Privacy Policy.

PalletFlow is pallet management software for pallet businesses. It is provided by PRAGO CONSULTING LIMITED(“PalletFlow”, “we”, “us”).

This policy explains what information we handle, why we handle it, and what rights you have. It covers two distinct things: this website at palletflow.co.uk, and the PalletFlow application that subscribing organisations sign in to.

PalletFlow is software. We do not collect, transport, supply, repair or recycle pallets ourselves — our customers do, and PalletFlow is the system they run those operations on.

There are two relationships, and they work differently.

• This website. Anyone may browse it, request a demonstration, make an Enterprise enquiry, or begin a subscription. For that information, we are the controller.
• The PalletFlow application. Used by subscribing organisations and the people they authorise. For the account information we need to run the service, we are the controller. For the operational business data a customer records in PalletFlow — their suppliers, customers, staff and transactions — the customer is the controller and we act on their instructions. See Your operational business data.

We only ask for what a particular step actually needs.

• Demonstration requests. Your name, company name, work email, telephone number, a description of your operation, approximate volumes, the areas of PalletFlow you are interested in, and anything you choose to write in the message field.
• Enterprise enquiries. The contact and company details you enter on the Enterprise form, and the detail of your requirement.
• Bulk pallet enquiries. Your name, company name, work email, telephone number if you give one, the pallet type, quantity and delivery postcode, whether you need collection or delivery, and anything you write in the message field. We use them to respond to your enquiry and to obtain a quotation for it, which means sharing the details of your requirement with one or more pallet suppliers. See bulk pallet enquiries.
• Starting a subscription. Three fields only — your full name, your work email address and your company name — together with the plan you chose.
• Your account. When you activate your account you set a password. We never ask for it by email or telephone.
• Operational data you record in PalletFlow. Whatever your organisation enters while using the service — collections, stock, repairs, staff activity, suppliers, customers, orders, deliveries, payments and reporting.

We do not ask for your turnover, your bank details, your company registration number or your card details on this website, and the demonstration form does not accept them.

This website sets no cookies. It uses no analytics, no advertising or conversion pixels, no tag manager, no session recording and no third-party tracking of any kind. There is nothing here to consent to, which is why you are not asked to.

The PalletFlow application does set one cookie, and only one: a strictly necessary sign-in cookie that keeps you signed in to your account. It is httpOnly, so it cannot be read by scripts in your browser, and it is sent only over HTTPS. It is not used for analytics, profiling or advertising. Signing out or letting the session expire ends it.

As with any website, our hosting infrastructure processes the technical information your browser sends in order to serve pages and to keep the service available and secure — typically your IP address, the page requested, the time of the request and your browser type. This is ordinary server operation rather than a tracking programme, and we do not use it to build a profile of you.

The PalletFlow application keeps operational records of significant account events — for example, a subscription change applied after a confirmed payment — so that an account can be supported and audited. These records identify the organisation and the action, not your browsing.

• To respond to your enquiry or arrange a demonstration. Our legitimate interest in answering people who ask us about the product, and taking steps at your request before entering a contract.
• To create your organisation, your account and your subscription. Performance of our contract with you.
• To provide, maintain and support the service. Performance of our contract with you.
• To take payment and manage billing. Performance of our contract, and our legal obligation to keep accounting records.
• To send service messages — account activation, billing notices, security and availability notices. Performance of our contract. These are not marketing and cannot be unsubscribed from while your account is open.
• To keep the service secure and to prevent misuse. Our legitimate interest in protecting our customers and our systems.

We do not sell your information, we do not share it for anyone else’s marketing, and we do not make decisions about you by automated means that produce legal or similarly significant effects.

Subscription payments are processed by Stripe. When you start a subscription you are taken to Stripe’s own secure hosted checkout to enter your card details.

PalletFlow never sees, receives or stores your card number. Neither this website nor the PalletFlow application handles card data at any point. We receive from Stripe only what we need to run your subscription: confirmation that a subscription exists, which plan it is on, its status, its trial and renewal dates, and identifiers for your Stripe customer and subscription records.

Stripe is an independent controller of the payment information it collects and handles it under its own privacy policy.

We use a small number of providers, each for one clearly defined purpose.

• Stripe — subscription payments and billing, as described above.
• Resend — delivery of transactional email, such as an enquiry sent to our team, an account activation message or a billing notice.
• Our hosting provider — the infrastructure on which this website, the PalletFlow application and its database run.

