1. Who we are
Borders Prep provides Amazon FBA preparation services from the Scottish Borders, United Kingdom. For the purposes of UK data protection law, Borders Prep is the data controller for the personal data described in this policy.
- Trading name: Borders Prep
- Registered company name and company number: Form & Focus Limited, registered in Scotland, company number SC877097
- VAT registration number: GB 513 336 421
- Registered office address: 12 Plora Crescent, Innerleithen, Scotland, EH44 6LX
- Contact: email us
2. What we collect
Information you give us
When you use the enquiry form on this site we collect the name, email address, business or storefront name, approximate monthly unit volume, the services you tick, and whatever you write in the message box. We collect this because you chose to send it, and we use it only to answer you.
Information collected automatically
Our hosting provider keeps standard web server logs, which include your IP address, the pages requested, timestamps, and your browser's user agent string. These are generated by the server rather than by us, and are used for security and for diagnosing faults.
The enquiry form records the sending IP address for a short period so that a single address cannot flood the form with automated submissions.
Information from working with you
If you become a client we will also hold the contact and business details needed to take in your stock, prepare it and invoice you, together with correspondence about your shipments.
Your orders online
If you are a client you can see your orders on our website. To sign in you give the email address we already hold for you, and we email you a link. While you use it we record your sign-ins, any question you send us, when you tell us you have paid an invoice, and when you accept a quotation. The photographs we take of your stock while it is with us (for example on arrival, or of any damage) are shown to you there.
3. Cookies and tracking
The public pages of this website set no cookies. If you sign in to see your orders, we set one cookie that keeps you signed in for 30 days or until you sign out. It is strictly necessary for the service you asked for, so it does not need your consent, and it is never used to track you. There is no advertising pixel and no social media tracking. The fonts are served from this website's own server rather than from a third-party font service, so loading a page does not disclose your visit to anyone but our host.
Our visitor counter
We do count visits, using our own counter that runs on this website. It is not Google Analytics or any other third-party service, so your browser never contacts another company in order to be counted. For each page view it records the page you looked at, the site that linked you to us if you arrived from one, whether you were on a phone, tablet or desktop computer, the country the visit came from, roughly how many seconds the page was visible (up to about five), and whether you scrolled or clicked. Those last two exist so we can tell a real reader from an automated crawler, not to build a picture of you.
To count one person's visits within a single day without knowing who they are, we turn your IP address and browser description into a short code, mixed with a secret value that is regenerated every day and never saved. Your IP address itself is never written down by the counter. Because yesterday's secret no longer exists, one day's codes cannot be matched to the next day's, or worked back to you.
If your browser sends a Do Not Track signal, no visit is recorded at all.
None of this needs your consent under the cookie rules, because nothing is stored on or read from your device. If a cookie-based tool or a third-party analytics package is added later, this policy and a cookie banner must be added at the same time.
4. Why we use your data, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Reply to your enquiry and prepare a quote | Legitimate interests: responding to someone who has approached us about our services |
| Provide prep services, arrange shipments and invoice you | Performance of a contract with you |
| Show you your orders, and record what you tell us through them | Performance of a contract with you |
| Count visits to this website, so we know it is working and being found | Legitimate interests: understanding how our own site performs, using information that does not identify you |
| Keep accounting and tax records | Legal obligation |
| Protect the website and the enquiry form from abuse | Legitimate interests: keeping the service secure and available |
| Send marketing, if we ever do | Consent, which you may withdraw at any time |
We do not sell your personal data, and we do not use it for automated decision making or profiling.
5. How long we keep it
- Enquiries that do not become work: 30 days, then deleted.
- Correspondence about a job (emails and messages about a particular shipment, once it is finished): 12 months after that job is complete, then deleted. We do not keep it for the six years below, because nothing requires us to.
- Sign-in links: a link works once, for 30 minutes, and is deleted a day after it expires.
- Sign-ins: your signed-in session ends after 30 days.
- Photographs, your questions and your "I have paid" messages: 12 months after that job is complete, then deleted, like other correspondence about a job.
- Client and shipment records: for the life of the working relationship and then six years, to match the period HMRC expects business records to be kept.
- Invoices and accounting records: six years from the end of the relevant accounting period, as UK tax law requires.
- Web server logs: retained by our hosting provider under its own schedule. 123 Reg does not publish a fixed period for these, stating only that it keeps personal data for its business needs and to comply with the law.
- Visitor counter: the detailed per-visit records are deleted after 90 days. What remains is daily totals, which contain no identifiers at all.
- Enquiry rate-limit records: ten minutes.
6. Who your data is shared with
We keep the list of people who can see your data as short as we can. It currently covers:
- 123 Reg Limited (Studio 4th Floor, Parts C&D At East West, Tollhouse Hill, Nottingham NG1 5FW), our web host, which stores this website and the enquiry records it produces. 123 Reg acts as our processor and handles that data only on our instructions. It stores data on its own systems and with service providers including Amazon Web Services, and where data leaves the UK it does so under an addendum based on the UK International Data Transfer Agreement or standard contractual clauses.
- Google Workspace, which provides the Borders Prep email service and therefore holds the emails you send us. Google is certified under the UK extension to the EU-US Data Privacy Framework.
- Google reCAPTCHA, which protects the enquiry form from automated abuse. When you use the form, reCAPTCHA collects hardware and software information such as device and application data, along with your IP address, and sends it to Google to score whether the submission is likely to be human. It is used only for that check. Google's privacy policy and terms of service apply to that processing.
- Our accountant, and HMRC, for invoicing and tax purposes.
- Carriers, where an address or contact detail is needed to get a shipment to Amazon or back to you.
- Amazon, to the extent that a shipment identifies you as the seller, which is inherent in how FBA works.
We do not otherwise disclose your information, unless we are legally required to.
7. Where your data is held
Your data is held in the United Kingdom and the European Economic Area, except where a supplier named above transfers it elsewhere under an approved safeguard such as the UK International Data Transfer Addendum or the UK extension to the EU-US Data Privacy Framework.
8. How we protect it
This website is served over HTTPS. The enquiry form is protected by a hidden trap field and a per-address submission limit, and enquiry records are not readable from the web. Access to the mailbox holding your correspondence is restricted to Borders Prep and protected by a password and two-factor authentication.
No system is perfectly secure. If a breach occurs that is likely to risk your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours and tell you where the law requires it.
9. Your rights
Under UK GDPR you have the right to:
- ask what personal data we hold about you, and get a copy of it;
- have inaccurate data corrected;
- have data erased, where we have no continuing reason to keep it;
- restrict or object to how we use it, including objecting to any processing we carry out under legitimate interests;
- receive data you gave us in a portable, machine-readable form;
- withdraw consent at any time, where we relied on consent.
To exercise any of these, email us using the address on our contact page. We will respond within one month. There is normally no charge.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. We would appreciate the chance to put things right first.
10. Changes to this policy
If this policy changes we will update the date at the top of the page. Where a change materially affects how we use data you have already given us, we will contact you about it.