Privacy policy

Last updated: October 15, 2026

Matcha Wholesale Ltd (“we”, “us”) is the controller of personal data collected through our Shopify store and business activities, except where another organisation acts as an independent controller. Contact: hello@matchawholesale.co.uk; postal address: 63 New Road, Weston Turville, Aylesbury, Buckinghamshire HP22 5QY, United Kingdom.

1. Information we collect. We may process names, business and personal contact details, account credentials, billing and delivery addresses, orders, transaction status, customer service messages, subscription choices, marketing preferences, website usage, device identifiers, IP addresses and cookie information. Payment details are handled by our payment providers; we do not ordinarily receive complete card numbers.

2. Sources. We receive information directly from you, your organisation, our Shopify storefront, payment and delivery providers, an, where appropriate, other lawful business sources.

3. Purposes and lawful bases. We use information to process and deliver orders, manage accounts, subscriptions, returns and payments (performance of contract); comply with tax, accounting, product safety and recall duties (legal obligation); prevent fraud, secure our website, analyse performance, improve services and manage business relationships (legitimate interests, balanced against your rights); and send marketing where permitted by applicable marketing law (consent where required, or another lawful basis where applicable). Where consent is required, you may withdraw it at any time.

4. Recipients. Data may be shared as necessary with Shopify and its service providers, payment processors, banks, fulfilment and courier partners, IT/hosting and security suppliers, professional advisers, and authorities where required. Marketing and analytics providers may include MailerLite, Google Analytics, Google Search Console, Google Merchant Center, Monday.com, Royal Mail Click & Drop and Joy Subscription, as applicable to the services actually enabled. Some providers act as independent controllers; their own privacy notices may also apply. We do not sell personal information to advertisers.

5. International transfers. Some suppliers may process information outside the UK. Where UK data protection law requires safeguards, we use appropriate mechanisms such as UK adequacy regulations, the UK International Data Transfer Agreement or UK Addendum, or other lawful transfer measures.

6. Retention. We retain data only as long as reasonably necessary for the stated purposes, including statutory accounting and tax records, product traceability, dispute handling and legal claims. Specific retention schedules are determined by record type and legal requirements.

7. Cookies. Essential cookies support shopping baskets, checkout, security and account access. Analytics, advertising and other non-essential technologies are used only in accordance with applicable consent requirements. See our Cookie Policy and the cookie preference controls displayed on the website. Non-essential cookies and similar technologies will be activated only where the applicable consent requirements are met.

8. Marketing. You can unsubscribe using links in marketing emails or contact us. We distinguish individual subscribers from corporate contacts as required by UK electronic marketing rules.

9. Your rights. Subject to applicable exceptions, you may request access, correction, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent. Contact us at the email above. You can complain to the UK Information Commissioner’s Office at ico.org.uk.

10. Children. Our website is not directed at children; we do not knowingly seek personal information from children.

11. Security. We use proportionate technical and organisational safeguards, although no online service is completely secure.

12. Updates. We may update this policy and will publish the revised version and effective date. Where required, we will provide additional notice.