Privacy Policy

1. Introduction

This Privacy Policy explains how Huup Ltd (“Huup”, “we”, “us”), a company registered in England and Wales (Companies House number 08708494, ICO registration ZC165061) with its registered address at 22 Old Montague Street, London E1 5NG, United Kingdom, collects, uses and protects personal data when you use the Huup platform, our website at www.huup.com, and any related services (together, the “Services”).

Huup is the data controller for personal data we collect about our customers, prospects and website visitors. Where we process personal data on behalf of our business customers (for example, end-customer messages routed through Huup), we act as a data processor and our customer is the controller — that processing is governed by our agreement with that customer.

This policy applies to all users globally. If you're in the UK, your rights are governed by the UK GDPR. If you're in the EEA, your rights are governed by the EU GDPR. Both are described in section 8.

2. Information we collect

We collect personal data in three ways: data you give us directly, data we collect automatically as you use the Services, and data we receive from third parties.

2.1 Account data

Identity data — name, job title, employer.
Contact data — email address, phone number, billing address.
Authentication data — hashed password, multi-factor authentication secrets, session tokens.
Billing data — VAT registration numbers and equivalent tax identifiers (where applicable), billing email, payment method tokens (we do not store full card numbers; see Stripe below).

2.2 Usage data

Product telemetry — pages visited, features used, click events, error logs.
Device data — IP address, browser type, operating system, device identifiers, time zone.
Performance data — request latency, API usage volumes.

2.3 Cookies and similar technologies

We use cookies for authentication, security and — with your consent — analytics and advertising. See our Cookie Policy for the full list and how to manage preferences.

2.4 Third-party data

Marketplace integrations — when you connect eBay, Amazon, OTTO Market, Shopify, Squarespace or other channels, we receive listing data, order data, buyer messages and limited buyer contact data on your behalf.
Payments (Stripe) — we receive payment status and the last 4 digits of cards for receipts; full card details are held by Stripe.
Identity verification — where required for fraud prevention, we may receive verification results from KYC providers.

3. How we use your information

We use personal data for the following purposes:

Service operation — to run, maintain and secure the Huup platform, including authentication, billing and customer support.
Improvement — to understand how customers use the Services, investigate issues, prioritise improvements and develop new features. We use aggregated or pseudonymised data where possible.
Legal compliance — to comply with our obligations under tax, accounting, anti-money-laundering and other applicable laws.
Communications — to send service notices, security alerts, invoices and operational updates you cannot opt out of while you have an active account.
Marketing — with your prior opt-in, to send newsletters, product updates and event invitations. You can withdraw consent at any time using the unsubscribe link in any email.

4. Lawful basis (GDPR)

Under the UK GDPR and, where applicable, the EU GDPR, we rely on one of the following lawful bases for each processing activity:

Performance of a contract — to deliver the Services you have signed up for and to handle billing.
Legitimate interest — to keep our Services secure, prevent abuse, improve our products and run our business. We document this balance in our internal records.
Consent — for marketing emails, non-essential cookies and any optional integrations you choose to enable. You can withdraw consent at any time.
Legal obligation — to retain financial records, respond to lawful requests and comply with regulatory requirements.

6. International transfers

Huup operates primarily in the UK and EEA. Customer data is stored in AWS EU/UK regions by default. Where a sub-processor or marketplace integration necessarily processes data outside the UK/EEA (for example, Amazon or eBay endpoints), we rely on appropriate safeguards including the UK International Data Transfer Agreement (IDTA), EU Standard Contractual Clauses (2021), and supplementary technical measures such as encryption in transit and at rest.

7. Data retention

We keep personal data only as long as necessary for the purposes it was collected, including legal, accounting and reporting requirements. Typical retention periods:

Account data — retained for the lifetime of your account and for up to 90 days following account closure, after which it is securely deleted or anonymised.
Billing & tax records — minimum 6 years to comply with HMRC requirements.
Product telemetry & application logs — up to 12 months, after which logs are purged or anonymised. Buyer personal data accessed via the Amazon Selling Partner API is deleted 28 days after the order date — stricter than the 30-day ceiling in the Amazon SP-API Data Protection Policy.
Security logs & access audits — up to 12 months, after which they are securely deleted.
Marketing contact lists (consent-based) — until you withdraw consent or unsubscribe, or after 24 months of inactivity since your last engagement (whichever is earlier), at which point data is deleted or anonymised.

8. Your rights (GDPR)

If you're in the UK or EEA, you have the following rights over your personal data under the UK GDPR or EU GDPR:

Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate or incomplete data.
Erasure ("right to be forgotten") — ask us to delete your personal data where there's no overriding legitimate ground or legal obligation to retain it. This right doesn't apply where retention is needed to comply with a legal obligation or to establish, exercise or defend legal claims.
Portability — where we process your data by automated means under consent or contract, receive it in a structured, machine-readable format and have it transferred directly to another controller where technically feasible.
Restriction — ask us to limit how we use your data while a query is resolved.
Objection — object at any time to processing based on our legitimate interests (including profiling). We'll stop unless we can show compelling grounds that override your rights, or the processing is needed for legal claims. For direct marketing, your right to object is absolute — we stop immediately.
Withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any right, email [email protected]. We respond within one month. You also have the right to complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.

8.1 Accountability records

We maintain a Record of Processing Activities (ROPA) under Article 30 of the UK GDPR, and we assess new integrations for data-protection risk, conducting a Data Protection Impact Assessment (DPIA) under Article 35 where processing is likely to result in a high risk to data subjects. Records are available to the ICO on request.

9. Security

page.We protect your data with layered technical and organisational measures: TLS 1.2+ (TLS 1.3 where supported) in transit, AES-256 encryption at rest with keys managed by AWS KMS, tenant-isolated databases (database-per-tenant architecture), enforced multi-factor authentication for staff, role-based access controls, granular audit logging and continuous vulnerability scanning of dependencies. See our

9.1 Breach notification

If we have a personal data breach, we'll notify the relevant supervisory authority (typically the UK Information Commissioner's Office) within 72 hours where required by Article 33 of the UK GDPR, and will notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms. Where the breach involves data processed under a marketplace integration, we will additionally notify the marketplace operator within their required notification window — for the Amazon Selling Partner API, this is within 24 hours of detection, in line with the Amazon Data Protection Policy.

10. Children

The Huup Services are designed exclusively for business use and are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, please contact [email protected] and we will delete it.

11. Updates to this policy

We may update this Privacy Policy from time to time. We will post the new version at this URL and update the “Last updated” date. For material changes, we will notify you in-product or by email at least 30 days before they take effect.

12. Contact

Questions, requests or complaints about this policy or our handling of personal data should be sent to:

Huup Ltd — Data Protection Contact

22 Old Montague Street, London E1 5NG, United Kingdom

Email (privacy queries): [email protected]

Companies House: 08708494

Huup Ltd has not appointed a Data Protection Officer (DPO) under Article 37 of the UK GDPR, as our processing activities don't meet the mandatory appointment threshold in Article 37(1). Privacy queries — including rights requests under section 8 — are handled by our legal team at the contact above. If you think a formal DPO is required for your purposes, contact us and we'll review.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk) or your local EU supervisory authority.

13. Automated decision-making

We don't make solely automated decisions that produce legal effects or similarly significant effects under Article 22 of the UK GDPR. Where we use profiling — for example, analysing usage patterns to suggest features — a human is involved in any decision that materially affects you.

If this changes, we'll update this policy and tell you what the UK GDPR requires us to disclose — including the logic involved and what it means for you.

14. Adequacy and international transfers

For transfers of personal data from the EEA to the UK, we rely on the European Commission’s adequacy decisions for the United Kingdom, renewed on 19 December 2025 following the UK Data (Use and Access) Act 2025 and valid until 27 December 2031, which recognise the UK as providing an adequate level of data protection. For transfers of personal data from the UK to the EEA, the UK Government’s adequacy regulations recognise the EEA/EU member states as adequate. Where we transfer data outside the UK and EEA — for example, to sub-processors located in the United States — we rely on the safeguards described in section 6.

16. Connected Google accounts (Google Ads & Tag Manager)

When you use Huup's advertising features, you can connect your own Google Ads and Google Tag Manager accounts to Huup through Google's official OAuth sign-in. We access these accounts only after you explicitly authorise it, and only to provide the features you ask for inside Huup.

Google Ads (scope .../auth/adwords) — to create, read, update and report on the advertising campaigns in the Google Ads accounts you connect.
Google Tag Manager (tagmanager scopes) — to read your containers and publish the conversion-tracking tags you ask us to set up on your website.
Basic Google profile (openid, email) — to identify which Google login you connected.

We use this data solely to operate the advertising features you request. We do not use Google user data for our own advertising, we do not sell it, and we do not share it with third parties except as needed to provide the service to you or where required by law. OAuth tokens are stored encrypted, and you can disconnect at any time from Settings → Integrations → Ads, which revokes Huup's access.

Huup's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Privacy Policy.