Business Customer Data Terms

These terms apply when a business uses PostRight to print and post letters. They form part of our Terms and Conditions.

1. Scope

The business is the controller and PostRight Ltd is the processor of the letter content and recipient details (the Data).

2. What We Process

Subject matter: printing and posting letters. Duration: from the Order until the Data is deleted under our retention schedule. Data: names, addresses and anything in the letter. Data subjects: the recipients and anyone named in the letter.

3. Instructions

We process the Data only to fulfil your Orders, and as needed for claims, support and our legal obligations, unless the law requires otherwise. Your Order is your instruction. We will tell you straight away if we think an instruction from you breaks data protection law.

4. Confidentiality

Everyone we allow to process the Data is bound by confidentiality.

5. Security

We use appropriate technical and organisational measures, including encryption in transit, encryption at rest by our providers, and access limited to our director.

6. Sub-Processors

You authorise the sub-processors listed in our Privacy Policy: Intelliprint (printing), Royal Mail (delivery), Supabase (database), Netlify (hosting), Resend (email), Anthropic (content checks on typed and template letters), Stripe (payments), Trustpilot (review invitations, which include the recipient's name) and postcodes.io (postcode checks). We will update that list and email you before adding a new one, and you may object. Each is bound by data protection terms, and we remain responsible for them.

7. Help With Your Obligations

We will help you respond to requests from individuals, assess and report breaches, and carry out impact assessments, as far as is reasonable.

8. Breaches

We will tell you without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach affecting your Data.

9. Deletion

We delete the Data under the retention periods in our Privacy Policy. At the end of our service to you, we will delete it or return it to you, as you choose, except where the law requires us to keep it.

10. Information and Audits

We will give you the information needed to show we comply with these terms, answer reasonable written questions within 14 days, and allow and contribute to audits, including inspections, by you or an auditor you appoint, on reasonable notice.

11. Transfers

Where a sub-processor handles Data outside the UK, the safeguards in our Privacy Policy apply.

12. Contact

PostRight Ltd, 3rd Floor, 86-90 Paul Street, London, EC2A 4NE. Email: info@postright.co.uk.