Privacy Policy
WHIZZLY LTD ("Whizzly", "we", "us", or "our") is committed to upholding the highest standards of data protection, transparency, and user privacy. This Privacy Policy sets out how personal data is collected, processed, shared, and protected across the Whizzly platform, digital storefronts, and associated services under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).
1. Who We Are & Regulatory Roles
WHIZZLY LTD is a private limited company incorporated and registered in England and Wales. We operate the Whizzly e-commerce, booking, and digital ordering software platform.
WHIZZLY LTD — Data Controller Information
Company Number: 17380895 (Registered in England & Wales)
Registered Office: Starkie Chambers, Lancaster Road, Preston, Lancashire, PR1 1DA
Data Protection Contact: help@whizzly.co.uk
Website: https://whizzly.co.uk
Important Note on Merchant Storefronts:
When you interact with a Whizzly-powered storefront (e.g. browsing a shop catalogue, purchasing goods, or scheduling a service appointment), the Merchant (business owner) who operates that store is an independent Data Controller for your checkout and customer data. Whizzly Ltd acts as a secure Data Processor providing cloud infrastructure and order processing tools on the merchant's behalf.
2. Personal Data We Collect
We collect and process personal data in the following categories:
A. From Merchants (Account Holders)
- Account Identity: Full name, account email address, and WhatsApp/phone number.
- Business Profile: Business name, address, store configuration, product catalogue, pricing, and operating schedules.
- Subscription & Billing: Subscription tier, invoice history, and Stripe customer IDs. Payment card numbers are processed directly by Stripe and are never stored on Whizzly servers.
- Activity Logs: Login timestamps, dashboard feature utilization, and IP addresses for fraud prevention and security auditing.
B. From Storefront Customers
- Contact Details: Customer name, email address, and WhatsApp mobile phone number.
- Fulfillment & Delivery: Street address, delivery postcode, and special delivery/allergy instructions.
- Order & Booking Details: Items purchased, custom product notes, appointment time slots, and payment method selected.
- Loyalty & Marketing: Digital stamp card balances, redeemed promotional codes, and opt-in consent timestamps for promotional WhatsApp or email updates.
C. Automatically Collected Technical Data
When you visit Whizzly or a merchant storefront, our edge network and analytical services automatically log device identifiers, browser user-agent strings, operating system, approximate geographical location (derived from IP address), and page engagement statistics.
3. Lawful Bases for Processing (UK GDPR Article 6)
We process personal data only when an applicable lawful basis under UK GDPR Article 6 applies:
1. Contractual Necessity (Article 6(1)(b))
Required to establish merchant accounts, generate storefronts, coordinate order fulfilment, book appointment slots, process payments, and dispatch essential order confirmations.
2. Explicit Consent (Article 6(1)(a))
Required for sending promotional WhatsApp broadcast campaigns, marketing newsletters, and activating non-essential analytical cookies (Google Analytics GA4) and ad tracking pixels (Meta Pixel, TikTok Pixel). Consent may be withdrawn at any time.
3. Legitimate Interests (Article 6(1)(f))
Processing necessary to prevent fraudulent transactions, secure platform APIs, maintain server availability, deliver technical bug fixes, and improve merchant usability.
4. Legal Obligation (Article 6(1)(c))
Processing required to retain invoicing and financial transaction records to comply with UK statutory HMRC accounting and VAT record-keeping laws.
4. Data Retention Schedule
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or to satisfy legal, tax, and accounting requirements:
- Active Merchant Accounts: Retained for the duration of the merchant subscription plus 30 days after cancellation to allow for account reactivation.
- Financial & Invoicing Ledgers: Retained for 7 years from the end of the relevant financial year to satisfy UK statutory HMRC tax compliance requirements.
- Storefront Customer Order Data: Retained by default for the lifetime of the merchant's active account, unless the customer or merchant requests anonymization under GDPR Article 17.
- Authentication OTP Codes: Automatically purged and invalidated within minutes of use or expiry.
- Customer Support Correspondence: Retained for up to 2 years to ensure service quality and continuity.
5. Third-Party Sub-Processors & Data Transfers
We partner with vetted third-party sub-processors to operate our platform infrastructure. All sub-processors are bound by strict Data Processing Agreements (DPAs) requiring adherence to UK GDPR:
| Sub-Processor | Processing Purpose | Data Location & Safeguards |
|---|---|---|
| Google Firebase / Cloud Firestore | Database hosting, user authentication, asset storage | USA / EU (Standard Contractual Clauses) |
| Stripe Payments UK Ltd | PCI-DSS Level 1 credit/debit card processing and billing | UK / USA / EU (SCCs applied) |
| PayPal (Europe) S.à r.l. | Alternative payment method processing | Luxembourg / EU |
| Meta Platforms (WhatsApp Cloud API) | Automated transactional WhatsApp messages & OTPs | USA / EU (Standard Contractual Clauses) |
| Google Cloud & Gemini AI | AI product catalogue builder and menu import | USA (Standard Contractual Clauses) |
| Google Analytics (GA4) | Storefront visitor metrics (consent-gated) | USA (Standard Contractual Clauses) |
| Meta Pixel & TikTok Pixel | Ad conversion measurement (consent-gated) | USA / EU (Standard Contractual Clauses) |
| Resend Inc | Transactional customer receipt and merchant alert emails | USA (Standard Contractual Clauses) |
| Google Cloud / Firebase App Hosting | Platform edge delivery and web hosting | USA / EU (Standard Contractual Clauses) |
Where personal data is transferred outside the United Kingdom, we ensure adequacy decisions or the UK International Data Transfer Addendum (IDTA) / ICO Standard Contractual Clauses (SCCs) are in force.
6. Cookies & Tracking Technologies (PECR Compliance)
In accordance with the Privacy and Electronic Communications Regulations (PECR), we employ a consent-first cookie architecture:
- Strictly Necessary Cookies: Essential for platform security, user authentication sessions, and maintaining active shopping carts. These cookies do not require prior consent under PECR Regulation 6.
- Performance & Analytics Cookies: Used by Google Analytics (GA4) to measure website traffic and performance. These cookies are deactivated by default and load only upon explicit user acceptance.
- Marketing & Conversion Pixels: Used by Meta Pixel and TikTok Pixel to track advertising effectiveness. Deactivated by default and fired only upon explicit consent.
7. Your Rights Under UK GDPR
Under the UK General Data Protection Regulation, you possess the following statutory rights regarding your personal data:
- Right of Access (Article 15): You may request a copy of all personal data held about you ('Subject Access Request').
- Right to Rectification (Article 16): You may request correction of inaccurate, outdated, or incomplete data.
- Right to Erasure ('Right to be Forgotten', Article 17): You may request permanent deletion or anonymization of your personal data, subject to statutory tax record retention obligations.
- Right to Restriction of Processing (Article 18): You may request that we temporarily halt or restrict processing of your data in specific scenarios.
- Right to Data Portability (Article 20): You may request a structured, machine-readable JSON copy of your personal data for transfer to another platform.
- Right to Object (Article 21): You may object at any time to processing based on legitimate interests or for direct marketing communications.
- Rights in Relation to Automated Decision-Making (Article 22): You have the right not to be subject to solely automated decisions that produce legal or significant effects.
How to Exercise Your Rights:
• For Merchants: You can download a complete JSON archive of your account and store data directly in Merchant Settings → Privacy & Data Protection, or delete your account in the Danger Zone.
• For Storefront Shoppers: You can submit data access or erasure requests directly through any merchant's storefront privacy page or by contacting the merchant directly.
• General GDPR Enquiries: Contact the Whizzly Data Protection team at help@whizzly.co.uk. In accordance with UK GDPR Article 12, we respond to all statutory requests within 30 calendar days at zero cost.
You also have the right to lodge a complaint directly with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection:
8. Technical & Organisational Security Measures
We implement industry-leading technical and organizational security controls to protect personal data against unauthorized access, loss, or alteration:
- Encryption in Transit & at Rest: Enforced HTTPS/TLS 1.3 encryption across all API endpoints and AES-256 database-level encryption.
- Granular Security Rules: Cloud Firestore security rules strictly isolate multi-tenant merchant data by verified Firebase UID.
- Payment Tokenization: Payment card numbers are processed exclusively by PCI-DSS Level 1 certified processors (Stripe & PayPal) and never touch Whizzly servers.
- Ephemeral Authentication: OTP codes expire automatically within minutes and are scrubbed upon verification.
- Access Control: Administrative access to production databases is restricted to authorized engineers with mandatory multi-factor authentication (MFA).
9. Children's Privacy
Whizzly is a commercial SaaS platform intended for use by business owners aged 18 and older. We do not knowingly collect or solicit personal data from children under the age of 13. If you believe a child has provided us with personal information, please notify us at help@whizzly.co.uk so we can delete the records immediately.
10. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect platform enhancements or changes in statutory data protection laws. When changes are made, the revised "Effective Date" at the top of this document will be updated. Continued use of Whizzly following the publication of changes signifies your acknowledgment of the updated policy.
11. Contact Us
For any questions, data protection inquiries, or to contact our Data Protection team, please reach out to: