.

Forwarded email is treated more tightly than the rest, because you will inevitably forward more than you meant to. We keep the original message for fourteen days so that a failure to read it can be diagnosed against what actually arrived, and then delete it. Delivery codes are deleted within twelve hours, since they are worthless the next day. What we keep beyond that is the extracted business detail - the products, quantities, costs and dates - under the same six-year rule as the rest of your stock records. A message we could not verify as coming from the retailer is discarded and only the fact that something arrived is logged.

Your rights

Under UK GDPR you can ask for access to your personal data, correction, deletion, restriction or portability, and you can object to processing we base on legitimate interest. Email [email protected] and we will respond within one month. There is no automated decision-making or profiling in anything we run. If you are unhappy with how we have handled a request you can complain to the Information Commissioner’s Office at ico.org.uk.

Cookies

See our cookie policy. In short: the marketing pages set no cookies at all, and the portal sets only what is needed to keep you signed in.

Changes

If we change what we collect or who processes it, this page changes with it and the date at the top moves. Material changes affecting client accounts go to your Discord channel as well.