Privacy policy
What we do with personal data: yours, and your customers'. Written to be read, not to be skipped.
The short version. Our website sets optional cookies from Meta (advertising) and Google (analytics), and only if you accept them on the banner. Reject them, or ignore the banner, and no cookie is set and nothing goes to Meta. Google is the one exception and we would rather say so here than bury it: since 23 September 2026 its tag loads for everyone in a switched-off state, setting no cookie, and sends a short message naming the page you are on. Section 6 explains it and how to stop it. We run no session recording. If you ask us for a quote we use your details to send you a quote and nothing else. Our mailing list is strictly opt-in. You are only on it if you ticked the box yourself, and one line in any email takes you off it. When we pack and ship orders for a client, the customer data inside those orders belongs to the client, not to us, and we only ever act on their instructions.
1. Who we are and how to contact us
Angler Fulfilment is a UK order-fulfilment provider. We are the data controller for the personal data described in Section 3, except for the order data we handle on behalf of our clients, where we act as a processor (see Section 9).
- Legal entity: Angler Fulfilment Ltd (Company No. 17403880)
- Registered address: 77 Smithy Bridge Road, Littleborough, OL15 0BQ, United Kingdom
- Privacy contact: privacy@anglerfulfilment.co.uk
Email us at that address with any question about this policy or about your data. We aim to reply within 5 working days, and in any case within one month.
2. The two roles we play
Because we fulfil orders on behalf of other businesses, we handle personal data in two different ways and the law treats them differently.
As a controller: for people who visit this website, ask us for a quote, run a client account with us, or apply for a job. We decide how and why that data is used, and this policy governs it.
As a processor: for the personal data inside the orders we pick, pack and ship, such as the name and delivery address of a client's customer. There, our client is the controller and we act only on their documented instructions. That relationship is governed by our Data Processing Agreement with the client, not by this policy. See Section 9.
3. The personal data we collect (as controller)
Website visitors
If you accept cookies on the banner, we use Google Analytics to measure visits and how our ads perform, as described in Section 6. If you do not, the only measurement is Cloudflare Web Analytics, which counts page views for us. It sets no cookie, uses no fingerprinting, assigns you no identifier and cannot follow you to another site, so there is nothing in it to build a profile from and, being neither advertising nor personalisation, it needs no consent under PECR. Our hosting provider also automatically records standard server log data (IP address, the page requested, timestamp, browser and device type) to serve the page and to protect the site from abuse. We do not use those logs for marketing or measurement.
People who ask for a quote or contact us
- Name and email address
- Business or store name, and store link
- Approximate monthly order volume and product type
- Anything you choose to tell us in the message field
- Phone number, if you contact us by phone or WhatsApp
Clients
- Account and contact details for the people we deal with
- Billing and payment information, and invoice history
- Correspondence and support history
- Business verification details we are required to hold under HMRC's Fulfilment House Due Diligence Scheme, where it applies, including VAT and EORI numbers and company details
People who subscribe to our mailing list
- Your email address
- A record of your consent: the date and time you subscribed, and the exact wording you agreed to
That is the whole list. We do not ask for your name, we do not append anything to your record from other sources, and we do not track whether you open or click.
People who make a referral, and the people they refer
Our referral programme works by one person giving us another person's details, so it is worth setting out on its own. From the person making the referral we collect a name and email address, and a phone number if they choose to give one. About the person being referred we are given a name and email address, and optionally a company name, a phone number and whatever context the referrer writes in the notes field. We also record the referrer's declaration that they have that person's permission, and the date and time of the submission.
A referral reaches us as an email and nothing more. It is not stored in any database on this website, the referred person is not added to our mailing list or to any other marketing list, and when we make contact we say who referred them. If you have been referred and would rather we did not hold your details, email privacy@anglerfulfilment.co.uk and we will delete them, without you having to give a reason.
Job applicants
- Name, email address and phone number
- The role you are applying for, and anything you tell us about your experience
- Your CV, as a file you upload
- How you heard about us, if you choose to say
Applications come in through the form on our careers page or straight to our inbox by email. Either way it reaches us as an email: your CV is not stored in any database on this website, and it is not shared with a recruitment agency. We keep unsuccessful applications for six months, as set out in Section 10, and then delete them. Ask us to delete yours sooner and we will.
We do not intentionally collect special-category data such as health or ethnicity, and we ask that you do not send it to us.
4. Where we get it
Directly from you: through the quote form, by email, WhatsApp or phone, and during onboarding. From your use of this website, in the form of the server logs described above. And, for clients, from the sales channels you connect to us, such as your Shopify, Amazon, eBay, Etsy or TikTok Shop store, so that orders can reach us automatically. And, for the referral programme, from somebody else: if a person refers you to us, we hold what they gave us, which is the list set out in Section 3, and we tell you who referred you the first time we contact you.
5. Why we use it, and our lawful basis
Under UK GDPR we need a lawful basis for each use of personal data. Ours are:
| What we do | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Reply to your quote request or enquiry | Legitimate interests: responding to a business enquiry you made |
| Provide our fulfilment, prep and returns services to a client | Performance of a contract |
| Send invoices and keep financial records | Legal obligation (tax), and performance of a contract |
| Keep our systems and premises secure and prevent fraud | Legitimate interests |
| Carry out due-diligence checks required by HMRC's Fulfilment House Due Diligence Scheme | Legal obligation |
| Send you our mailing list, if you subscribed to it | Consent (Art. 6(1)(a)), given by ticking the box on the signup form. You can withdraw it at any time and every message tells you how |
| Reply to an existing client about their own account and service | Performance of a contract. This is service correspondence, not marketing, and is not affected by whether you are on the mailing list |
| Contact a person whose details we were given through the referral programme | Legitimate interests: a single business approach that the referrer has confirmed you are expecting. Tell us to stop and we delete your details |
| Check whether a referral qualifies, and pay the reward | Legitimate interests, and steps taken at the referrer’s request before a contract with them |
| Handle a job application | Legitimate interests, and steps taken at your request before a contract |
Our mailing list, in full
There is a newsletter signup in the footer of every page. It is worth being precise about it, because email marketing in the UK is governed by the Privacy and Electronic Communications Regulations (PECR) as well as the UK GDPR.
- It is opt-in only. The consent box is not pre-ticked and the form will not submit without it. We never add anyone to the list because they asked for a quote, because they became a client, or because we met them somewhere.
- What we send: at most one email a month, covering rate-card changes, peak-season deadlines and write-ups of how our operation actually runs.
- How to leave: reply “unsubscribe” to any email, or write to privacy@anglerfulfilment.co.uk. We action it the same working day. Withdrawing consent is as easy as giving it, and it does not affect anything else we do for you.
- No tracking: we do not use open-tracking pixels or click-tracking links, so we cannot tell whether you read a message. That is deliberate.
- Where it is stored: subscriptions are submitted through Cloudflare, who host this site, delivered to us by Resend, and we send from our own mailbox. See Sections 7 and 8. We do not use a third-party marketing platform, and if we ever adopt one we will update this policy and name it before your address is transferred to it.
- We never sell, rent or share the list.
6. Cookies, analytics and tracking
This website sets non-essential cookies from two companies, Meta and Google, and only if you accept them. They measure whether our advertising reaches the right sellers and how the site is used, and let our ads be shown again to people who have visited (remarketing). They are off until you press Accept on the banner, and if you reject them or ignore the banner they are never set. Beyond those, and the cookieless Cloudflare Web Analytics page counting described above, we run no session recording, no A/B testing and no fingerprinting.
What changed. Until August 2026 this site set no cookies at all and this section said so. We began advertising, and we added the pixel. It sits behind a consent banner rather than firing on arrival, and this paragraph exists so the change is stated rather than buried. On 21 September 2026 we added Google Analytics behind the same banner. The banner had mentioned Meta only, so an earlier Accept does not count for Google and everyone is asked once more. Later the same day the banner was widened to cover remarketing, and anyone who had accepted the narrower wording was asked again. On 23 September 2026 the Google tag began loading for every visitor in a switched-off state, described below, so that advertising bought for visitors who never answer the banner can still be measured.
