Privacy

Last updated: 21 October 2026

Overview

This policy explains what personal data Zatu Limited, trading as Zatu Distribution ("we", "us"), collects when you use distribution.zatu.com (the "Portal"), how we use it, where it is stored and how we protect it. The Portal is a trade-only wholesale service. It is used by businesses and by the people who act for them, so most of the personal data we hold is business contact data about trade account applicants, account holders and their colleagues.

We process your data to run your trade account, take and fulfil your orders and meet our legal obligations. We only use it for other purposes, such as marketing, where you have agreed or where we are otherwise permitted to do so. We share data with trusted partners such as Shopify, Storefeeder and Klaviyo so that we can provide the service. We will not share your data for third party advertising purposes.

Who we are

Zatu Limited is the data controller of the personal data described in this policy. Our registered office and trading address is 40 Barnard Road, Bowthorpe Employment Area, Norwich, NR5 9JB, United Kingdom. Zatu Distribution is the wholesale arm of Zatu Limited.

You can contact us about this policy or about your data by email at [distribution email], by phone on [distribution phone], or by post at the address above. Data protection enquiries should be marked for the attention of the Data Protection Officer.

What this policy covers

This policy applies to the Portal at distribution.zatu.com, the Shopify checkout it uses, the trade account application process, the emails we send you about your account and orders, and your dealings with our trade and customer service teams by email, phone or post. Together these are the "Services".

It applies to personal data: information that identifies you or could reasonably be used to identify you. Information about a company that does not identify a person (for example a company registration number on its own) is not personal data, but where it is held alongside details of named contacts we treat the whole record with the same care.

Our retail websites, including zatu.com, have their own privacy policy. If you also shop with us as a consumer, that policy applies to your retail account and orders.

Business use and age

The Portal is for businesses, sole traders and other organisations buying for resale or professional use. It is not intended for consumers or for anyone under the age of 18, and we do not knowingly collect personal data from children. When you apply for a trade account you confirm that you are at least 18 and authorised to act for the business you are applying on behalf of.

Information we collect

Depending on how you use the Services, we may collect:

• Trade account application details: the business name, trading name, type of business, website, company registration number and VAT number; delivery and billing addresses; and the name, job title, email address and phone number of the person applying and of any other contacts you give us (such as an accounts contact or additional buyers).
• Account details: your login email address, a password (stored in hashed form, never as plain text), the one-time codes we send to verify your email address, your company assignment and account number, your preferences and settings, and a record of when you sign in.
• Order and transaction details: products you view, add to a cart or save in a shared company cart, orders you place, invoices, payment status, deliveries, returns and any communications about them.
• Payment information: if you pay by card at checkout, your card details are collected and processed by Shopify, not by us; we receive confirmation of payment and the card type and last four digits only. If you pay by bank transfer, we see the payer name and reference shown on our bank statement. We may ask for bank details if we need to send you a refund.
• Credit and payment terms information: where you apply for or hold credit terms, information about your business's credit history obtained from a credit reference agency, together with your trading and payment history with us.
• Correspondence: anything you send us by email, through the Portal's contact and enquiry forms, or by phone or post.
• Technical information: your IP address, browser and device type, pages visited and how you use the Portal, collected automatically when you use it.
• Cookie data, as described under "Cookies" below.

How data about you is collected

Most of the data we hold comes directly from you or your colleagues: when you apply for a trade account, sign in, place an order, update your details or contact us. Some is created as you use the Services, such as your order history and sign-in records. We obtain credit information from credit reference agencies as described below, and Shopify shares order and payment status with us after checkout.

If you give us personal data about other people in your organisation, you confirm that you are authorised to do so and that you have made them aware of this policy.

We do not receive or store your full card details. Card payments are handled by Shopify's payment services, which hold your card information under their own privacy policy.

Why we use your data (legal basis for processing)

UK data protection law requires us to have a lawful basis for each use of your personal data. We rely on:

• Performance of a contract: to set up and run your trade account, take and deliver your orders, invoice you and deal with returns and support requests.
• Legal obligation: to keep accounting and tax records, respond to lawful requests from authorities and carry out any checks the law requires.
• Legitimate interests: to run and secure the Portal, prevent fraud, manage credit risk, understand how the Portal is used so we can improve it, and keep business contacts informed about products and services relevant to their trade with us. When we rely on this basis we balance our interests against your rights, and you can object at any time.
• Consent: where you have opted in to marketing emails, or where we ask your permission for anything else. You can withdraw consent at any time without affecting what was done before.

How your information is used

• To review your trade account application and, if approved, set up your company and user accounts on the Portal and in Shopify.
• To verify your identity when you sign in, including by sending one-time codes to your email address.
• To show you your trade pricing, availability and catalogue, and to let you build, save and share carts with colleagues on the same account.
• To process, pick, pack and deliver your orders, send order confirmations and delivery updates, and handle returns.
• To invoice you, collect payment, apply and review credit terms and follow up overdue accounts.
• To respond to your questions and provide account support. This includes letting our trade team view your account as you see it, so that they can resolve pricing or ordering queries.
• To send you marketing emails about new releases, pre-orders, offers and trade news where you have opted in. Every marketing email includes an unsubscribe link.
• To monitor, secure and improve the Portal, including detecting unusual sign-in activity and fixing errors.
• To meet our tax, accounting and other legal obligations.

