Privacy Policy

This Privacy Policy explains how Colourmedia (“we”, “us”), the provider of PushWMS, collects, uses and protects personal data, under the UK GDPR, the Data Protection Act 2018 and, for people in the European Economic Area, the EU GDPR. PushWMS is a multichannel inventory, order and warehouse management service for online sellers (“merchants”).

1. Who we are

PushWMS is operated by Colourmedia Solutions Ltd, a company registered in England and Wales (company number 9703935), whose registered office is at Unit C, Moorhouse Courtyard, Warwick-on-Eden, Carlisle, Cumbria, CA4 8PA. Our Data Protection Lead can be contacted at privacy@pushwms.com.

2. Our role

• When merchants connect a sales channel (such as TikTok Shop, Shopify, WooCommerce or eBay), PushWMS receives their customers’ order details. For that data, the merchant is the controller and we are their processor: we use it only to provide PushWMS to that merchant, on their instructions, under our Data Processing Agreement.
• For information about merchants and their staff who use PushWMS, and visitors to our website, we are the controller.

3. Personal data we process

About merchants’ customers (from connected channels): name, delivery and billing address, email address, phone number, order contents and value, shipping method, tracking numbers, and order notes.

About merchants and their users: name, business name and address, email address, phone number, VAT, company and EORI numbers, and account settings. Where a merchant uses them: warehouse activity (picks and packs) and pack desk video, which films the packing bench, without sound, and is deleted after 90 days.

Channel and courier credentials: access tokens and API keys that merchants authorise. These are encrypted and never shown back in full.

Technical data: IP address, browser type and request logs, kept for security and troubleshooting.

4. How we use it

• To receive and manage orders, sync products and stock, commit and allocate stock, print packing slips, and send orders to the courier the merchant chooses, and to update the channel when an order is fulfilled.
• To provide support, keep the service secure, and prevent fraud and abuse.
• To bill merchants and meet our legal obligations.

We do not sell personal data, use customers’ data for advertising or profiling, share one merchant’s data with another, or make decisions about anyone by automated means alone.

Lawful bases (where we are controller): performance of our contract with the merchant, our legitimate interests in running and securing the service, and compliance with legal obligations.

5. Who we share it with

We share personal data only as needed to provide the service:

Our sub-processors (we tell merchants at least 30 days before adding or replacing one):

Chosen by the merchant (the merchant’s own providers, not our sub-processors), and GitHub, which holds our source code and no customer data:

We may also disclose data where required by law, or to protect our rights or the safety of others.

6. Where data is stored

PushWMS stores and processes data in the United Kingdom (AWS London region, eu-west-2). If data is transferred outside the UK, for example to a courier delivering abroad, we rely on appropriate safeguards such as UK adequacy regulations or the UK International Data Transfer Addendum. The European Commission recognises the UK as giving adequate protection, so data from the EEA can come to PushWMS without further safeguards; any onward transfer uses the EU Standard Contractual Clauses.

7. How we protect it

Data is encrypted in transit (TLS 1.2+) and at rest (AWS KMS). Each merchant’s data is isolated by database row-level security, channel credentials are individually encrypted, and access is limited on a least-privilege basis with multi-factor authentication. More detail is in our Information Security Policy, available on request.

8. How long we keep it

We keep merchants’ customer data while the merchant uses PushWMS, or for less if the merchant chooses: each merchant sets how long shoppers’ details are kept once an order is finished. Some things go sooner, automatically: channels’ copies of orders and courier labels after 90 days, pack desk videos after 90 days, Amazon buyers’ details 30 days after the order is shipped, and the sign-in log after 12 months. Application logs are kept for 90 days, and encrypted backups expire automatically within 12 months. Credentials are deleted when a connection is removed. When a merchant closes their account or asks us to, we delete their data from our live systems within 30 days.

9. Your rights

You have the right to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. If you are a customer of a merchant that uses PushWMS, please contact that merchant first, as they control your data: PushWMS lets them give you a copy of your data or remove it. We will help them respond. You can also contact us at privacy@pushwms.com and we will pass your request to the right merchant.

You have the right to complain to the UK Information Commissioner’s Office (ico.org.uk, 0303 123 1113). If you are in the EEA you can also complain to the data protection authority where you live. We would appreciate the chance to address your concern first.

10. Cookies

PushWMS uses only cookies that are strictly necessary for the service to work, so they need no consent: a session cookie that keeps you signed in (ending when you sign out, after 8 hours idle or 24 hours), and short-lived cookies that protect sign-in and the flows that connect a sales channel. Your browser also remembers choices you make on it, such as the pack desk camera. We do not use analytics, advertising or tracking cookies, and pushwms.com loads no third-party scripts or fonts.

11. Changes to this policy

We review this policy at least once a year and whenever our services change. We will post the updated version here with a new date, and tell merchants by email of any significant change.

12. Contact

Colourmedia, privacy@pushwms.com