The Meta pixel. If you consent, Meta Platforms Ireland Ltd sets a _fbp cookie lasting three months and receives the page you are viewing, your IP address, your browser and device type, and the fact that a page view or a quote request happened. It does not receive the contents of your quote form as you type it. However, if you submit a quote request after accepting, our server also reports that conversion to Meta directly, server to server (Meta calls this the Conversions API). That report contains one-way cryptographic hashes of your email address, your first and last name, your country and, only if you chose to give one, your phone number, plus your IP address and your browser type. Hashing means Meta receives a fixed-length code rather than the values themselves, which lets it match the conversion to an account it already holds without us handing over your details in readable form. Even so, a hash of your data is still your personal data, and we treat it as such. Meta does not receive your store link, your order volumes or anything you wrote in the message box. Our server checks your recorded consent before sending, so if you rejected the banner, or never answered it, no server-side report is sent either. Our lawful basis is your consent (UK GDPR Art. 6(1)(a)), given through the banner and withdrawable at any time from the Cookie settings link in the footer. Meta is a joint controller with us for this data; its own terms are at facebook.com/privacy/policy.
Google Analytics. If you consent, Google Ireland Ltd sets the _ga and _ga_C5QKXS3DC1 cookies, lasting up to two years, and _gcl_au, lasting three months, which links a quote request to the Google ad click that led to it. Google receives the pages you view, the page you came from, your browser and device type, an approximate location worked out from your IP address, and, if you submit a quote request, the fact that one was submitted. It does not receive your name, your email address or anything you wrote in the form. If you accept, Google may also use your visit to show you our ads later on other sites and apps (this is called remarketing), and, if you are signed in to a Google account with ad personalisation switched on, link it to that account. Our lawful basis is your consent (UK GDPR Art. 6(1)(a)), given through the same banner and withdrawable at any time from the Cookie settings link in the footer; withdrawing also deletes the Google cookies from your browser. Google processes the analytics data on our behalf, and acts under its own terms for advertising measurement, set out at policies.google.com/privacy.
The Google tag before you answer the banner. Since 23 September 2026 the Google tag loads on every page for every visitor, rather than only after Accept, and it loads switched off. Before you answer the banner it sets no cookie, gives you no identifier and cannot follow you to another site. It does send Google a short message on each page view saying which page was loaded, which carries your IP address and browser type. Google uses these to estimate the results of advertising we buy for the many visitors who never answer a banner at all. Because nothing is stored on or read from your device, this sits outside the cookie rules in PECR; our lawful basis under the UK GDPR is our legitimate interests (Art. 6(1)(f)) in measuring whether our advertising works, weighed against the fact that no identifier, no cookie and nothing you typed is involved. Blocking googletagmanager.com in your browser, or using an ad blocker, stops it entirely and breaks nothing on this site. You can also object to it at the address in Section 1. Pressing Accept switches the tag fully on; pressing Reject leaves it exactly as described here.
The consent cookie. Recording your answer requires one first-party cookie, af_consent3, lasting six months. It stores nothing but the word granted or denied. It is strictly necessary and therefore does not itself need consent.
Fonts. The typeface used across the site is served from our own domain. Your browser does not contact any third party to load it, so no font provider receives your IP address or browser type. This was previously served by Google Fonts and is not any more.
The full detail, including a table of every cookie, is in our cookie notice.
7. Who we share data with
We share personal data only where it is necessary to run the service, with:
- Delivery carriers: Royal Mail, Evri, DPD, DHL and similar, to deliver orders. They receive recipient name, address and contact details, and act as controllers in their own right for delivery.
- Cloudflare: hosts this website and processes quote-form, referral and newsletter-signup submissions at the point of delivery. Cloudflare is a US company; see Section 8.
- Resend: delivers form submissions to our inbox as email. The sending infrastructure for this domain is in Ireland (eu-west-1). Resend Inc. is a US company; see Section 8.
- Meta Platforms Ireland Ltd: receives advertising and conversion data, but only from visitors who have accepted cookies on the banner. See Section 6.
- Google Ireland Ltd: receives analytics and ad measurement data from visitors who have accepted cookies on the banner, and a cookieless page message from those who have not. See Section 6.
- Our email and communications providers, including WhatsApp Business where you choose to contact us that way.
- Our order-management and accounting software providers, who process client and order data on our instructions under written data-protection terms.
- Professional advisers: accountants, insurers and lawyers, where needed.
