Privacy Policy

1. Introduction

This Privacy Policy explains how Megatronic Ltd (“we”, “us”, “our”) collects, uses, stores, and protects personal data when merchants install and use the Batch Dispatch application (“the App”) on the Shopify App Store.

Batch Dispatch is a shipping label automation tool. It connects a merchant’s Shopify store directly to courier APIs (currently Evri and DHL) to generate, format, and distribute print-ready shipping labels. The App also enables collection point and parcel shop label generation on standard Shopify plans, without requiring a Shopify Plus subscription.

We operate in full compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the UK Privacy and Electronic Communications Regulations (PECR). We are registered with the Information Commissioner’s Office (ICO) under registration number [ICO REGISTRATION NUMBER].

By installing Batch Dispatch, the merchant agrees to this Privacy Policy. If you do not agree, please do not install or use the App.

2. Who We Are and How to Contact Us

For all data protection enquiries, data subject access requests, or deletion requests, contact us at the privacy email address above. We will acknowledge all requests within 72 hours and respond fully within one calendar month.

3. Who This Policy Covers

This policy applies to two distinct groups with different legal relationships to Megatronic Ltd:

We have no direct relationship with end customers. We process their shipping data solely to fulfil the merchant’s instruction to generate a shipping label. We never contact end customers, sell their data, profile them, or use their data for any purpose beyond label generation and delivery.

4. What Data We Handle and Why

4.1 Merchant Account Data (we are data controller)

When a merchant installs and uses Batch Dispatch, we collect and store the following:

• ›Shopify store domain and store ID, received via Shopify OAuth at installation
• ›Merchant contact name and email address, received via Shopify OAuth
• ›Subscription tier and label volume counts, used for billing via Shopify's native billing system
• ›App configuration settings and courier preferences
• ›Courier API credentials for Evri, DHL, and any future couriers — stored encrypted at rest; after initial entry the key is obfuscated so only the final four characters are visible
• ›Merchant-provided FTP or Amazon S3 connection credentials, where configured on paid tiers — stored encrypted and obfuscated in the same manner
• ›Tracking numbers generated for each order, stored in our database linked to the Shopify order ID only, not to any customer personal data

4.2 End Customer Shipping Data (we are data processor)

When a merchant triggers label generation, the following end customer data is retrieved from Shopify and processed:

• ›Customer full name
• ›Delivery address (including postcode)
• ›Email address

This data is used exclusively to:

• ›Transmit to the selected courier API (Evri or DHL) to generate a shipping label and obtain a tracking number
• ›Render the label as a print-ready PDF to the courier's exact print specification
• ›Deliver the PDF to the merchant's configured storage location, or make it available for manual download on the free Starter tier

This data is not stored in our database. It transits our servers for processing only.

4.3 Parcel Shop and Collection Point Lookups

The App queries the Evri courier API using a customer’s delivery postcode to retrieve the relevant parcel shop ID. This is a live lookup only — the postcode is transmitted to Evri’s API and is not stored in our database. If a postcode is captured in an error log during a failed lookup, it is deleted with those logs at 30 days.

4.4 Error Logs and Retry Data

When a failure occurs, the system logs the Shopify order ID and the error cause, executes an automatic retry sequence, and surfaces unresolved failures in the merchant’s console. Error logs may contain fragments of customer data if the failure originated within a courier or Shopify API response. These logs are held on our Hostinger VPS server and are permanently deleted at 30 days.

4.5 Generated Label PDFs

4.6 Tracking Number Write-back

Once a tracking number is obtained from the courier, the App writes it back into the Shopify order record via the Shopify API. The tracking number is also stored in our database linked to the Shopify order ID only. No customer personal data is stored alongside the tracking number in our database.

4.7 Usage and Performance Analytics

We collect server-side, first-party operational analytics: label counts per merchant per billing period, and API success and failure rates. No personal data is included in analytics. No individual order details, customer names, addresses, or postcodes are used. We do not use third-party analytics platforms.

