Privacy Policy

Last updated: 28-02-2026

Who we are

Hi-Express (“we”, “us”, “our”) provides ecommerce fulfilment services (storage, pick & pack, returns handling, reporting and dispatch). Our main fulfilment facility is in Greater Manchester. This Privacy Policy explains how we collect, use, share and protect personal data when you interact with us (as a customer, prospective customer, member, website visitor, or end-customer).

Controller

The data controller is HI-EXPRESS.
Contact for data matters: info@hi-express.co.uk

If you have data protection questions, please use the address above or the contact details on our Contact page.

1. What personal data we collect

We collect different categories of personal data depending on your relationship with us:

A. Business contacts & customers (B2B)

Contact details: name, business name, email, phone, billing address.
Contract information: onboarding data, membership status, service preferences.
Transactional records: invoices, payments, order volumes and service usage.

B. Order & recipient data (end-customers)

Delivery name, delivery address, order reference, telephone number and email required for fulfilment and carrier handover.

C. Operational data

Inventory and order history, returns details, condition reports and photographs (for returned items).
Platform activity: login, API usage, order statuses, IP address and device metadata.

D. Marketing & communications

If you opt in (or where legitimate interest applies), we may hold marketing consent and communication preferences.

E. Technical and analytics data

Cookies and usage data collected via our website (see Cookie section).

2. How we use personal data (purposes)

We use personal data for these main purposes:

To provide and operate our Services (order fulfilment, storage, picking, packing, dispatch, returns processing and reporting).
Lawful basis: performance of contract.
To manage membership and onboarding (eligibility checks, fee administration and priority handling).
Lawful basis: performance of contract; contractual necessity.
To communicate about orders, operational issues and service updates.
Lawful basis: performance of contract; legitimate interest.
To process payments and invoices (billing, debt collection, tax and accounting).
Lawful basis: legal obligation; performance of contract.
To detect, prevent and investigate fraud or other unlawful activity.
Lawful basis: legitimate interests.
To improve services, platform performance and support (including analytics and troubleshooting).
Lawful basis: legitimate interests.
For marketing communications (only if you consent or where permitted by law).
Lawful basis: consent or legitimate interest where appropriate.

3. Who we share data with

To deliver services, we share personal data with trusted third parties, including:

Carriers & delivery partners (for UK and international delivery). Example carrier partner used: Royal Mail.
Platform & integration partners used to sync orders and inventory (e.g., Shopify, Amazon, eBay).
Payment processors and banks (to accept payments and process refunds).
IT and hosting providers (for our website and Platform).
Professional advisers (legal, audit) where required.
Law enforcement or regulators, if required by law.

We only share the data necessary for the recipient to perform their role and require them to keep that data secure.

4. International transfers

If personal data is transferred outside the UK (for example, to international carriers or cloud providers), we will ensure an adequate level of protection by using appropriate safeguards (e.g., standard contractual clauses or transfers to countries with adequacy decisions). We will list specific countries and safeguards when finalising this policy.

5. Data retention

We retain personal data only as long as necessary for the purposes described, and in accordance with legal and regulatory requirements.

Customer & contract records: 7 years (for accounting/tax obligations).
Order & delivery records: up to 6 years after last activity.
Marketing consents: until consent is withdrawn.
Web analytics and cookies: as per Cookie Policy.

6. Your data protection rights

Depending on where you live, you may have the right to:

Request access to the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request erasure (“right to be forgotten”) in certain circumstances.
Request restriction of processing.
Object to processing (including profiling), where applicable.
Request portability of your data where technically feasible.
Withdraw consent at any time (for marketing or other consent-based processing).
Lodge a complaint with your local data protection regulator (e.g., the UK Information Commissioner’s Office).

To exercise your rights, please contact info@hi-express.co.uk. We will respond within statutory timeframes.

7. Cookies & tracking

We use cookies and similar technologies on our website to provide core functionality, remember preferences and analyse site usage.

Strictly necessary cookies – required for site operation.
Performance & analytics cookies – to measure how visitors use the site.
Functional cookies – to remember choices.
Marketing cookies – used only with consent.

On the first visit, we display a cookie banner that lets you accept or customise your cookie settings. For a full list (including specific retention periods and third-party cookies), see our Cookie Policy.

8. Security

We use industry-standard technical and organisational measures to protect personal data (encryption, access controls, secure hosting and restricted internal access). However, no method of transmission or storage is 100% secure. If a personal data breach occurs, we will follow applicable legal obligations, including notifying authorities and affected individuals when required.

9. Children

Our Services are aimed at businesses and not children. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child without appropriate consent, we will take steps to delete it.

10. Automated decision-making and profiling

We do not rely on automated decision-making that produces legal or similarly significant effects on individuals. Some reporting features may aggregate or analyse data to provide operational insights; these are intended to assist human decision-making.

11. Changes to this policy

We may update this Privacy Policy periodically. Material changes will be notified via our website or by other means where appropriate. The date at the top shows when this policy was last updated.

12. Contact & complaints

If you have questions about this Privacy Policy or wish to exercise your data rights, contact: info@hi-express.co.uk. For unresolved complaints, you may contact the UK Information Commissioner’s Office.