This notice explains personal data processing associated with the DIVA Workspace internal business application and its authorised integrations. It applies to relevant business users, staff and individuals whose marketplace orders are processed through the participating seller businesses. It supplements, rather than replaces, the privacy notice of the marketplace or seller with whom a customer places an order.
1. Overview
DIVA Workspace supports the transfer and reconciliation of authorised marketplace orders, stock availability, dispatch records and tracking information with the existing OrderWise ERP system, including data workflows supported by Supabase. It also supports internal purchasing, operational reporting and staff-related workflows.
Marketplaces may include Temu, TikTok Shop, B&Q and OnBuy where integrations are used and permission has been granted. Any direct API connection described as a planned capability is subject to applicable marketplace approval and is not represented here as already active.
2. Who is responsible for personal data?
The seller identified on the relevant marketplace order is responsible for determining the purposes of processing customer order information. Participating UK companies which may use the DIVA Workspace platform include:
Registered office for the companies above: 1132 Silverstone Business Park, Buckingham Road, Silverstone, Towcester, England, NN12 8FU.
These businesses are distinct legal entities; sharing an internal platform does not make them a single controller. For an order placed with a different legal seller, that seller remains responsible for its own customer-data processing. For staff and workspace accounts, the employing or responsible business will be the relevant controller. Please contact the seller named in your order confirmation if you are uncertain which company applies.
3. Information we process and where it comes from
- Marketplace order and customer details: marketplace and order IDs, recipient names, delivery addresses, telephone numbers, order-related contact details where supplied, products and SKU codes, quantities, relevant payment or tax totals, deadlines and order statuses.
- Shipping and fulfilment data: courier, consignment or parcel tracking references, warehouse dispatch information, returns, exceptions and delivery status.
- Inventory and product data: product identifiers, stock quantities, product listings and order-related operational records (normally not personally identifying, except when linked to an order or staff user).
- Workspace account and staff data: names, business contact details, user accounts, access roles, login activity, work availability, attendance, leave requests or other operational HR records where relevant modules are used.
- Security and audit information: timestamps, action logs, request/error records, and technical identifiers needed to operate and protect the system.
Customer order information generally comes from the authorised selling marketplace and is subsequently updated using ERP and courier records. Employee and business-user details are supplied by the relevant company or user. We do not require special-category personal data for ordinary order fulfilment; if such information is processed in an HR context, additional safeguards and appropriate lawful conditions apply.
4. Purposes and legal bases
Personal data is used for legitimate, disclosed business operations and is not collected for unrelated profiling or resale.
| Purpose | Likely lawful basis under UK GDPR |
|---|---|
| Receiving, validating and fulfilling marketplace customer orders; managing deliveries and returns | Performance of a contract and/or legitimate interests in fulfilling customer orders |
| Maintaining accurate stock, synchronising permitted marketplace status, resolving errors and preventing duplicate processing | Legitimate interests in secure, accurate business operations |
| Keeping required invoices, VAT/accounting records and responding to legal requests | Compliance with legal obligations |
| Operating business accounts, work schedules and staff records | Relevant employment contract, legal obligation, legitimate interests or other appropriate basis depending on the record |
| Protecting credentials, investigating misuse and maintaining system security | Legitimate interests and, where applicable, legal obligations |
Each responsible business should confirm the appropriate lawful basis for its specific activity and records. Where consent is the lawful basis for a particular optional processing activity, it may be withdrawn without affecting earlier lawful processing.
6. Processing locations and international transfers
Core Supabase database services for the current DIVA Workspace project are hosted in the AWS Ireland region. Relevant OrderWise and warehouse processing also takes place on UK office infrastructure. Cloud services, edge execution, support, third-party providers and backup operations may involve other locations.
Where personal data is transferred outside the UK, appropriate protections are required under applicable UK data-protection law, such as adequacy regulations or approved contractual safeguards. We do not claim that every system, provider or edge request is restricted exclusively to the UK or Ireland.
7. Retention and deletion
We aim to keep personal information only for as long as it is needed for its documented purpose, subject to applicable marketplace commitments and legal requirements. The relevant retention period depends on the type of information, the order or employment lifecycle, legal obligations, disputes and security requirements.
| Record type | Retention approach |
|---|---|
| Operational buyer/contact and shipment details | Kept as needed for fulfilment, customer support, returns, reconciliation and justified disputes, then deleted or de-identified when no longer required. They are not automatically all subject to the accounting retention period. |
| Required VAT, invoices and business accounting records | Generally six years where required under UK VAT record-keeping rules; longer or shorter retention may apply in specific legal circumstances. |
| Staff records, access logs and technical records | Retained according to the relevant employment, security, operational or legal need, with restricted access and periodic review. |
| Service-provider backups and archives | Subject to provider retention cycles and applicable legal, security and contractual obligations. |
Requests for deletion will be assessed promptly. Certain records may be retained where required by law or necessary to establish, exercise or defend legal claims. A six-year requirement for qualifying accounting records does not authorise indefinite retention of unrelated delivery contact details.
8. Security of the information
Operational safeguards are intended to include controlled user permissions, authenticated access, access logging, encrypted connections, restricted handling of integration credentials and checks to prevent duplicate or unauthorised order processing. Sensitive system credentials should not be included in public website code or exposed to external users.
No internet-connected system is risk-free. Suspected unauthorised access or data incidents should be promptly investigated and handled under the applicable incident-response and legal reporting processes.
9. Your rights
Depending on the circumstances and applicable law, you may have the right to request access to your personal data, correction, erasure, restriction, data portability or to object to processing. Certain rights have exceptions, particularly for records the responsible company must retain by law.
If your request relates to a marketplace order, contact the seller identified on your order confirmation or the relevant company below. Please provide the minimum information needed to identify the order or account; do not email passwords or payment-card information. Requests may require reasonable identity verification. UK GDPR requests are normally handled within one month, subject to permitted extensions or exceptions.
If you are unhappy with how your concerns are handled, you may complain to the UK Information Commissioner's Office (ICO).
11. Contact and policy updates
For privacy queries, access requests or corrections, contact the legal seller responsible for your order or the relevant business at sales@divagift.com, sales@divastore.co.uk or sales@divapackage.com.
Postal correspondence may be sent to the registered office listed in section 2. This notice may change when our applications, connected marketplaces or legal duties change; the date at the top will be updated when we publish revisions.
This notice describes processing connected with DIVA Workspace. For details about a particular order, please contact the seller identified on your order confirmation.