Privacy Policy

Last Updated: 17 March 2026 | Company No. 17098858

Keyshift Logistics Ltd ("we", "our", or "us") is committed to protecting your privacy. This policy explains how we collect, use and protect your personal data, in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.

1. Important Information and Who We Are

Keyshift Logistics Ltd is the "Data Controller" responsible for your personal data when you visit our website, contact us, book a call, become a client, or work with us as a referral partner.

  • Registered Office: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF

  • Company Number: 17098858

  • Contact Email: hello@keyshiftlogistics.com

Note on Operational Role: When we provide operational management services inside a Client's digital infrastructure (for example, Shopify or Amazon Seller Central), Keyshift Logistics Ltd acts strictly as a Data Processor on behalf of the Client, who is the Data Controller. In that role, we follow the Client's documented instructions and the data processing terms in Section 7 and Schedule 2 of our Terms of Service. This policy does not cover that processing.

If your data is held by one of our Clients (for example, you bought something from a Client's store), please contact that Client about your data. If you contact us instead, we will pass your request to the Client without undue delay.

Our services are for businesses and are not aimed at children.

2. The Data We Collect

We may collect, use, store and transfer these kinds of personal data about you:

  • Identity Data: Name, job title, username, or company name.

  • Contact Data: Email address, telephone number and billing address.

  • Business Data: Information about your business that you share with us, such as the platforms you use, order volumes and the details you give in our intake, onboarding and audit forms or on discovery calls.

  • Communications Data: Emails, messages in our shared channels, and notes of calls and meetings. If we record a call, we tell you first and ask for your agreement.

  • Financial Data: Invoicing details and bank transfer records. Card and direct debit payments are processed securely by Stripe or GoCardless, and we do not store full card numbers.

  • Referral Data: Contact details of people introduced to us by our referral partners, and contact details of our partners.

  • Records of Acceptance: The date, time and version of our Terms of Service that you accept.

  • Technical Data: IP address, login data, browser type and version, time zone setting and operating system.

  • Usage Data: Information about how you use our website and services.

  • Marketing Preferences: Whether you want to receive marketing from us.

We do not intentionally collect special category data (such as health or political opinions). Please do not send it to us.

If you do not give us data we need to provide a service, we may not be able to provide it.

3. How We Collect Your Data

  • Direct Interaction: You give us data by filling out forms, booking calls through Cal.com, signing a Statement of Work, accepting our Terms, messaging us or emailing us.

  • Partners and Referrers: A partner may introduce you to us, for example by email. Where we receive your details this way, we tell you where we got them when we first contact you.

  • Automated Technologies: When you use our website, we may automatically collect Technical Data and Usage Data through cookies and similar tools (see Section 11).

  • Public Sources: We may use publicly available business information, such as a company website, to prepare for a conversation with you.

4. Lawful Basis for Processing

Under UK GDPR, we only process your personal data when we have a legal basis to do so:

  • Performance of a Contract: To provide the monthly retainers, operational audits or fixed-scope projects you purchased, and to take steps you ask for before you sign up.

  • Legitimate Interests: For our business interests in running and improving our website and services, responding to enquiries, managing our referral partnerships (including confirming that an introduction became a client), keeping business records, and contacting business contacts about our services where the law allows. We balance these interests against your rights, and you can ask us for details of that balance.

  • Legal Obligation: Where we must keep financial records for tax or company law (typically 6 years).

  • Consent: Where you have agreed to receive marketing that needs consent, where we ask you to accept non-essential cookies, or where we ask to record a call. You can withdraw consent at any time.

5. Marketing

We only send you marketing where the law allows it and, where consent is needed, only if you have agreed. Every marketing email tells you how to unsubscribe, or you can email us at any time. We do not sell your data.

6. Data Sharing

We share data only with trusted third parties that we need to run our business, and only as far as needed:

  • Service Providers: Website hosting (Squarespace), scheduling (Cal.com), workflow automation (Make.com), team communication and project management (Slack and Asana), an encrypted password manager, email and cloud storage, accounting software, and payment processors (Stripe and GoCardless).

  • Professional Advisers: Lawyers, accountants, bankers and insurers.

  • Referral Partners: We tell a partner whether an introduction went ahead only if you agree. We ask for your agreement when you onboard.

