ORDERLINKS – PRIVACY POLICY

Last updated: 18th August 2026

This Privacy Policy explains how Orderlinks Technologies Ltd (“Orderlinks”, “we”, “us”, “our”) collects, uses, stores, shares, and protects personal data when Sellers, Buyers, or other Users interact with our platform. We are committed to processing personal data lawfully, fairly, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Defined Terms

“Seller” – a business or individual who signs up to the Orderlinks platform to manage and receive orders.

“Buyer” – a business or individual placing an order with a Seller through the platform or via Order Assist channels (email or WhatsApp).

“User” – any individual interacting with the platform, including Sellers, Buyers, and staff acting on their behalf.

“Order Assist” – the feature that processes incoming email or WhatsApp messages to help Sellers manage and create orders.

“Platform” – the Orderlinks website, dashboard, APIs, order management tools, integrations, and related digital services.

“Google Workspace APIs” – the Google APIs (including the Gmail API) that Orderlinks accesses where a Seller has explicitly authorised access to their Google account.

“Google User Data” – any data, whether raw or derived, that Orderlinks receives from Google Workspace APIs.

2. Data Controller and Data Processors

Data Controller

Orderlinks Technologies Ltd
Company Number: 14254523
Email: tom@orderlinks.co

We determine how and why personal data is processed.

Data Protection Officer (DPO)

Thomas Paton
Email: tom@orderlinks.co

Categories of Data Recipients (Processors)

We use third-party services strictly to deliver our platform functionality, including:

• Payment processors (e.g., Stripe)
• Hosting and cloud infrastructure providers
• Messaging and communications providers
• AI processing services
• Analytics providers
• Delivery and logistics partners
• Optional integration partners selected by Sellers

All processors act only under our instructions.

3. Categories of Personal Data We Collect

Identity and Contact Data

• Name
• Email address
• Phone number
• Business name
• Delivery address
• Billing address

Order and Transaction Data

• Order items, quantities, and delivery instructions
• Order history
• Payment identifiers (e.g., Stripe customer ID, last 4 digits of card)

Other Business Data

• Product information
• Pricing information

Communication Data

• Emails sent to Seller-connected inboxes
• WhatsApp messages sent to Seller-assigned numbers
• Message content containing order instructions

Integration Data

• Order, inventory, or delivery information passed through optional integrations

Analytics Data

• Aggregated usage and behavioural data from analytics tools

Special Category Data

We do not intentionally collect special category data. If received unintentionally, it is deleted or minimised.

4. Purpose of Data Collection (Why We Collect Data)

We collect and process data for:

• Creating and managing Seller and Buyer accounts
• Processing and administering orders
• Extracting order details from email or WhatsApp messages for order creation
• Facilitating payments
• Generating shipping labels and delivery documentation
• Providing customer support
• Fraud prevention and platform security
• Conducting analytics and improving the platform
• Sending essential service-related updates
• Meeting legal and accounting obligations

We do not use personal data for advertising or unrelated purposes.

5. How We Use Personal Data (Processing Activities)

Personal data is processed to:

• Interpret order content from emails and WhatsApp messages
• Create draft orders on behalf of Sellers
• Transmit order information to Sellers and Buyers
• Validate delivery and payment information
• Provide usage reporting and platform insights
• Communicate about orders and account activity
• Maintain and optimise platform functionality

AI-assisted tools may help interpret messages, but all AI outputs are reviewed or approved by a human.

We do not use personal data — and specifically do not use any Google User Data — to develop, improve, or train generalised or non-personalised artificial intelligence or machine learning models. Our use of AI/ML is limited to interpreting message content in order to deliver the order automation features requested by the Seller. See Section 6 for the specific commitments that apply to Google User Data.

We do not use automated decision-making that produces legal or significant effects.

6. Use of Google Data (Email Connection)

Where a Seller connects their Google account to Orderlinks, we only access Google data that the Seller explicitly authorises through Google’s OAuth permission process.

6.1 Limited Use Compliance Statement

Orderlinks’ use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

6.2 Use of AI/ML with Google Workspace Data

Orderlinks uses AI/ML models, and third-party AI/ML services, to interpret the content of order-related emails so that draft orders can be prepared automatically for the Seller. In relation to this processing we confirm that:

• We do not use Google User Data — whether raw, aggregated, anonymised, or otherwise derived — to develop, improve, or train generalised or non-personalised AI and/or ML models, or any foundational or generalised machine learning or artificial intelligence model.
• We do not transfer or sell Google User Data to any third party for the purpose of developing, improving, or training such models.
• Where Google User Data is sent to a third-party AI/ML service in order to deliver the user-facing feature, that provider acts solely as our processor under contractual terms which prohibit retaining the data beyond what is necessary to return a result, and which prohibit using the data to train or improve their models.
• AI/ML outputs are used only to populate draft orders and related order information within the Seller’s own Orderlinks dashboard, and are reviewed or approved by a human before an order is confirmed.

