Privacy Policy
Last updated 25 September 2026
1. Controller
Mando Systems Ltd (company no. 17168657), 10 Pilgrims Walk, Worthing, BN13 1RJ, United Kingdom, is the data controller for the personal data described here. Contact: privacy@dropshipmachine.com.
2. What we collect
- Account data — name, email address, password hash, and the identifier returned by Apple, Google or PayPal if you sign in that way.
- Billing data — subscription status, payment references and transaction history. We never see or store your full card number; payments are handled by PayPal.
- Payout destination — if you add one, the PayPal email or bank account details (sort code, account number, IBAN, SWIFT/BIC) you want your profit paid to. Encrypted at rest.
- Usage data — products you import, listings you publish, orders processed.
- Your buyers' delivery details — name, delivery address and phone number, received from your marketplace solely so an order can be delivered.
- Technical data — IP address, browser type and server logs.
3. Why we use it, and our lawful basis
- To provide the service (contract) — running your account, importing products, placing and tracking orders.
- To take payment (contract) — subscriptions and fulfilment credit.
- To keep the service secure and prevent fraud (legitimate interests).
- To meet legal duties (legal obligation) — accounting and tax records.
- To send service updates (legitimate interests). Marketing email only with your consent, withdrawable at any time.
4. Your buyers' data
When one of your listings sells, we receive the end buyer's delivery details so the order can be shipped. We use that data only to fulfil the order and to return tracking information. We delete or anonymise end-buyer personal data 90 days after delivery is confirmed. We never use it for marketing and never sell it.
5. Who we share it with
We use a small number of processors, each under contract and each only for the purpose listed:
- Hosting — our servers (UK/EEA).
- PayPal — payments and, if you choose it, sign-in.
- Fulfilment partners — receive the delivery name, address and phone number needed to ship an order. Nothing more.
- Marketplaces you connect (for example eBay) — receive listing and tracking data.
- Email and SMS providers — deliver order notifications.
We do not sell personal data.
6. International transfers
Some recipients are outside the UK. Where that happens we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, and we minimise what is sent to the delivery details and tracking reference required to complete an order.
7. How long we keep it
- End-buyer personal data — deleted or anonymised 90 days after delivery.
- Financial and transaction records — 6 years, as required by HMRC.
- Account data — while your account is open, then deleted within 90 days of closure except where we must keep records by law.
8. Your rights
Under UK GDPR you can request access to your data, correction, erasure, restriction, portability, and you can object to processing based on legitimate interests. Email privacy@dropshipmachine.com and we will respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.
9. Cookies
We use strictly necessary cookies to keep you signed in and to protect forms against cross-site request forgery. We do not use advertising cookies.
10. Security
Data is transmitted over TLS, access tokens are encrypted at rest, access is limited to those who need it, and payment card details never touch our servers.
11. Changes
We will post any update here and, where the change is material, tell you by email.