Privacy Policy
Last updated: 27 October 2026
This privacy policy explains how Dispatch Ltd handles personal data in connection with Parallel Purchasing and the Purchasing Portal service.
1. Who we are
Parallel Purchasing is a trading name of Dispatch Ltd, a private limited company registered in England and Wales.
- Company number: 12639946
- Registered office: 11 Station Road, Balsall Common, Coventry CV7 7FN
- Contact for data matters: matt@parallelpurchasing.co.uk
Dispatch Ltd is the data controller for personal data we collect directly (for example, when you register a user account, send us an enquiry, or sign a Services Agreement with us). Where we process our clients' purchase data (invoices, prices and spend) on their behalf, as part of our procurement services or our Purchasing Portal SaaS product, we act as a data processor and the client organisation remains the data controller. Dispatch Ltd is also the data controller for its supplier directory, including supplier company and contact details derived from any source, as described in sections 4 and 15. The roles are explained further in section 4 below.
We are not required to appoint a Data Protection Officer.
2. What this policy covers
This policy covers personal data we process in connection with:
- The Parallel Purchasing consultancy service
- The Purchasing Portal SaaS product (app.purchasingportal.co.uk)
- Communications with prospective and existing clients, suppliers, and other business contacts
It does not cover third-party services you may access through us (for example, your own Xero or QuickBooks account). Those services have their own privacy policies and you should read them.
3. What personal data we process
We process the following categories of personal data:
About our clients and prospective clients
- Names, job titles, business email addresses, business phone numbers, and business postal addresses of individuals at client and prospective client organisations
- Records of correspondence and meeting notes
- Information necessary to deliver our procurement services (for example, baseline pricing schedules, tender documents)
About users of the Purchasing Portal
- Account registration details (name, business email, role)
- Authentication tokens and session data
- Records of use of the platform, including invoices uploaded and settings changes
What the Xero connection reads
Where a client connects their Xero account, the connection is read-only. It cannot create, change or delete anything in Xero, and it has no access to bank accounts, bank transactions, payroll or financial reports.
Xero's read permissions are broader than what we use: the permissions we hold would also allow sales invoices, credit notes, quotes, purchase orders and the client's full contact list to be read. Our regular sync requests purchase invoices (bills) only, and for each one we store its attached documents (such as the supplier's invoice PDF) and the supplier's name and Xero reference. We do not keep clients' sales invoices, and we will not read any other Xero data without the client's written approval.
A client can disconnect the Purchasing Portal from Xero at any time, which stops any further data reaching us. Data already received is then kept or deleted under our agreement with the client.
About suppliers and supplier contacts
- Supplier organisation details
- Names and contact details of supplier representatives where these appear on invoices, quotes, or in client accounting records
- Business contact details from our correspondence with you: if you have emailed us, our systems read the signature block at the end of your message and record the business contact details in it
- Business contact details from your employer's public website
- Quote, invoice, and transaction history
About visitors to our website
- IP addresses and basic usage analytics (if and when these are enabled on our marketing website)
- Information you submit through contact forms
We do not knowingly process special category personal data (such as health, race, religion, or political opinions). The personal data we handle is almost entirely business contact data in a B2B context.
4. Controller and processor roles
The role we play under UK data protection law depends on the activity:
-
We are the data controller for: our own employees and contractors; users who register accounts on the Purchasing Portal directly with us; visitors to our marketing website; individuals at prospective client organisations we engage with for business development. We are also the data controller for our supplier directory, including supplier company and contact details derived from any source, our clients' purchase records included (see section 15).
-
We are a data processor for: the purchase data our clients provide to us, such as their invoices, prices and spend, including data pulled from a client's accounting system (for example, their Xero account). The client organisation remains the controller of this data. Our processing of this data is governed by our agreement with each client.
5. Why we process personal data and our lawful basis
We process personal data for the following purposes, under the lawful bases shown:
| Purpose | Lawful basis |
|---|---|
| Providing the Parallel Purchasing consultancy service to clients | Performance of a contract (UK GDPR Art 6(1)(b)) |
| Operating the Purchasing Portal SaaS product | Performance of a contract |
| Processing client invoices, prices and spend on instructions from clients | We act as processor on the client's documented instructions; the client, as controller, determines the lawful basis |
| Responding to business enquiries and prospective client communications | Legitimate interests (UK GDPR Art 6(1)(f)): pursuing new business in a B2B context |
| Sending service-related communications (e.g. service updates, security notices) | Legitimate interests, or performance of a contract |
| Meeting legal obligations (accounting, tax, regulatory) | Legal obligation (UK GDPR Art 6(1)(c)) |
| Keeping our supplier directory: running tender exercises and supplier management | Legitimate interests (UK GDPR Art 6(1)(f)); see section 15, which summarises our legitimate interests assessment. A copy of our legitimate interests assessment is available on request. |
We do not rely on consent as the primary lawful basis for B2B communications, in line with the ICO's guidance for B2B direct marketing under PECR.
6. Who we share personal data with
We share personal data only with parties that need it to support the services we provide. These include:
- Sub-processors of the Purchasing Portal: see section 7 below
- Our professional advisers: accountants, lawyers, and insurers where required
- Regulatory and law enforcement authorities: where we are legally required to do so
- The client whose tender you are invited to quote for (supplier contact details only, see section 15)
We do not sell personal data to third parties and we do not use it for third-party advertising.
7. Sub-processors
The Purchasing Portal relies on the following sub-processors. Each operates under its own data protection commitments and is subject to UK GDPR-equivalent obligations:
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase | Database hosting, file storage, authentication | See section 8 |
| Vercel Inc. | Application hosting and content delivery | See section 8 |
| Anthropic PBC | AI document processing (reading invoices, classifying suppliers), and AI assistance with building and supporting the service | See section 8 |
| Resend, Inc. | Transactional email delivery | See section 8 |
| Microsoft | See section 8 |
Xero is not one of our sub-processors: it is our clients' own accounting system, which a client chooses to connect to the Purchasing Portal (see section 3).
How Anthropic handles invoice data. We use Anthropic's AI through its commercial API, under Anthropic's Commercial Terms, which include its data processing addendum. Under those terms Anthropic acts as our processor, does not by default use the data we send to train its models, and normally deletes it within 30 days.
We review this list as we add new providers, and we will update this policy when material changes occur.
8. International transfers
Our primary data storage is in the European Union: our Supabase database, file storage and sign-in run on AWS in eu-west-1 (Ireland), which is covered by the UK's adequacy regulations for the EEA.
Where each provider listed in section 7 holds or processes personal data, and the basis for any transfer:
| Provider | Location | Transfer basis |
|---|---|---|
| Supabase (database, file storage and sign-in) | EU: AWS eu-west-1 (Ireland), the project's region | UK adequacy regulations for the EEA |
| Vercel Inc. | Our application runs in Ireland (EU). Each request first reaches Vercel's network at the location nearest to where it is sent from (for users in the UK, normally London), where the sign-in check runs before the request is passed on to Ireland. | UK International Data Transfer Addendum to the EU standard contractual clauses, incorporated in Vercel's data processing addendum; Vercel is also certified under the EU-US Data Privacy Framework |
| Anthropic PBC | United States | The UK Addendum to the EU standard contractual clauses, in Anthropic's data processing addendum |
| Resend, Inc. | United States (all stored data, per Resend) | Standard contractual clauses and the EU-US Data Privacy Framework with its UK Extension, under Resend's data processing addendum |
| Microsoft (Microsoft 365 mailbox) | United Kingdom | Not applicable - stored in the UK |
Where personal data is transferred outside the UK and EEA, we rely on the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU standard contractual clauses, or equivalent safeguards, as set out in each sub-processor's data processing terms.
9. How long we keep personal data
We keep personal data only as long as we need it for the purpose we collected it for, or as long as we are legally required to keep it.
- Active client data: kept for the duration of the engagement plus six years from the end of the calendar year in which the engagement ends, to satisfy UK statutory record-keeping obligations
- Prospective client communications: kept for up to two years from last contact, then deleted
- Purchasing Portal account data: kept for the duration of the account; deleted within 90 days of account closure, save for records we are required to retain
- Supplier contacts (our supplier directory, section 15): kept for as long as the company is a supplier we might reasonably invite to tender; contacts with no correspondence for three years are deleted; contacts at companies that have ceased trading are deleted
- Backups: our database is backed up daily and each backup is kept for seven days, so deleted data leaves our backups within seven days
- Client purchase data: returned or deleted within 90 days of the end of our agreement with the client, as set out in that agreement
10. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Have inaccurate data corrected
- Have your data erased (subject to our legal obligations)
- Restrict our processing
- Receive your data in a portable format
- Object to our processing on legitimate interests grounds
- Lodge a complaint with the Information Commissioner's Office (ico.org.uk)
To exercise any of these rights, email matt@parallelpurchasing.co.uk with the word Data Request in the subject line. We will respond within one month, as required by UK GDPR.
