This policy explains how FTP EDI ("we", "us") handles personal data when you visit ftpedi.com, contact us, or use the FTP EDI platform. We are the controller for data collected on this website and for our own customer records. When we process trading documents on behalf of a customer we act as their processor, as described in our terms and data processing agreement.
Who we are
FTP EDI is a UK-based provider of retailer EDI services. You can contact us about anything in this policy at hello@ftpedi.com.
What we collect and why
Website visitors
We do not use analytics or advertising cookies on this website. Our hosting provider records standard server logs (IP address, user agent, pages requested, timestamps) for security and to keep the site running. Logs are kept for no more than 30 days.
Enquiries
When you fill in the contact form or email us we collect your name, company, email address, phone number if given, and whatever you tell us about your requirements. We use this to reply, prepare a proposal and, if you become a customer, to set up your account. Legal basis: our legitimate interest in responding to enquiries and, where you ask for a proposal, steps taken at your request before entering a contract.
Customers and platform users
For each user of the platform we hold a name, work email address, role, sign-in and activity records, and alert preferences including a mobile number if SMS alerts are enabled. We use this to operate the service, secure accounts, send alerts you have asked for and provide support. Legal basis: performance of our contract with your employer and our legitimate interest in keeping the platform secure.
Trading documents
Orders, despatch advices, invoices and related messages processed through the platform may contain personal data such as contact names on delivery notes. We process this only on the instructions of our customer, under the data processing terms in our agreement, and retain it for the period the customer selects (seven years by default) to meet their record-keeping obligations.
Sharing
We share personal data with the suppliers we need to run the service: cloud hosting in the UK and EU, email and SMS delivery, and payment processing for invoicing. Each is bound by a contract that restricts what they can do with it. We share trading documents with the retailers, warehouses and networks our customers instruct us to send them to. We do not sell personal data.
International transfers
Data is stored in the United Kingdom. Where a supplier processes data outside the UK we rely on the UK International Data Transfer Agreement or an adequacy regulation.
Retention
- Enquiries: two years after our last contact, unless you become a customer.
- Customer account and user records: for the life of the contract and six years afterwards for tax and legal purposes.
- Trading documents: the retention period chosen by the customer, seven years by default, then deleted.
- Server logs: 30 days.
Your rights
Under UK GDPR you can ask for a copy of your personal data, ask us to correct or delete it, object to or restrict processing, and ask for it in a portable format. Email hello@ftpedi.com and we will respond within one month. If you are a user of a customer's account we may need to refer your request to them as controller. You can also complain to the Information Commissioner's Office at ico.org.uk.
Security
Data is encrypted in transit and at rest. Access to production systems is restricted to named staff with multi-factor authentication and is logged. Retailer connections use AS2 with signed and encrypted payloads or equivalent secured channels.
Changes
We will update this page when our practices change and revise the date at the top. Significant changes affecting customers will be notified by email.