Privacy & Data Handling

1. Who we are

PostMend Ltd (company no. 17236155, registered office 167-169 Great Portland Street, 5th Floor, London, W1W 5PF) is the data controller for personal data collected through this website and during repairs. We are registered with the Information Commissioner's Office under ZC155988. Contact: support@postmend.co.uk.

2. What we collect

• Account details — name, email, phone and address.
• Repair details — device model, service tag, reported fault and photos you upload.
• Order and payment records (card payments are processed by Stripe; we do not store card numbers).
• Basic website analytics, where you consent to cookies.

3. The data on your device

We treat the contents of your device as private. Our engineers do not browse, open or copy your personal files. Where a repair requires us to power on the device, access is limited to what is necessary to diagnose and test the fault.

Please back up your data before sending a device. A secure data-wipe certificate is available on request, and is recommended before any WEEE disposal.

4. How we use your data and our lawful basis

• Performance of contract (UK GDPR Art. 6(1)(b)) — to take and fulfil your repair booking, take payment, ship the device and provide warranty support.
• Legal obligation (Art. 6(1)(c)) — to keep accounting, tax and WEEE consignment records as required by UK law.
• Legitimate interests (Art. 6(1)(f)) — to secure the site against fraud and abuse and to improve our service.
• Consent (Art. 6(1)(a)) — for optional analytics cookies and optional marketing emails. You may withdraw consent at any time.

5. Subprocessors and sharing

We share data only with vetted service providers, each bound by a written processor agreement. We do not sell your data.

• Stripe — card payment processing.
• ShipStation, Royal Mail and other couriers — postage and tracking.
• Resend — transactional email delivery.
• Vercel — site hosting and Blob storage for completion photos.
• Neon — managed PostgreSQL database (EU region).
• Google — optional OAuth sign-in and, with your consent, Google Analytics.

6. International transfers

Some processors (notably Stripe, Resend, Vercel and Google) are based in or route data through the United States. Transfers rely on the UK Extension to the EU–US Data Privacy Framework, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, with supplementary technical measures (TLS in transit, encryption at rest).

7. Retention

• Account & repair history: while your account is active, then up to 12 months after closure.
• Invoices and payment records: 6 years from the end of the relevant tax year (Companies Act 2006 / HMRC).
• Warranty records: 12 months from device return.
• WEEE consignment notes: as required by the Environment Agency.
• Completion photos and diagnosis notes: deleted 12 months after the repair closes.
• Marketing-email consent: until you withdraw it.

8. Your rights

Under UK GDPR you have the right to access, correct, erase, restrict or object to processing of your personal data, the right to data portability, and the right to withdraw consent at any time. To exercise any right, email support@postmend.co.uk. We will respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).

9. Cookies

We use essential cookies to run the site and, with your consent, Google Analytics to understand how it is used. No analytics cookies are set until you accept.

Manage cookies — clears your stored choice and re-opens the consent banner.