- HMRC and other authorities, where we are legally required to disclose, including under the Fulfilment House Due Diligence Scheme.
We do not sell personal data and we do not share it with data brokers. We do share advertising and measurement data with Meta and Google, as advertising networks, but only for visitors who have given consent. See Section 6. A current list of the sub-processors we use is available on request from privacy@anglerfulfilment.co.uk, and forms part of the Data Processing Agreement we sign with every client.
8. Sending data outside the UK
Our warehouse operation and our records are in the UK. Three flows leave it:
- Quote-form, referral and newsletter-signup submissions are processed by Cloudflare, a US company, and delivered by Resend, a US company whose sending infrastructure for this domain is located in Ireland.
- Advertising and conversion data, for consenting visitors only, goes to Meta Platforms Ireland Ltd, which is in the EEA but may transfer onward to Meta Platforms, Inc. in the United States under its own safeguards.
- Analytics and ad measurement data, for consenting visitors only, goes to Google Ireland Ltd, which is in the EEA but may transfer onward to Google LLC in the United States under its own safeguards.
Where a supplier processes personal data outside the UK, we rely on the transfer safeguards in our written agreement with that supplier (an adequacy decision, the UK International Data Transfer Agreement or Addendum, or the UK version of the EU Standard Contractual Clauses), so that the data keeps an equivalent level of protection. If you would rather not send your details through the form, email us instead at info@anglerfulfilment.co.uk.
9. Order data we handle for our clients (our processor role)
When we fulfil orders we process the personal data of our clients' customers: recipient name, delivery address, contact details, order contents and any delivery notes. For that data:
- Our client is the controller and is responsible for having a lawful basis and for giving their own customers privacy information.
- We act only on the client's documented instructions, under a Data Processing Agreement that meets Article 28 of the UK GDPR.
- If you are a shopper whose order we packed and you want your data corrected or deleted, please contact the shop you bought from. They are the controller, and we will support them in responding to you.
10. How long we keep it
| What | How long |
|---|---|
| Quote and enquiry data, where you don't become a client | 12 months from last contact |
| Client account, order and financial records | The life of the contract, then 6 years, to meet tax record-keeping and, where it applies, HMRC Fulfilment House Due Diligence Scheme requirements |
| Mailing-list subscriptions | Until you unsubscribe. We remove the address within one working day and keep only the consent record itself for 12 months afterwards, as evidence that the subscription was properly obtained |
| Referrals, where the referred person does not become a client | 12 months from the submission, and sooner if either the referrer or the referred person asks us to delete them |
| A referral reward we have paid | 6 years, as part of our financial records |
| Other business-to-business contacts | Until you opt out, reviewed every 24 months |
| Unsuccessful job applications, including the CV itself | 6 months, unless you ask us to keep them on file, and sooner if you ask us to delete them |
| Website server logs | As retained by our hosting provider for security and diagnostics, typically no more than 30 days |
11. How we keep it safe
We use technical and organisational measures appropriate to the size of our operation: access controls so staff only see what their role requires; encrypted connections for data in transit; access-controlled premises; regular backups; malware protection and prompt software updates; written confidentiality obligations and data-protection training for staff; and a documented breach-response procedure. No system is ever perfectly secure, but we work to keep the risk low, and we will notify you and the ICO of a personal-data breach where the law requires it.
12. Your rights
Under UK GDPR you have the right to be informed; to access your data; to have inaccurate data corrected; to have data erased; to restrict or object to processing; to data portability; and to withdraw consent at any time where we rely on it. Where we rely on legitimate interests, you have the right to object and we will stop unless we have compelling grounds not to.
Exercising these rights is free in normal cases and we will respond within one month. Email privacy@anglerfulfilment.co.uk. We may ask you to confirm your identity first.
13. Children
Our service is aimed at businesses, not children. We do not knowingly collect data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
14. Changes to this policy
We may update this policy as our service changes. The “last updated” date at the top shows the current version, and we will tell clients directly by email about any significant change.
15. Complaints
If you are unhappy with how we have handled your data, please tell us first at privacy@anglerfulfilment.co.uk so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
Angler Fulfilment Ltd is registered with the Information Commissioner’s Office as a data protection fee payer. Our registration reference is ZC228998, and you can check it against the ICO register of fee payers.