Privacy notice

1. Who we are

JustDrop is a trading name of CRABARC TECHNOLOGIES LTD, a private limited company registered in England and Wales under company number 17356507. Registered office: 3 Fencote Road, Hamilton, Leicester, LE5 1LW. We are the controller for the personal data described in this notice.

For any privacy question or request, contact hello@justdrop.co.uk.

2. Information we collect

Supply Partner applications. Company name, contact name, email address, phone number, website, product category, estimated SKU count, inventory system, VAT-registration status, dispatch capability, delivery method or couriers, and anything else you tell us in the message field.

Seller applications. Business name, contact name, email address, phone number, website, sales channels, marketplace channels, estimated monthly order volume, product categories, current selling platforms, and anything else you tell us in the notes field.

Account and authentication information. If your application is approved, we create an account and hold sign-in details. Passwords are never stored in readable form — we store only a salted cryptographic hash.

Security and rate-limiting information. When you submit an application we record your IP address against a request counter, so that the form cannot be abused. The counter resets after a set time window (currently one hour for application submissions). We keep this security information only for as long as it is reasonably necessary for security and abuse prevention.

Service communications. Emails we send you about your application or account, and any correspondence you send us.

Transaction information. Where the service is later used to place or settle orders, we hold the related order and transaction records. We do not receive or store full card details — any payment is handled by a payment processor.

3. Why we use it, and our lawful bases

Our legitimate interests — to assess business-to-business applications, to administer and secure the closed beta, to prevent misuse of the platform, and to communicate with you about your application and account.

Steps taken at your request before entering into an agreement, and performance of a participation agreement — where those apply to you or your business.

Legal obligations — to keep company, tax, accounting and compliance records.

Consent — only for optional promotional email, if you separately opt in. The consent checkbox on the application form is acceptance of the closed-beta terms; it is not marketing consent.

4. Who we share it with

We do not sell personal data and we do not share it for third-party marketing. We use a small number of service providers, and we disclose information where we are legally required to:

• hosting and infrastructure providers who run the platform and store its data;
• email delivery and email forwarding providers, so that we can send and receive service messages;
• payment processors, where a payment service is used;
• professional advisers, such as accountants and lawyers, where needed;
• regulators, courts or public authorities, where we are legally required to disclose.

5. International processing

Some of our service providers may process personal data outside the United Kingdom. Where the destination country is covered by UK adequacy regulations, we rely on those regulations.

Where adequacy regulations do not apply, we will put in place the appropriate safeguards required by UK data protection law before the transfer — for example the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.

If you would like to know which safeguard applies to a particular transfer, or to request a copy, contact hello@justdrop.co.uk.

6. How long we keep it

• Pending applications: while the application is being assessed.
• Rejected or withdrawn applications: non-essential application and profile information is normally kept for no longer than 90 days after the decision or withdrawal.
• Approved accounts: non-essential profile information is kept for the life of the account and normally no longer than 90 days after the account is closed.
• Accounting, tax, transaction, dispute, fraud-prevention and legal-claim records: kept for the applicable statutory or limitation period.
• Security and rate-limiting information: kept only as long as reasonably necessary for security and abuse prevention.

Non-essential information from rejected or withdrawn applications, and non-essential profile information after an account is closed, is scheduled for deletion within 90 days. This happens as a matter of course — you do not need to make a separate erasure request for it. After that, we keep only the records we are required to hold: accounting, tax and transaction records, and records needed for disputes, fraud prevention or legal claims, each for its applicable statutory or limitation period.

Deletion is carried out operationally by our team rather than by an automated process. You can still ask us to remove information sooner, and we will action it in line with the periods above and any records we must keep by law.

7. Your rights

Subject to the conditions in UK data protection law, you have the right to ask for access to your personal data, to have it corrected, to have it erased where that applies, to restrict or object to how we use it, and to receive it in a portable form where that applies. Where we rely on consent, you can withdraw it at any time.

Contact hello@justdrop.co.uk to make a request. You also have the right to complain to the Information Commissioner's Office.

8. Automated decisions

Every application is reviewed by a person. We do not make decisions about applications solely by automated means that produce legal effects or similarly significant effects for you.

9. Cookies

When you sign in, we set one strictly necessary cookie, justdrop_session, which keeps you signed in. It is HTTP-only, limited to this site, and marked Secure in production.

The current site does not use analytics or advertising cookies, and does not use browser storage to track you.

10. Marketing

We send promotional or newsletter email only if you have separately opted in, and you can opt out at any time. Messages about your application, your account or the operation of the service are not marketing.

11. Changes to this notice

We will update this notice as the service develops. Company details are on our Company information page, and participation is covered by our Closed-beta terms.