  • Subcontractors: People who help us deliver services. They must keep data confidential and follow our data protection terms.

  • Authorities and Buyers: Where the law requires it, or if our business is sold, in which case the buyer must protect your data in line with this policy.

We can give you a list of the providers we use on request. Our Clients can also ask for the list of sub-processors that handle their data, as set out in Schedule 2 of our Terms of Service.

7. International Transfers

Some of our providers, or the people who work with us, may be outside the UK (for example, in the USA). Where your personal data is sent outside the UK, we make sure it is protected by safeguards the law recognises. These include UK adequacy regulations (such as the UK-US data bridge for certified recipients), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguards we use.

8. Data Security

We use technical and organisational measures to prevent your personal data from being lost, used or accessed without permission. These include an encrypted password manager for client credentials. We limit access to people who need it, who are bound by confidentiality.

When we work in a Client's platforms, we process data in those platforms and in the tools listed in our sub-processor list. We do not routinely download, export or store customer personal data on our own devices.

If a personal data breach affects you, we will tell you and the ICO where the law requires it. For Clients, we notify them without undue delay and within 48 hours of becoming aware of a breach that affects their data, as set out in Schedule 2 of our Terms of Service.

9. Data Retention

We keep your personal data only for as long as we need it for the purposes we collected it for, including legal, accounting and reporting needs.

  • Financial and accounting records: 6 years.

  • Client contracts and engagement records (Statements of Work, Terms acceptance, onboarding forms, support requests, deliverables we hold): up to 6 years after the engagement ends.

  • Enquiries that do not become clients: up to 90 days after our last contact with you.

  • Referral partnership records: For as long as the arrangement lasts, plus 6 years for payment records.

  • Call recordings (if made): up to 90 days.

  • Marketing preferences: Until you withdraw consent or unsubscribe.

  • Temporary operational data handled while coordinating logistics for a Client: deleted within ninety (90) days of the task being completed.

  • Automation run logs: Run logs of automations in a Client’s own Make.com account are held in that account and follow the retention period of the Client’s plan. Run logs in our own testing account use dummy data and are kept for up to thirty (30) days. We recommend that Clients switch on Make’s ‘Data is confidential’ setting where possible.

  • Client data we process as a processor: On a Client's written request within thirty (30) days of the end of the engagement, we delete or return it, unless the law requires us to keep it.

When we no longer need data, we delete it or anonymise it.

10. Your Legal Rights

Under UK GDPR, you have the right to:

  • Request access to your personal data.

  • Request correction of your data, or erasure of it.

  • Object to processing, including processing for direct marketing, or ask us to restrict it.

  • Request a copy of your data in a portable format.

  • Withdraw consent at any time, where we rely on consent.

We do not make decisions about you using only automated processing that has a legal or similarly significant effect.

To use these rights, email hello@keyshiftlogistics.com. We normally reply within one month, and we may extend that by up to two months if your request is complex; in that case, we will let you know. We usually don't charge a fee. We may need to confirm your identity first.

11. Cookies and Similar Technologies

Cookies are small files that a website places on your device.

  • Essential cookies: Needed to run the website, for example, to keep it secure. These do not need your consent.

  • Analytics cookies: We use these to understand how visitors use the website. Where the law requires your consent, we ask for it before setting them.

  • Third-party tools: Our booking and scheduling tool may set its own cookies when you use it.

You can accept or refuse non-essential cookies through our cookie settings banner, and you can also set your browser to refuse all or some cookies. If you do, some parts of the website may not work properly.

12. Complaints

If you have a concern about how we handle your personal data, please email hello@keyshiftlogistics.com. We will acknowledge your complaint within 30 days, look into it, and respond without undue delay, keeping you informed of progress.

You also have the right to complain at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection (www.ico.org.uk). We would appreciate the chance to put things right first, but you do not have to contact us before the ICO.

13. Changes to This Policy

We may update this policy from time to time. The latest version is always on this page with its "Last Updated" date. If we make a change that materially affects our Clients, we will tell them by email. Our Terms of Service explain how changes to those terms apply.

14. Contact

Keyshift Logistics Ltd

Email: hello@keyshiftlogistics.com

Company No. 17098858 | VAT No. 518537181

Registered office: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF