Privacy Policy

This Privacy Policy applies to the Zobook website (zobook.co.uk) and the Zobook inventory, sales, and finance platform (the "Service"), operated by Zobook Ltd ("Zobook", "we", "us"), a company registered in England & Wales (company no. 14009071), with its registered office in London, United Kingdom. Zobook Ltd is the data controller for the personal data described here. For the business data our customers process through the Service, Zobook acts as a data processor on the customer's behalf, under the terms of our Data Protection statement and Data Processing Agreement.

1. Data we collect

2. How we use data

• provide, operate, maintain, and secure the Service;
• authenticate users and manage permissions and roles;
• respond to enquiries, demos, support requests, and contact-form submissions;
• process payments and manage your subscription;
• send service, security, and (where you have not opted out) product communications;
• detect, prevent, and investigate fraud, abuse, and security incidents;
• comply with our legal and regulatory obligations.

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects about you.

3. Lawful bases (UK GDPR)

We rely on: performance of a contract (to deliver the Service you sign up for); legitimate interests (to secure and improve the Service and run our business, balanced against your rights); consent (for non-essential cookies and marketing email, which you can withdraw at any time); and legal obligation (for tax, accounting, and compliance).

4. How we share data

We do not sell your personal data. We share it only with:

• Sub-processors who help us run the Service (hosting, email delivery, payment processing, error monitoring), under written data-processing terms. See our Data Protection statement for the current list.
• Third-party platforms you choose to connect, only to the extent needed to provide the integration you enabled.
• Authorities or advisers where required by law, to enforce our terms, or to protect rights, safety, and property.
• A buyer or successor in the event of a merger, acquisition, or sale of assets, subject to this policy.

Data accessed from the Amazon Selling Partner API is never sold, and is never aggregated across customers or shared with other sellers — see section 8.

5. How we store and protect data

Data is hosted in data centres in the United Kingdom and European Union. We protect it with encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls on a least-privilege basis, multi-factor authentication for staff, network isolation, audit logging, regular encrypted backups, and ongoing monitoring. Access by our staff is restricted to those who need it to operate or support the Service. More detail is in our Security overview.

6. International transfers

Where data is transferred outside the UK or EEA (for example to a sub-processor), we rely on an adequacy decision or appropriate safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses. A copy of the relevant safeguard is available on request.

7. Data retention & deletion

We keep personal data only as long as needed for the purposes above or as required by law. Customer business data is retained for the life of your account; on closure we delete or anonymise it within 90 days, except where law requires longer retention (for example, certain financial records). Data retrieved from connected platforms is deleted within 30 days of you disconnecting the integration or requesting deletion. You can request deletion at any time (see section 9).

8. Amazon Selling Partner API data

If you connect an Amazon Selling Partner account, we access information through Amazon's official Selling Partner API (SP-API) strictly on your authorisation, including Brand Analytics, Search Query Performance, sales and traffic, advertising and promotion, order, and inventory data. In line with the Amazon Acceptable Use Policy and Data Protection Policy:

• we use this data only to provide analytics and inventory services back to the selling partner whose account it came from;
• we do not aggregate or combine one selling partner's data with another's to create or sell benchmarks, reports, or insights;
• we do not promote, publish, or share insights about Amazon's business;
• Personally Identifiable Information from Amazon orders is encrypted in transit and at rest, access-controlled, retained only as long as required to provide the Service, and deleted within 30 days of disconnection unless law requires otherwise.

You can revoke Zobook's access at any time from Amazon Seller Central. See our full Data Protection statement.

9. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict, or object to processing of your personal data, to data portability, and to withdraw consent at any time. To exercise any right, email [email protected]; we respond within one month. If your data is processed by a customer using the Service (where we are the processor), we will refer your request to that customer. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

10. Marketing & your choices

We only send marketing email with your consent or to existing customers about similar services, and every message includes an unsubscribe link. You can opt out at any time without affecting service communications you need to receive.

11. Children

The Service is for businesses and is not directed at children under 16. We do not knowingly collect their data.

12. Changes

We may update this policy from time to time. Material changes will be posted here with a revised "last updated" date and, where appropriate, notified to account holders.

13. Contact us

For any privacy question or to exercise your rights, contact our data protection team:

Zobook Ltd, London, United Kingdom
Email: [email protected]
General enquiries: [email protected]