Privacy policy

1 Who We Are

The Stock Desk is a trading name of Jay Preston Winter, a sole trader operating in the United Kingdom. We provide inventory consulting services to eCommerce and Shopify brands. For any questions about this Privacy Policy or how we handle your data please contact us: Email: hello@thestockdesk.com Website: thestockdesk.com Address: 105 Whitehouse Road, Dordon, Warwickshire

2 Our Commitment to Your Privacy

We are committed to protecting your personal data and handling it responsibly, transparently, and in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, how long we keep it, and what your rights are. We use plain language throughout — if anything is unclear please contact us directly.

3 What Personal Data We Collect

We collect only the data we genuinely need to provide our services and communicate with you. The personal data we may collect includes: Contact information — your name, email address, and business name submitted through our contact form or at the point of purchase. Business information — your Shopify store URL, number of SKUs, monthly revenue range, and stock-related information you provide to us voluntarily through our intake forms or during our engagement. Communication data — emails, messages, and notes from calls and conversations between us. Purchase data — details of services purchased through our website including order confirmation information processed by Squarespace. Technical data — your IP address, browser type, and pages visited on our website, collected automatically by Squarespace's analytics tools. Scheduling data — your name, email address, and appointment details if you book a discovery call through our Acuity Scheduling system. We do not collect any special category data as defined under UK GDPR — including health information, ethnicity, political opinions, or biometric data. We do not collect payment card details directly. All payments are processed securely by Squarespace Payments and we never see or store your full card details.

4 How We Collect Your Data

We collect your personal data in the following ways: Directly from you — when you complete our contact form, purchase a service, book a discovery call, or communicate with us by email or WhatsApp. Automatically — when you visit our website, Squarespace collects basic technical data including your IP address and browsing behaviour on our site. This is standard behaviour for all Squarespace-hosted websites. From third party tools — our scheduling tool Acuity Scheduling and payment processor Squarespace Payments collect data on our behalf when you interact with those services.

5 Why We Collect Your Data and Our Lawful Basis

Under UK GDPR we must have a lawful basis for processing your personal data. We rely on the following lawful bases depending on the purpose of processing. Contract — we process your contact information, business data, and purchase information because it is necessary to provide the services you have purchased or to take steps at your request before entering into a contract. This is our primary lawful basis for client data. Legitimate interests — we process basic enquiry data from our contact form to respond to your message and assess whether we can help you. We consider this processing necessary for our legitimate business interests and not overridden by your privacy rights. Legal obligation — we may process and retain certain data where required by law, including financial records required by HMRC. We do not use your personal data for automated decision-making or profiling. We do not use your data for direct marketing without your explicit consent.

6 How We Use Your Data

We use your personal data solely for the following purposes: To respond to enquiries submitted through our contact form or by email. To deliver the consulting services you have purchased including weekly stock reports, audits, and review calls. To send invoices and process payments for our services. To communicate with you about your service including scheduling calls and sending updates. To comply with our legal obligations including tax record-keeping requirements under HMRC rules. To improve our website and services using anonymised analytics data provided by Squarespace. We will never use your data for any purpose other than those listed above without telling you first and, where required, obtaining your consent.

7 Who We Share Your Data With

We do not sell your personal data to any third party under any circumstances. We share your data only with the following trusted third party service providers who process it on our behalf and are contractually obligated to protect it: Squarespace — our website hosting and payment processing provider. Data processed by Squarespace is subject to Squarespace's privacy policy available at squarespace.com/privacy. Acuity Scheduling — our appointment booking tool used to manage discovery calls. Data processed by Acuity is subject to Acuity's privacy policy. Google Workspace — we use Google Drive, Gmail, and Google Meet to store client files, communicate, and conduct calls. Data stored in Google Workspace is subject to Google's privacy policy. We may disclose your personal data to law enforcement or regulatory authorities if required to do so by law. We will notify you of any such disclosure where legally permitted to do so.

