Solicitor draft - placeholders in [brackets] need confirmation before relying on this page.
DRAFT FOR SOLICITOR REVIEW — NOT LEGAL ADVICE
Prepared as a starting draft for Helix Platforms Ltd (OmniRestock). Do not publish until reviewed by a qualified solicitor. Placeholders in [brackets] need Matt’s input or counsel.
Controller: Helix Platforms Ltd (company no. 17032196), Unit 2 Lions Barn, Langham Lane, Colchester, CO4 5HY.
ICO registration: [ICO registration number — TO CONFIRM]
Contact: [privacy@omnirestock.com]
UK GDPR / Data Protection Act 2018 apply.
1. Scope
This policy covers omnirestock.com, the OmniRestock web app, the Shopify app, support channels and related services.
2. Data we collect
- Account data: name, email, password hash, company name, billing country, role.
- Billing data: processed by Stripe and/or Shopify; we receive limited billing metadata (plan, status). We do not store full card numbers.
- Channel connection data: OAuth tokens and IDs for Amazon SP-API, Shopify, eBay, WooCommerce, TikTok Shop, WMS/3PL systems (e.g. Mintsoft, Linnworks), stored encrypted and segregated.
- Commercial content you connect: products, SKUs, orders, inventory levels, locations, purchase orders, suppliers — used to forecast and replenish.
- Usage data: logs, audit trail, AI assistant prompts/responses scoped to your account.
- Support data: tickets and email.
- Cookies: see Cookie Policy.
3. Purposes and lawful bases
| Purpose | Lawful basis |
|---|---|
| Provide the service and integrations | Contract |
| Billing and fraud prevention | Contract / legitimate interests |
| Security and audit | Legitimate interests |
| Improve forecasting accuracy in aggregate (no cross-account leakage of client data) | Legitimate interests |
| Marketing to business contacts | Legitimate interests or consent (as applicable) |
| Legal compliance | Legal obligation |
4. Amazon and Shopify-specific notes
- Amazon SP-API data is handled in line with Amazon’s Data Protection Policy and our security practices.
- Shopify: we process personal data from the shop as a processor/controller as applicable; mandatory compliance webhooks (
customers/data_request,customers/redact,shop/redact) are implemented for App Store distribution. - We request only scopes needed for forecasting, inventory reads and (if enabled) PO/transfer writes.
5. Sharing
We use subprocessors listed below. We do not sell personal data. Agency/3PL partner users see client data only for accounts they are authorised to access.
Subprocessors [PLACEHOLDER — FINALISE BEFORE LAUNCH]
| Subprocessor | Role | Region |
|---|---|---|
| [Hosting e.g. AWS / Cloudflare / Railway] | Infrastructure | [Region] |
| [Stripe] | Web billing | [EU/US] |
| Shopify | App billing & platform | Global |
| [Email provider e.g. Resend] | Transactional email | [Region] |
| [AI model provider] | AI assistant | [Region] — prompts scoped; [no training on customer data — CONFIRM CONTRACT] |
| [Error/analytics e.g. Sentry] | Diagnostics | [Region] |
6. International transfers
Where data leaves the UK, we use [UK IDTA / Addendum / SCCs — SOLICITOR TO CONFIRM] and vendor reviews.
7. Retention
Active account data retained while the account is open. After closure: [30/60/90 days] for recovery, then delete or anonymise, except where law requires longer (e.g. invoices). Channel tokens deleted on disconnect. AI logs retained [period].
8. Your rights
Access, rectification, erasure, restriction, portability, objection, and complaint to the ICO (ico.org.uk). Requests: [privacy@omnirestock.com].
9. Children
Service is for businesses; not directed at children.
10. Changes
We will post updates on this page and, where appropriate, notify account admins by email.
Draft ends. Solicitor + ICO registration check required.