6.3 Purpose and Limited Use

Google data is used solely to provide or improve user-facing features that are prominent in the Seller’s Orderlinks dashboard, including:

• Identifying incoming order-related emails
• Extracting relevant order information
• Assisting Sellers in automating draft order creation

Data is used purely to enhance the email experience for productivity purposes.

Google data is never used for advertising, profiling, credit assessment, lending, or any other purpose unrelated to the user-facing features described above.

6.4 Restrictions on Transfers of Google Data

Orderlinks does not transfer Google data except when:

• Necessary to provide or improve user-facing features that are prominent from the user interface
• The Seller has given explicit consent
• Required for security purposes, such as investigating a potential violation or abuse
• Required to comply with applicable laws
• Necessary as part of a merger, acquisition, or sale of assets, following explicit prior consent from the Seller

6.5 Human Access to Google Data

Orderlinks does not permit human access to Google data unless:

• The Seller has given explicit consent for specific messages to be accessed (for example, when raising a support request)
• Access is required to comply with applicable law
• The data is aggregated or anonymised and used for internal operations in accordance with applicable privacy and other jurisdictional legal requirements
• It is necessary for security purposes, including investigating abuse

By default, message content is not manually viewed.

6.6 Data Minimisation

Orderlinks processes only message content relevant to trade order automation. Unrelated Google data is not accessed, stored, or used.

6.7 Revoking Access

A Seller may revoke Google access at any time via their Google Account permissions page, or from within their Orderlinks dashboard. Once revoked, Orderlinks immediately stops receiving new data, and previously received Google data is deleted in accordance with Section 9.2.

7. Lawful Basis for Processing

7.1 Contract (Article 6(1)(b))

To provide the platform, operate accounts, and facilitate order processing and delivery.

7.2 Legitimate Interests (Article 6(1)(f))

For:

• Delivery of service
• Order creation through Order Assist
• Platform security
• Fraud detection
• AI-assisted message processing
• Analytics and service improvement
• Operational communications

We balance these interests with User rights.

7.3 Consent (Article 6(1)(a))

For:

• Marketing communications
• Connecting email accounts to automate order processing

Consent may be withdrawn at any time.

7.4 Legal Obligation (Article 6(1)(c))

For compliance with accounting, regulatory, and legal duties.

8. Special Category Data (Article 9 UK GDPR)

We do not intentionally process special category data. Any such data received unintentionally is deleted where feasible.

9. Storage, Retention, and Security

9.1 Storage

Data is stored securely using:

• Cloud hosting infrastructure
• Approved third-party systems

9.2 Retention Periods

Unless required otherwise by law:

• Order and payment records: 6 years
• Account information: retained while active, then deleted/anonymised within 12 months of inactivity
• Email/WhatsApp message data (Order Assist): 18 months
• Analytics data: 26 months

Orderlinks does not retain message content unrelated to order automation.

Google User Data is deleted when a Seller disconnects their Google account, deletes their Orderlinks account, or requests deletion, save where retention of the resulting order records is required to meet the legal and accounting obligations set out above. Google User Data is never retained for AI/ML training purposes.

9.3 Security Measures

We use appropriate technical and organisational measures, including:

• TLS/HTTPS encryption
• Secure API key management
• Access controls and permissions
• Staff access restrictions
• Audit logging
• Regular backups
• Secure hosting environments

10. Who We Share Personal Data With and Why

We share data only where necessary to provide the Platform’s functionality.

Categories of recipients include:

• Payment processors
• Messaging and communication providers
• AI processing services
• Hosting and infrastructure providers
• Analytics providers
• Delivery and logistics partners
• Optional integration partners selected by Sellers

These organisations process data only on our behalf and only for specified purposes.

Any sharing of Google User Data is additionally restricted by Sections 6.1 to 6.4. In particular, no recipient is permitted to use Google User Data to develop, improve, or train generalised or non-personalised AI/ML models.

We do not sell personal data.

11. Individual Rights

Users have the right to:

• Access personal data
• Correct inaccurate data
• Request deletion
• Restrict processing
• Object to processing
• Request portability
• Withdraw consent at any time

To exercise these rights, contact: tom@orderlinks.co

We respond within one month, unless an extension applies.

12. Data Protection Contact

Thomas Paton (DPO)
Email: tom@orderlinks.co

13. ICO Complaints

If you are unhappy with how we use your data, you may complain to:

Information Commissioner’s Office (ICO)
Website: https://ico.org.uk
Helpline: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

• Changes to how we process data
• Updates to the platform
• New integrations or features
• Legal or regulatory requirements

Significant changes may be communicated directly to Users. The latest version will always be available on our website.