1. What this notice covers
This notice explains how John Spinks trading as ClearSKU ("ClearSKU", "we", "us") uses personal data when you visit ClearSKU, ask for access, hold or administer an account, contact us, or use our product-evidence and market-access workspace.
For account administration, billing, support, security and our own business operations, ClearSKU is the controller. When a customer uploads or supplies personal data in product evidence, supplier workflows or marketplace records, that customer will normally be the controller and ClearSKU acts as its processor. In that situation, please direct rights requests to the relevant customer first.
2. Personal data we use
- Identity and contact data: name, work email, organisation, role and invitation or support details.
- Account and security data: password hashes, authentication settings, recovery state, session records, permissions, IP and security-event information.
- Workspace content: product records, evidence files, supplier contacts, marketplace notices, listing observations, review notes and audit history that you or authorised users provide.
- Billing data: plan, subscription, invoice and payment-status references. Stripe processes card details; ClearSKU does not store full payment-card details.
- Service and communications data: usage, operational and integration logs, support messages, notification delivery records and access enquiries.
ClearSKU is a business service and does not require special-category data or criminal-offence data. Please do not upload such data, or unrelated personal data, unless your organisation has confirmed it is necessary and lawful.
3. Where the data comes from
We receive data directly from you, your organisation's administrators and other authorised users; from content uploaded to a workspace; from suppliers or reviewers invited by a customer; from connected marketplaces or integrations; and from service providers such as Stripe. Some product evidence may contain business contact details obtained by a customer from public or commercial sources.
4. Why we use it and our lawful bases
| Purpose | Personal data | Lawful basis |
|---|---|---|
| Provide accounts, workspaces, evidence workflows, exports, billing and support | Identity, contact, account, workspace, billing and communications data | Performance of a contract, or steps requested before entering one |
| Secure the service, prevent misuse, maintain audit trails and investigate incidents | Account, session, security, usage and operational data | Our legitimate interests in operating a secure, reliable B2B service and protecting customers |
| Improve reliability and understand feature performance | Minimised usage, error and support data | Our legitimate interests in maintaining and improving the service |
| Keep financial, tax and legal records and respond to lawful requests | Identity, contact, billing, transaction and relevant audit data | Legal obligation and, where applicable, legitimate interests in establishing or defending legal claims |
We do not currently rely on consent for essential account or service processing. If we introduce an optional activity that relies on consent, we will ask first and explain how to withdraw it without affecting earlier lawful processing.
5. When providing data is required
Account, contact and authentication details are needed to create and secure a workspace and provide the service. If they are not provided, we may be unable to open or administer an account. Other workspace fields are optional unless ClearSKU clearly marks them as needed for a requested workflow.
6. Who receives personal data
We may share the minimum necessary data with authorised members of your organisation; suppliers or reviewers your organisation invites; hosting, database and object-storage providers; transactional email, security, monitoring and support providers; Stripe for subscription billing; professional advisers; and regulators, courts or law-enforcement bodies when legally required. These recipients may act as processors, independent controllers, or both, depending on the service.
ClearSKU does not sell personal data. We do not share it for third-party behavioural advertising.
7. International transfers
Some service providers may process personal data outside the UK. Where that is a restricted transfer, we use an applicable UK adequacy regulation or approved safeguards, such as the UK International Data Transfer Agreement or UK Addendum, together with relevant risk assessments and security measures. Contact us for information about safeguards that apply to your data.
8. How long we keep data
We keep account and workspace data while the customer account is active and for a limited period afterwards where needed for closure, restoration, disputes, security or legal obligations. Billing and transaction records are retained for the period required by tax and accounting law. Security, support and audit records are kept only for as long as reasonably needed for those purposes. Backups are protected and overwritten on their normal cycle.
We decide exact periods by considering the contract, the amount and sensitivity of the data, security and support needs, limitation periods and legal record-keeping duties. Customers can use ClearSKU's export and closure controls, subject to these limits.
9. Security
ClearSKU uses role-based access, tenant separation, protected authentication, audit records, encrypted transport and controlled evidence storage. No service can promise absolute security. Customers must use strong credentials, protect recovery codes, keep access lists current and tell us promptly about suspected unauthorised access.
10. Your data-protection rights
Depending on the circumstances and lawful basis, you may have rights to access, correct, erase or restrict personal data, receive portable data, and object to processing. You may also withdraw consent where processing relies on consent. These rights are not absolute, and we may need to verify your identity.
To exercise a right, email [email protected]. If ClearSKU processes the data only for a customer, we will refer the request to that customer and assist them as required.
11. Complaints
Please contact us first so we can try to resolve the issue. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data-protection regulator. Visit the ICO's data-protection complaints page.
12. Automated processing
ClearSKU applies rules and analysis to product records and evidence to produce operational readiness results and suggested next actions. Those outputs concern products and marketplace workflows; they are not solely automated decisions about individuals with legal or similarly significant effects. ClearSKU does not certify products or grant permission to sell, and customers remain responsible for human review and decisions.
13. Cookies and local storage
ClearSKU uses strictly necessary session and security technologies to authenticate users, protect requests and preserve essential workspace state. At the effective date above, it does not use advertising cookies or non-essential analytics cookies. If this changes, we will update this notice and provide any consent controls required by law.
14. Children
ClearSKU is a B2B service for authorised workplace users and is not directed to children. Please contact us if you believe a child has provided personal data to ClearSKU.
15. Changes and contact
We review this notice and will update the effective date when it changes. We will bring material changes to account holders' attention where appropriate. Questions or requests can be sent to [email protected].