5. Where Data Is Stored

All Megatronic Ltd server infrastructure is located in the United Kingdom (Hostinger VPS, UK datacentre). No personal data processed by us is transferred outside the United Kingdom or the European Economic Area (EEA).

6. Third-Party Sub-Processors

We use the following sub-processors. Each is contractually bound to handle data only as instructed and in accordance with applicable data protection law:

Additional couriers will be named in this policy before any integration goes live. Merchants may request an up-to-date list of sub-processors at any time by contacting hello@mega-tronic.com

7. Merchant-Owned Storage (Amazon S3 and FTP)

Available on paid tiers (Growth, Professional, Scale) only. Not available on the Starter free tier.

• ›The connection is established between the App and the merchant's storage, facilitated by Megatronic Ltd
• ›Megatronic Ltd does not access, read, or process any data held within the merchant's storage beyond delivering the label PDF
• ›The merchant is solely responsible for the security, configuration, and data protection compliance of their own storage environment
• ›Megatronic Ltd strongly recommends merchants use a dedicated, isolated S3 bucket or FTP location entirely separate from any other business infrastructure
• ›S3 access keys and FTP credentials are stored encrypted in our database and obfuscated after initial entry; only the final four characters remain visible
• ›Merchants are responsible for rotating their own credentials. Megatronic Ltd accepts no liability for data held in or accessed via merchant-controlled storage environments

8. Data Retention

Note: “deletion” means removed from our active systems and databases. Server infrastructure backups are purged on a rolling 30-day cycle.

8A. Merchant Retention Responsibility

Label PDFs stored by Megatronic Ltd on behalf of a merchant contain personal data belonging to that merchant’s customers. Megatronic Ltd acts as data processor; the merchant is the data controller.

Paid tier merchants who select a retention period beyond the 30-day default confirm that they have identified a specific operational purpose justifying the extended period, and accept responsibility for that retention decision in their capacity as data controller.

Shopify compliance redact webhooks override the merchant’s configured retention period. On receipt of a valid customers/redact or shop/redact request, the relevant data is deleted immediately.

9. Security Measures

• ›All data is encrypted in transit using TLS/HTTPS
• ›All data stored on our servers is encrypted at rest
• ›Courier API keys, FTP credentials, and S3 access keys are encrypted in our database; only the final four characters are visible after initial entry
• ›Access to production systems and personal data is restricted to authorised Megatronic Ltd personnel only
• ›Access logs are maintained for all systems that hold personal data
• ›In the event of a personal data breach we will notify the ICO within 72 hours and affected merchants without undue delay, as required by UK GDPR Article 33

10. Data Subject Rights

11. Shopify Mandatory Compliance Webhooks

Batch Dispatch subscribes to and verifies all three mandatory Shopify compliance webhooks:

12. Cookies

Batch Dispatch uses a small number of cookies that are strictly necessary for the App to function. No tracking, analytics, advertising, or preference cookies are used. Because these cookies are strictly necessary, they do not require consent under UK PECR.

13. Our Position on Children’s Data

Batch Dispatch is a business-to-business tool for Shopify merchants. Megatronic Ltd has no direct relationship with end customers and no mechanism to identify the age of any end customer whose shipping data is processed through the App.

The merchant is the data controller for their customers’ data and is solely responsible for ensuring that their store’s data collection and processing practices are lawful, including any obligations relating to customers who may be under the age of 18.

14. Changes to This Policy

Where changes are material, we will:

• ›Notify merchants via email at least 14 days before the change takes effect
• ›Update the version number and last updated date at the top of this document
• ›Require merchants to acknowledge the updated policy on their next login before continued use

15. Complaints and Regulatory Authority

If you have a concern about how we handle personal data, please contact us at hello@mega-tronic.com in the first instance. We aim to resolve all concerns within 30 days.

You also have the right to lodge a complaint directly with the UK supervisory authority: