GDPR & Data Protection

Last updated: 15 May 2026

1. Data Controller

Cheap International Post Ltd is the data controller for all personal data processed in connection with our website and services. We are a company registered in England and Wales with our principal place of business in London, United Kingdom.

As data controller, we determine the purposes and means by which personal data is processed. We are registered with the Information Commissioner’s Office (ICO) as a data controller; our registration number is available upon request.

2. Data Protection Officer (DPO)

You may contact our data protection point of contact for any GDPR-related queries, subject access requests, or complaints:

We will acknowledge your request within 72 hours and respond substantively within one calendar month. In complex cases we may extend this by a further two months; we will notify you if an extension is needed.

3. Lawful Bases for Processing

We rely on the following lawful bases under UK GDPR Article 6 when processing your personal data:

  • Contract (Article 6(1)(b)): processing that is necessary to perform a contract with you or to take steps at your request before entering into a contract. This covers account creation, shipment processing, invoicing, and customer support.
  • Legitimate interests (Article 6(1)(f)): processing necessary for our legitimate business interests — including operating our CRM, maintaining business records, sending service-relevant commercial communications, and analysing website usage — where those interests are not overridden by your rights and freedoms.
  • Legal obligation (Article 6(1)(c)): processing required to comply with applicable UK law, including HMRC record-keeping rules and financial reporting requirements.
  • Consent (Article 6(1)(a)): where we specifically rely on consent (for example, placing optional analytics cookies), you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4. Your Data Subject Rights

Under UK GDPR, you have the following rights in relation to your personal data. To exercise any of them, please email join@cheapinternationalpost.co.ukwith the subject line “Data Subject Request”.

  • Right of access (Article 15): you may request a copy of all personal data we hold about you, along with information about how and why we process it.
  • Right to rectification (Article 16): you may ask us to correct personal data that is inaccurate or to complete data that is incomplete.
  • Right to erasure (Article 17): you may ask us to delete your personal data where there is no compelling reason for us to continue holding it. This right is not absolute — we may need to retain certain data for legal compliance or to defend legal claims.
  • Right to restriction of processing (Article 18): you may ask us to suspend the processing of your data in certain circumstances, for example while you contest its accuracy.
  • Right to data portability (Article 20): where processing is based on your consent or a contract, you may ask us to provide your data in a structured, commonly used, machine-readable format, or to transmit it directly to another controller where technically feasible.
  • Right to object (Article 21): you may object at any time to processing based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests. You have an unconditional right to object to processing for direct marketing purposes.
  • Rights related to automated decision-making (Article 22): we do not currently make decisions about you solely by automated means that produce legal or similarly significant effects.

5. International Data Transfers

Some of our third-party service providers are based outside the UK. When personal data is transferred outside the UK we ensure that appropriate safeguards are in place in accordance with UK GDPR Chapter V:

  • HubSpot, Inc. (United States): our CRM and marketing platform processes data on servers in the United States. This transfer is covered by Standard Contractual Clauses (SCCs) approved by the European Commission and adopted for UK transfers via the UK Addendum issued by the ICO, providing equivalent protection to UK GDPR.
  • Calendly, LLC (United States): meeting scheduling data is transferred to the US under Standard Contractual Clauses.
  • Vercel, Inc. (United States): website hosting infrastructure. Request logs and IP data may be processed on US servers, covered by Standard Contractual Clauses.

You may request a copy of the relevant safeguarding measures by emailing us at join@cheapinternationalpost.co.uk.

6. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law:

  • Account data: held for the duration of your active account and for a reasonable period thereafter to handle queries or disputes.
  • Financial and transactional records: retained for 7 years from the date of the relevant transaction in compliance with HMRC requirements.
  • Marketing and CRM data: reviewed annually; suppressed or deleted upon opt-out or inactivity beyond a reasonable period.

After the applicable retention period, data is securely and permanently deleted or anonymised so that it can no longer be attributed to you.

7. Security

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.

8. Right to Lodge a Complaint

If you believe we have not handled your personal data in accordance with UK GDPR, you have the right to lodge a complaint with the UK supervisory authority:

  • Information Commissioner’s Office (ICO)
  • Website: ico.org.uk
  • Telephone: 0303 123 1113
  • Post:Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would, however, appreciate the opportunity to address your concerns before you approach the ICO. Please contact us first at join@cheapinternationalpost.co.uk.

9. Changes to This Notice

We may update this GDPR notice from time to time to reflect changes in our processing activities or legal requirements. The “Last updated” date at the top of this page will reflect the most recent revision. We encourage you to review this notice periodically.