Privacy
Privacy Policy — AHCT WMS
AHCT Group Limited
Unit 7 Cornwall Business Centre, Cornwall Road, Leicester, LE18 4XH, United Kingdom
Company registration number: 12452641 · VAT: GB 346868942
Contact: info@ahctgroup.co.uk
Effective date: 11 July 2026
Last updated: 11 July 2026
1. Who we are and what this policy covers
AHCT Group Limited ("AHCT", "we", "us") operates a third-party logistics (3PL) fulfilment warehouse in Leicester, United Kingdom. We operate an internal warehouse management system known as AHCT WMS.
This policy explains how we handle personal data when our merchant clients ("Sellers") connect their marketplace accounts — such as Amazon, TikTok Shop, SHEIN or Temu — to AHCT WMS so that we can pick, pack and ship their customers' orders.
In respect of order and recipient data received from a marketplace:
- the Seller is the data controller;
- AHCT Group Limited acts as a data processor on the Seller's documented instructions, in accordance with Article 28 of the UK GDPR.
Where we determine the purposes of processing ourselves — for example, our own business records, invoicing and staff accounts — we act as a controller.
2. What personal data we process
We process the minimum data required to fulfil and dispatch an order:
| Category | Examples | Why we need it |
|---|---|---|
| Recipient contact and delivery details | Name, delivery address, postcode, country, telephone number, email address | To produce a carrier shipping label and deliver the parcel |
| Order details | Order reference, marketplace order ID, SKUs, quantities, weights, dimensions, declared values | To pick, pack, price and dispatch the order |
| Shipment details | Carrier, service, tracking number, dispatch date, delivery status | To dispatch the parcel and report tracking back to the marketplace and the Seller |
| Seller account data | Seller company name, contact name, business email and phone, marketplace authorisation tokens | To operate the Seller's account and maintain the marketplace connection |
We do not collect or store payment card details, bank details of end customers, marketplace passwords, or any special category data.
3. Legal basis
- Performance of a contract (UK GDPR Art. 6(1)(b)) — to provide fulfilment services under our contract with the Seller.
- Legal obligation (Art. 6(1)(c)) — to retain the tax and accounting records required by HMRC and the Companies Act 2006.
- Legitimate interests (Art. 6(1)(f)) — to secure our systems, prevent fraud, and investigate delivery disputes and claims.
4. How we obtain marketplace data
Sellers connect their marketplace account to AHCT WMS using the marketplace's own OAuth 2.0 authorisation flow. We never ask for, receive or store a Seller's marketplace username or password. The Seller grants a scoped authorisation, which the Seller can revoke at any time from the marketplace's own settings; on revocation we stop retrieving data immediately.
5. Who we share data with
We share the minimum necessary data with:
- Carriers — Royal Mail, DPD, The Delivery Group and other carriers we use, solely to produce a shipping label and deliver the parcel.
- The Seller — the controller of the data.
- The originating marketplace — to write back dispatch confirmations and tracking numbers.
- Our hosting and infrastructure providers, acting as sub-processors under written contract.
We do not sell personal data, use it for advertising, or use it to train machine-learning models. We do not use recipient data for any purpose other than fulfilling the order in question.
6. International transfers
Our systems and data are hosted within the United Kingdom and the European Economic Area. Where any transfer outside the UK/EEA is unavoidable, we rely on UK adequacy regulations or on the International Data Transfer Addendum to the EU Standard Contractual Clauses.
7. How long we keep data
| Data | Retention |
|---|---|
| Recipient personal data (name, address, phone, email) | Deleted or irreversibly anonymised within 30 days of the order being dispatched, unless a longer period is required to resolve an open delivery dispute, claim or investigation, or is required by law |
| Order, shipment and invoicing records required for tax and accounting | 6 years from the end of the relevant accounting period (HMRC VAT records and Companies Act 2006), held in a minimised, encrypted form |
| Marketplace authorisation tokens | Held only while the Seller's authorisation is active; destroyed on revocation or on termination of the contract |
| Security and audit logs | 12 months |
Where an open dispute requires us to keep recipient data beyond 30 days, we retain only the fields needed for that dispute, with access restricted to authorised staff, and we delete it as soon as the matter is closed.
8. How we protect data
- All data is encrypted in transit (TLS 1.2+) and at rest (AES-256).
- Access is role-based and granted on a least-privilege, need-to-know basis; each user has an individual account with a unique credential.
- Marketplace and carrier credentials are stored as encrypted secrets in our hosting platform's secret store, never in source code, and are never written to application logs.
- All access to personal data is logged and reviewed.
- We maintain a documented security incident response procedure and will notify the affected Seller and, where required, the Information Commissioner's Office (ICO) within 72 hours of becoming aware of a personal data breach.
- Staff receive data protection training and are bound by confidentiality obligations.
9. Your rights
Individuals whose data we process as a processor should contact the Seller (the controller) in the first instance. If you contact us directly, we will forward your request to the relevant Seller and assist them in responding.
Where we act as a controller, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and the right to data portability. To exercise these rights, contact info@ahctgroup.co.uk.
You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.
10. Contact
Data protection contact: info@ahctgroup.co.uk
Postal: AHCT Group Limited, Unit 7 Cornwall Business Centre, Cornwall Road, Leicester, LE18 4XH, United Kingdom
11. Changes to this policy
We will post any changes to this policy on this page and update the "Last updated" date above.
