Internal Personal Data Protection Policy

Internal Personal Data Protection Policy

Company: Happy Unit Limited
Effective Date: 15 October 2026
Policy Owner: Company Director
Review Frequency: Annually
Next Review Date: 15 October 2027

1. Purpose

Happy Unit Limited is committed to protecting personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy establishes internal procedures for the secure handling, storage, processing and deletion of personal information.

2. Scope

This policy applies to the company's online retail operations, including eBay, Temu, Etsy and Shopify, and its internally developed inventory management software.

3. Data Collection and Processing

Personal data shall only be collected and processed where necessary for legitimate business activities, including order fulfilment, customer service and legal compliance.

The company's inventory management software is designed primarily to process non-personal information, including:

  • Product SKUs

  • Inventory quantities

  • Product descriptions and listings

  • Product prices

  • Stock synchronisation information

The software shall minimise the collection and storage of customer personal information.

4. Access Control and Security

Happy Unit Limited shall implement the following measures:

  • Restrict access to authorised personnel.

  • Protect business devices with passwords or equivalent authentication.

  • Keep operating systems and software updated.

  • Protect API credentials and authentication tokens.

  • Prevent unauthorised disclosure of personal information.

  • Use secure connections when communicating with marketplace APIs.

5. Data Retention and Deletion

Personal information shall be retained only for as long as necessary for legitimate business purposes or legal obligations.

Personal data obtained through marketplace APIs shall be deleted according to applicable platform requirements, including any relevant 30-day deletion obligations.

Non-personal product and inventory information may be retained for ongoing business operations.

6. Third-Party Data Processing

Personal information shall not be disclosed to unauthorised third parties.

Where third-party services are required, the company shall assess their data protection arrangements and share only information necessary for the relevant service.

7. Individual Data Protection Rights

Happy Unit Limited shall respond appropriately to valid requests concerning:

  • Access to personal information

  • Correction of inaccurate information

  • Deletion of personal information

  • Restriction of processing

  • Other applicable rights under UK data protection legislation

8. Data Security Incidents

Any suspected personal data breach shall be investigated promptly.

Where required by law, the company shall notify the Information Commissioner's Office (ICO) and affected individuals within the applicable statutory deadlines.

Appropriate corrective measures shall be taken to reduce the risk of recurrence.

9. Responsibilities

The Company Director is responsible for:

  • Overseeing compliance with this policy.

  • Maintaining appropriate security measures.

  • Reviewing access permissions.

  • Responding to data protection concerns.

  • Ensuring that personal data is handled appropriately.

10. Policy Review

This policy shall be reviewed at least once every 12 months and whenever significant changes occur to the company's operations, technology or legal obligations.

Reviews and material changes shall be documented.

Approved by: Company Director, Happy Unit Limited

Approval Date: ____________________

Next Review Date: 15 October 2027

Back to blog