Privacy Policy

ReturnKits Ltd ("ReturnKits", "we", "us", "our") provides managed IT hardware recovery and employee offboarding/onboarding logistics for businesses. This policy explains what personal data we collect, why, and how we handle it — for our business customers, the employees whose devices we help recover or who receive a kit, and visitors to this site.

• Account data: name, work email, company name, billing address and phone number, provided when you register for a ReturnKits account.
• Order data: kit type, device reference (asset tag or serial number), and the shipping and return addresses you provide when booking a kit.
• Recipient data: the name, email, and delivery or collection address of the person receiving or returning a kit — who may be an employee or contractor, not necessarily the account holder.
• Payment data: processed directly by Stripe. We never see or store full card numbers; we retain a Stripe customer/session reference only.
• Credit and billing history: your company's prepaid Kit Credit balance and transaction history, where applicable, and invoice records.
• Tracking data: courier tracking numbers and delivery status from our shipping partner.
• Usage data: standard technical data such as IP address, browser type, and pages visited.

• To fulfil kit orders: packaging, dispatch, courier handoff, and delivery/return confirmation.
• To process payment for kits, prepaid credits, and optional Enhanced Cover via Stripe.
• To communicate order status, including dispatch, delivery, and any delays or issues.
• To operate customer accounts and the company portal, including letting authorised team members view their company's order activity.
• To maintain business records for accounting, fraud prevention, and legal compliance.
• To improve the service and, where you've agreed to be contacted, for sales and marketing communications.

We share personal data only where necessary to deliver the service:

• Stripe, for payment processing.
• Sendcloud, to coordinate courier labels and tracking with our shipping partners.
• Supabase, our database, authentication, and hosting provider (data hosted in the UK).
• Lovable, the platform our customer portal application runs on.
• Retool, our internal operations dashboard, used only by ReturnKits staff.
• Resend, for delivering transactional emails (order confirmations, dispatch notices, and check-ins).

We retain order and account records for as long as needed to meet contractual, accounting, and legal obligations — typically 6 years for financial records, in line with UK requirements. You can ask us to delete account data that is no longer needed for these purposes at any time.

If you are in the UK or EU, you have rights under UK GDPR / the GDPR, including the right to access, correct, or request deletion of your personal data, to object to or restrict certain processing, and to data portability. To exercise any of these rights, contact us using the details below. If you are not satisfied with our response, you can complain to the UK Information Commissioner's Office (ico.org.uk) or your local data protection authority.

We use industry-standard safeguards to protect personal data, including encrypted connections (HTTPS), database-level tenant isolation (row-level security) so customer data is only visible to the account it belongs to, role-based access controls, and audit logging of staff actions on customer data.

We use essential cookies and local storage to keep you signed in. We do not currently use third-party analytics or advertising cookies; if that changes, this policy will be updated accordingly.

ReturnKits is a business-to-business service and is not directed at children. We do not knowingly collect personal data from anyone under 16.

We may update this policy from time to time. Material changes will be reflected by an updated "last modified" date at the top of this page.

For any questions about this policy or your personal data, contact us at privacy@returnkits.com.