We do not make decisions about you using automated processing that has a legal or similarly significant effect on you. Decisions about trade account applications and payment terms are made by a member of our trade team.

Credit checks and payment terms

Trade accounts may be offered payment terms. Before granting or extending credit terms, and periodically while you hold them, we may search the records of a credit reference agency about your business. If your business is a sole trader or partnership, that search may include information about you or your partners as individuals. The agency will keep a record of our search, which may be visible to other organisations that search your record. We use this information, together with your payment history with us, to decide what terms to offer and to manage the credit we extend. You can ask us which agency we used and how to contact them.

How we handle your personal information

Your data is stored and processed on secure servers operated by our hosting providers in the UK and European Economic Area, and by Shopify and our other partners under the safeguards described below. Access is limited to staff who need it to do their jobs. We use encryption in transit, hashed passwords, access controls and regular backups, and we review our security measures as the Portal develops.

We keep your data only for as long as we need it:

• Order, invoice and payment records are kept for 6 years after the end of the financial year they relate to, as required by HMRC.
• Account and company details are kept for as long as your trade account is active, and for 6 years after it closes so that we can meet the record-keeping requirements above and deal with any disputes.
• Trade account applications that are declined or not completed are kept for 12 months and then deleted.
• Marketing data is kept for as long as you remain subscribed. We remove you from our marketing lists within 30 days of an unsubscribe request.
• Credit reference information is kept for as long as it is relevant to the terms we offer you.
• Correspondence is kept for as long as needed to deal with your enquiry and for a reasonable period afterwards.

Data sharing within your organisation

Trade accounts belong to your business, not to you personally. Colleagues on the same trade account can see shared carts, order history, addresses and company settings. Please bear this in mind when adding details to shared parts of the account, and let us know if someone leaves your organisation so that we can remove their access.

Anything you choose to share with other businesses or on third party platforms is outside our control, and we are not responsible for how those parties use it.

Third party information collection and external services

The Portal may link to publisher websites, courier tracking pages, stockist sites and other third party services. Those sites have their own privacy policies and we are not responsible for how they handle your data, so please check them before providing any information.

Our trusted partners

We share your data with partners who help us run the Services. We provide each of them with the minimum data necessary, and they are only permitted to use it to provide services to us.

• Shopify: the commerce platform behind the Portal. Shopify holds your company, contact, order and checkout information and processes card payments. When you proceed to checkout, your Portal sign-in is passed to Shopify so that you don't need to log in again. See Shopify's privacy policy for how it handles your data.
• Storefeeder: our warehouse and order management system, used to pick, pack and dispatch your orders and manage returns.
• Klaviyo: sends our marketing emails and holds your marketing preferences where you have opted in.
• SendGrid: delivers transactional emails such as one-time sign-in codes, account notifications and enquiry form submissions.
• Hosting providers: the Portal runs on Vercel, and our account and order database is hosted by DigitalOcean.
• Couriers and pallet networks: receive your delivery address, contact name and phone number so that they can deliver your orders and send tracking updates.
• Credit reference agencies: as described under "Credit checks and payment terms".
• Our accountants, auditors, insurers and professional advisers where necessary.

Some of these partners process data outside the UK. Where they do, we rely on the UK's adequacy regulations or on contractual safeguards approved under UK law, such as the International Data Transfer Agreement or Addendum.

We will also share your data with the police, HMRC or other authorities where we are required to by law, and with a buyer or successor if our business is sold or restructured.

Cookies

The Portal uses cookies that are strictly necessary to keep you signed in, remember your settings (such as your display theme) and protect the site. Shopify sets its own cookies during checkout. We do not currently use analytics or advertising cookies on the Portal. If that changes we will update this policy and ask for your consent where required.

Your rights

Under UK data protection law you have the right to:

• Access a copy of the personal data we hold about you.
• Have inaccurate data corrected. You can update some details yourself in your account settings; address and company changes go through our trade team.
• Have your data deleted where we no longer have a lawful reason to keep it.
• Restrict or object to our processing, including objecting to direct marketing at any time.
• Receive the data you have given us in a portable format.
• Withdraw consent where we rely on it.
• Complain to the Information Commissioner's Office (ico.org.uk) if you are unhappy with how we have handled your data. We would appreciate the chance to resolve your concern first.

To exercise any of these rights, contact us using the details below. We may need to confirm your identity before acting on a request, and we will respond within one month. Because trade accounts belong to a business, some records (such as invoices) must be kept even if an individual contact asks for their data to be deleted. In those cases we will remove the personal details we can and explain what we have kept and why.

Changes to this privacy policy

We may update this policy to reflect changes to the Portal, our partners or the law. We will post the new version here with an updated date, and where the changes are significant we will tell you by email or through the Portal. Please check this page from time to time.

Contact

Zatu Limited (trading as Zatu Distribution), 40 Barnard Road, Bowthorpe Employment Area, Norwich, NR5 9JB, United Kingdom. Email: [distribution email]. Phone: [distribution phone].