That is the complete list of third parties that handle information on our behalf. When you send a bulk pallet enquiry, the details of your requirement are also shared with pallet suppliers so that it can be quoted. We may also disclose information where the law requires it, or to establish or defend legal claims.

Enquiries you submit through this website are emailed to our team. This website itself has no database and keeps no copy of what you submitted.

The records your organisation creates in PalletFlow belong to your organisation. Where those records contain personal data — the name of a supplier contact, a customer contact, or one of your own staff — your organisation is the controller and we act as a processor on your instructions.

In that role we will:

• process that data to provide the service, and to support your organisation;
• not use it for our own purposes, and never sell it or share it for marketing;
• keep it separated from the data of other customers;
• support you, so far as we reasonably can, in responding to requests from the people whose data it is.

Access within your organisation is controlled by the roles and permissions your administrator sets. If you are one of our customers’ staff, suppliers or customers and you want to exercise a right over your data, please contact that organisation directly — they decide what is held and why. We will help them respond.

We are based in the United Kingdom and the United Kingdom is our primary market. Some of the providers named above operate internationally, so information may be processed outside the UK — Stripe and Resend both do.

Where information is transferred outside the UK, that transfer is made under the safeguards UK data protection law requires, such as the UK International Data Transfer Agreement or Addendum, or on the basis of an adequacy decision.

We make no claim to offer country-specific tax, accounting or regulatory compliance in any jurisdiction. PalletFlow is an operational system; it is not tax or accounting software.

We keep information for as long as we need it for the purpose it was collected for, and for as long afterwards as is reasonably necessary.

• Enquiries and demonstration requests — kept while we are dealing with the enquiry and for a reasonable period afterwards.
• Account and organisation records — kept for the life of your subscription, and afterwards where there is a continuing reason to keep them.
• Your operational business data — kept while your subscription is active. After it ends it is not removed automatically, so that your account can still be reopened, reconciled or exported.
• Billing and payment records — retained for as long as accounting and tax law requires, which is normally six years.

Beyond those points we may continue to hold information where it is reasonably necessary for administering the service, for security, for resolving a dispute, or to meet a legal, accounting or regulatory obligation.

Cancelling a subscription does not by itself delete your records. If you want your data exported, or removed, tell us at hello@palletflow.co.uk and we will agree what is possible with you, subject to anything we are required to keep. You can also ask us to erase personal data at any time — see Your rights.

We take the protection of your information seriously. In practice that means:

• this website and the application are served only over HTTPS;
• passwords are stored as salted, computationally expensive hashes and never in a form that could be read back;
• sign-in sessions are carried in a signed, httpOnly cookie that cannot be read or edited by your browser, and can be revoked;
• each organisation’s data is scoped to that organisation on every request the server answers;
• instructions that change a subscription are accepted only from the payment provider and only when cryptographically verified as genuine;
• card details are never handled by us at all.

No system can be guaranteed absolutely secure, and we do not claim otherwise. We hold no security certification and make no certification claim. If you believe you have found a vulnerability, please tell us at hello@palletflow.co.uk so we can investigate.

Under UK data protection law you have the right to ask us for a copy of the personal data we hold about you; to have it corrected if it is wrong; to ask us to delete it; to ask us to restrict how we use it; to object to processing we carry out on the basis of our legitimate interests; and to receive certain data in a portable form.

To exercise any of these, email hello@palletflow.co.uk. We will respond within one month. There is no charge in normal circumstances.

If you are unhappy with how we have handled your information you may complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk. We would appreciate the chance to resolve it with you first.

When you record information about other people in PalletFlow — your staff, your suppliers’ contacts, your customers’ contacts — you remain responsible for that information. In particular you are responsible for:

• having a lawful basis for recording it in the first place;
• telling those people how their information is used, through your own privacy notice;
• keeping your user accounts accurate — removing people who have left, and granting each person only the access their role needs;
• keeping sign-in credentials confidential within your organisation.

We provide the roles, permissions and account controls to let you do this. Setting them appropriately is your decision, not ours.

We may update this policy as the service develops or as the law changes. The date at the top always shows when it last changed. If a change materially affects how we handle your information, we will tell account administrators by email rather than relying on you to notice the new date.

For anything in this policy — a question, a request about your data, or a concern — email hello@palletflow.co.uk.

See also our Terms & Conditions, which govern the use of PalletFlow.