Privacy Policy

Last updated: 26 September 2026

1. Who we are

1stsend is operated by Ecommerce Transhipment Solution Ltd ("1stsend", "we", "us"), a company registered in England and Wales (company number 08586595), with its registered office and warehouse at Cici House, 58 Derby Street, Manchester, M8 8HF, United Kingdom.

For personal data about our own customers (selling partners) and their staff, we are the data controller. For personal data about Amazon buyers that we process to ship orders on behalf of a selling partner, we act as a data processor on that selling partner's instructions.

You can contact us about this policy or your personal data at admin@1stsend.com.

Our technology partner. The 1stsend platform — including its integration with the Amazon Selling Partner API, its hosting and its day-to-day technical operation — is developed and operated for us by Britannica Creations Limited, a company registered in England and Wales (company number 07473370), registered office 51c Derby Street, Manchester, M8 8HW, United Kingdom. Britannica Creations Limited is the registered Amazon Selling Partner API developer for 1stsend. It processes Amazon Information only to provide the 1stsend service, under a written data processing agreement that requires it to protect that information to the standards described in this policy and in the Amazon Data Protection Policy.

2. What data we collect

(a) Customer account data

When a business signs up to 1stsend we collect the contact name, business name, email address, telephone number, billing details and the user accounts created for its staff, together with sign-in records (such as IP address and sign-in time) that we keep for security purposes.

(b) Amazon Information obtained through the Amazon Selling Partner API

When a selling partner authorises 1stsend, we retrieve from Amazon the information needed to ship their orders:

• Order information: Amazon order ID, order date, ship-by and deliver-by dates, items and quantities, and the shipping service requested.
• Amazon buyer Personally Identifiable Information (PII): recipient name, shipping address, telephone number and email address, where provided by Amazon.

(c) Our website

Our public website pages do not use analytics or advertising cookies. If you send us a quote request, we receive the details you choose to include in your email.

3. How we use it

We use customer account data to provide and bill for the service, to support our customers and to keep the service secure. Our legal basis is the performance of our contract with the customer and our legitimate interest in running a secure service.

We use Amazon Information only to fulfil the selling partner's orders: to generate shipping labels, arrange dispatch and collection, update tracking and send shipment confirmation back to Amazon.

Use limitation. We use Amazon Information solely to provide the shipping and fulfilment services requested by the selling partner who authorised our access. We do not sell, rent, licence or otherwise disclose Amazon Information to any third party except our sub-processors listed in section 6 and the delivery carrier selected through the Amazon Shipping API, and then only the minimum fields required to produce a shipping label and complete delivery. We never use Amazon Information for marketing, for resale, or for any purpose other than fulfilling the order it relates to.

4. How we store it

Where your data is stored

Amazon Information, including Personally Identifiable Information relating to Amazon buyers, is stored on Amazon Web Services infrastructure in the Asia Pacific (Tokyo) region, Japan. It is encrypted at rest using AES-256, with encryption keys generated, stored and rotated in AWS Key Management Service — customer-managed keys are rotated automatically every 365 days and application-level secrets every 90 days. Data in transit is encrypted using TLS 1.2 or above. Encrypted backups are held in the same region and are subject to the same retention and deletion rules as primary data. Keys are never stored alongside the data they protect, and access to key material is restricted to authorised services and named personnel on a least-privilege basis, with all access audit-logged.

5. How we protect it

Security. Amazon Information is encrypted at rest using AES-256 with keys managed in AWS Key Management Service, and in transit using TLS 1.2 or above. Access is granted strictly on a least-privilege basis, requires multi-factor authentication, and is fully audit-logged. Personally Identifiable Information is masked or redacted before log ingestion and is never written to application logs.

Who can access your data

Access to Amazon Information is limited to authorised personnel of Ecommerce Transhipment Solution Ltd (warehouse operations and customer support) and Britannica Creations Limited (platform engineering and operations), all of whom are located in the United Kingdom. Access is granted strictly on a least-privilege basis according to job role, requires multi-factor authentication, is individually attributable to a named user, and is fully audit-logged. No personnel outside the United Kingdom have access to Amazon Information.

We also carry out regular vulnerability scanning and an annual penetration test, and we maintain an incident response process. More detail is available on our Security page.

6. Who we share it with

Sub-processors

We use a small number of sub-processors to provide 1stsend, each bound by written data protection terms:

• Britannica Creations Limited (United Kingdom) — develops, hosts and operates the 1stsend platform and its Amazon Selling Partner API integration.
• Amazon Web Services (Asia Pacific (Tokyo) region, Japan) — encrypted hosting and storage.

Shipping labels are purchased through the Amazon Shipping API. The delivery carrier selected for each shipment receives only the minimum delivery details — recipient name, delivery address and, where the delivery service requires it, telephone number — through Amazon's shipping services, and the same details are printed on the label attached to the parcel. We do not share Amazon Information with any other party, and we do not sell, rent or licence it. We never use it for marketing, analytics or model training. We will disclose personal data to a public authority only where we are legally required to do so.

7. How long we keep it and how we delete it

Data retention and deletion. Personal data obtained through the Amazon Selling Partner API is retained only for as long as is necessary to fulfil the order it relates to. Personally Identifiable Information relating to Amazon buyers — including recipient name, shipping address, telephone number and email address — is permanently and irreversibly deleted within 30 days of order delivery. Deletion is automated and applies to primary databases, replicas and encrypted backups. We do not retain Amazon buyer PII beyond this period for any purpose, and we do not retain it for analytics, marketing or model training.

If a selling partner revokes our access or closes their account, we stop retrieving their Amazon Information, and any Amazon buyer PII we still hold is deleted within 30 days.

Customer account data is kept while the account is active and afterwards only for as long as we need it to meet our legal, tax and accounting obligations.

8. Amazon-specific commitments

• We comply with the Amazon Services API Developer Agreement, the Amazon Acceptable Use Policy and the Amazon Data Protection Policy.
• We use Amazon Information only to support the selling partner's own business, and only for the shipping purposes described in this policy.
• We do not combine Amazon Information from one selling partner with that of another, and we do not use it to build profiles of Amazon buyers.
• We notify Amazon of any security incident involving Amazon Information within 24 hours of detecting it, as required by the Amazon Data Protection Policy.

9. Your rights (UK GDPR)

Under UK data protection law you have the right to access your personal data, to have it corrected, to have it erased, to receive it in a portable format, to restrict or object to its processing, and to withdraw consent where processing is based on consent.

To exercise any of these rights, email admin@1stsend.com. We will respond within one month of receiving your request.

If you are an Amazon buyer, your order was placed with the seller, not with us. Please contact the seller first; we will help them respond to your request.

You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

10. International transfers

Ecommerce Transhipment Solution Ltd and Britannica Creations Limited are both established in the United Kingdom, and personal data processed on behalf of selling partners is stored in Japan (AWS Asia Pacific (Tokyo) region). Transfers of personal data from the United Kingdom to Japan are made in reliance on the UK adequacy regulations for Japan, which recognise Japan as providing an adequate level of protection for personal data. In addition, the technical and organisational safeguards described in this policy — encryption at rest and in transit, least-privilege access control, multi-factor authentication, audit logging, and deletion of Amazon buyer Personally Identifiable Information within 30 days of order delivery — apply to all data regardless of where it is stored.

11. Contact

Data protection contact: admin@1stsend.com
Telephone: +44 7492 316331
Post: Data Protection, Ecommerce Transhipment Solution Ltd, Cici House, 58 Derby Street, Manchester, M8 8HF, United Kingdom

12. Changes to this policy

If we change this policy we will update it on this page and revise the "Last updated" date above. Material changes will be notified to our customers by email.