8 International Data Transfers

Some of our third party service providers — including Google and Squarespace — may process your data outside the United Kingdom. Where this occurs we ensure appropriate safeguards are in place in accordance with UK GDPR requirements, including standard contractual clauses or equivalent transfer mechanisms recognised by the UK ICO.

9 How Long We Keep Your Data

We retain your personal data only for as long as necessary for the purpose it was collected. Enquiry data from visitors who do not become clients — deleted within 6 months of your last contact with us. Client data including stock reports, emails, and business information — retained for 12 months following the end of our engagement, after which it is securely deleted. Financial records including invoices and payment data — retained for 6 years in accordance with HMRC requirements for sole trader records. Website analytics data — retained in accordance with Squarespace's data retention policies. You may request early deletion of your data at any time — see Section 11 for details.

10 Cookies

Our website is hosted on Squarespace which uses cookies — small text files placed on your device — to operate the website, analyse traffic, and improve user experience. The cookies used on thestockdesk.com include: Essential cookies — necessary for the website to function. These cannot be disabled. Analytics cookies — used by Squarespace to understand how visitors use the site. These collect anonymised data including pages visited and time spent on the site. We do not use advertising cookies or third party tracking cookies. You can control and disable non-essential cookies through your browser settings. Please note that disabling cookies may affect the functionality of our website.

11 Your Rights Under UK GDPR

Under UK GDPR you have the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, and the right to object. These rights are explained below in plain language. Right to be informed — you have the right to know how your data is being used. This Privacy Policy fulfils that obligation. Right of access — you have the right to request a copy of the personal data we hold about you. We will provide this within one month of your request. Right to rectification — if any data we hold about you is inaccurate or incomplete you have the right to ask us to correct it. Right to erasure — you have the right to ask us to delete your personal data where there is no legitimate reason for us to continue holding it. Note that we may be required to retain certain data for legal reasons such as HMRC compliance — we will explain this clearly if it applies. Right to restrict processing — you have the right to ask us to pause processing of your data in certain circumstances, for example while a dispute is being resolved. Right to data portability — you have the right to receive your personal data in a structured, commonly used format so you can transfer it to another provider. Right to object — you have the right to object to our processing of your personal data where we are relying on legitimate interests as our lawful basis. Rights relating to automated decision-making — we do not carry out any automated decision-making or profiling so this right does not currently apply. To exercise any of these rights please email hello@thestockdesk.com with your full name, the nature of your request, and sufficient information for us to identify your data. We will respond within one month. We will not charge a fee for reasonable requests.

12 How We Protect Your Data

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, or disclosure. These measures include: All client files are stored in a private Google Drive folder accessible only by us. All communications are conducted via password-protected Google Workspace accounts with two-factor authentication enabled. We do not store payment card details — all payments are processed securely by Squarespace Payments. We do not send sensitive client data via unencrypted email where it can be avoided. While we take all reasonable precautions, no method of transmission over the internet is completely secure. If you have concerns about sharing sensitive data please contact us and we will discuss a secure transfer method.

13 Data Breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms we will notify the ICO within 72 hours of becoming aware of the breach in accordance with our obligations under UK GDPR. Where the breach is likely to result in a high risk to you personally we will also notify you directly without undue delay.

14 ICO Registration

The Stock Desk is in the process of registering with the Information Commissioner's Office (ICO) and will update this section upon completion of registration.

15 Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make significant changes we will update the date at the top of this page. We encourage you to review this policy periodically. Continued use of our website or services after any changes constitutes acceptance of the updated policy.

16 How to Complain

If you are unhappy with how we have handled your personal data please contact us in the first instance at hello@thestockdesk.com. We will acknowledge your complaint within 2 business days and provide a full response within 10 business days. If you remain unsatisfied after contacting us you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection supervisory authority: ICO website: ico.org.uk ICO helpline: 0303 123 1113 Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF