Login Sign Up

DATA PROTECTION POLICY

Last updated November 2, 2026

It is the policy of MarketplaceHub to maintain an information management system designed to meet the requirements of ISO 27001 in pursuit of its primary objectives, the purpose and the context of the organization in relation with the provided services within the scope:

  • managed ecommerce services for brands and retailers selling products on online marketplaces
  • retail activities on online marketplaces, independently, and in partnership with other commercial organisations
  • the development of technology to support all the elements of the business

It is the policy of MarketplaceHub to:

  • make the details of our policy known to all other interested parties including external where appropriate and determine the need for communication and by what methods relevant to the business management system.
  • comply with all legal requirements, codes of practice and all other requirements applicable to our activities; therefore, as a company, we are committed to satisfy applicable requirements related to information security and the continual improvement of the ISMS.
  • provide all the resources of equipment, trained and competent staff and any other requirements to enable these objectives to be met;
  • ensure that all employees are made aware of their individual obligations in respect of this information security policy;
  • maintain a management system that will achieve these objectives and seek continual improvement in the effectiveness and performance of our management system based on "risk".

This information security policy provides a framework for setting, monitoring, reviewing and achieving our objectives, programmes and targets.

To ensure the company maintains its awareness for continuous improvement, the business management system is regularly reviewed by "Top Management" to ensure it remains appropriate and suitable to our business. We are not certified against ISO 27001 and do not currently undergo external audit; the standard is used as the framework this policy is built on.

Scope of the Policy

The scope of this policy relates to use of the database and computer systems operated by the company in pursuit of the company's business of providing ecommerce managed services, operating online stores on online marketplaces and the development and deployment of technology for the ecommerce industry sector. It also relates where appropriate to external risk sources including functions which are outsourced.

Access Control

Access to systems and personal data is granted on the principle of least privilege: each person and each system receives only the access its role needs, and nothing more.

  • Each application runs under its own cloud identity and can read only the secrets granted to it.
  • Administrative and operational tools are not reachable from the public internet. They are available only over our private network and require Microsoft Entra ID sign-in.
  • Production systems are reachable only by named administrators. Access to the cluster and to the key vault is logged and reviewed when an incident is investigated.
  • Each merchant's data is held in its own database, separate from every other merchant's, and its sensitive fields are encrypted with that merchant's own data key.
  • Within the product, merchants control who on their team can see and change each area, and can protect their sign-in with two-factor authentication or passkeys. They can also have their team sign in through their company's own identity provider with single sign-on, and with SCIM that identity provider adds, updates and switches off team members; switching someone off ends their sessions at once.
  • Access is removed on the day a person leaves or no longer needs it.

Data Classification

We classify the data we hold into four categories, and handle each as follows.

  • Credentials: the marketplace access tokens, keys and passwords merchants give us to connect their sales channels and feeds. Encrypted with the merchant's own data key, and must never be written to logs.
  • Buyers' personal data: names, contact details and delivery addresses from marketplace orders. We process it on behalf of the merchant, who is its controller. Contact and address fields are encrypted with the merchant's own data key, and it is kept only as long as fulfilment requires: 24 months by default, or less where a marketplace requires a shorter period.
  • Merchant account data: the merchant's own name, email, sign-in details and billing information, how they found us and their answers to the welcome questions, for which we are the controller. Sign-in passwords are stored only as salted hashes.
  • Business data: products, listings, prices, stock and order values. Confidential to the merchant, and shared only with the sales channels the merchant connects and with the sub-processors listed in our Data Processing Agreement.

All data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256.