Where we process personal data as a data processor on behalf of a client, which applies to clients' purchase data (invoices, prices and spend), requests will normally need to be made to that client (the controller). We will support the client in fulfilling the request. Requests about our supplier directory or supplier contact details should come to us at matt@parallelpurchasing.co.uk.
11. Security
We use appropriate technical and organisational measures to protect personal data, including:
- TLS encryption in transit for all connections
- Encryption at rest for stored data, provided by our hosting provider
- Our database and files stored in Ireland; invoice documents are read by Anthropic in the United States (see section 8)
- Read-only access to clients' accounting systems, using only the purchase invoice data described in section 3
- Xero connection tokens held encrypted in Supabase Vault; other secrets held in our hosting platforms' secret stores
- Access to client data limited to authorised Parallel Purchasing personnel and the service providers in section 7; the application is password-protected, and individual logins in which each client sees only its own data are being introduced
- No direct client access to the database: the application reaches it only from our servers
- AI services used under terms that exclude training on the data we send
No system can be made completely secure. If a personal data breach occurs that affects you, we will notify you and the relevant authorities as required by UK GDPR.
12. Cookies and tracking
The Purchasing Portal uses only essential cookies required for authentication and session management. We do not use marketing or analytics cookies in the application.
If and when we operate a marketing website that uses cookies for analytics or other purposes, we will publish a separate cookie policy and request consent where required by the Privacy and Electronic Communications Regulations 2003 (PECR).
13. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top shows the most recent revision. Material changes will be communicated to active clients and registered users by email.
14. Complaints
If you have a concern about how we handle personal data, please contact us first at matt@parallelpurchasing.co.uk so we can try to resolve it.
You also have the right to complain to the UK Information Commissioner's Office:
- Website: ico.org.uk
- Helpline: 0303 123 1113
15. How we use supplier contact information
Who we are
Parallel Purchasing is a trading name of Dispatch Ltd, a company registered in England and Wales (company number 12639946), of 11 Station Road, Balsall Common, Coventry CV7 7FN. Dispatch Ltd is the controller of the supplier contact information described in this section.
Dispatch Ltd is the controller for the supplier directory described in this section. This is separate from the purchase data our clients provide to us (their invoices, prices and spend), for which Dispatch Ltd acts as a processor on the client's behalf, as described in section 4.
Dispatch Ltd is registered with the Information Commissioner's Office under registration number ZC260225.
Contact for data protection questions: matt@parallelpurchasing.co.uk
What we do
We are a procurement consultancy. We run tender exercises for food manufacturers and other SME clients, which means inviting suppliers to quote, comparing what comes back, and helping our clients decide who to buy from. To do that we keep a directory of suppliers and the people who work for them.
What information we hold about you
The personal data we hold about supplier staff is business contact information only:
- your name and job title
- the name of the company you work for
- your work email address, work telephone and mobile numbers
- your employer's business address, postcode and website
- a record that we have corresponded with you, including the dates of the first and most recent message and how many there have been
- where relevant, certifications or accreditations your company states publicly
We also hold commercial information about your company, such as quotes, prices and invoice history, which is not usually personal data. Quotes are kept in our email and with the records of the tender they relate to.
We do not keep the content of emails you have sent us in our supplier directory. We do not hold any information about your personal life, and we do not seek out information about you outside your professional role.
Where it came from
One of four places:
- Our correspondence with you. If you have emailed us, for example in response to a request for quotation, our systems read the signature block at the end of your message and record the business contact details in it.
- Quotes and correspondence you send us in response to a request for quotation.
- Your employer's public website, where we have looked up what a company supplies in order to categorise it correctly.
- Our clients' purchase records, where your company appears as a supplier they buy from.
Why we hold it, and our lawful basis
Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)). Our legitimate interest is running tender exercises competently: knowing which companies supply what, and having a named person to send an enquiry to rather than a generic inbox.
We have assessed this against your interests and rights and concluded that the processing is proportionate, because the information is business contact information you use in your working life, you provided most of it to us directly in a business context, and the use we make of it, inviting you to quote for business, is what you would reasonably expect.
You can object at any time; see section 10.
Who we share it with
This is the part suppliers care about. When we run a tender for a client, we tell that client which suppliers we are inviting and, where relevant, who the contact is. So your business contact details may be shared with the client whose tender you are being invited to quote for.
We do not sell supplier contact information, and we do not share it with anyone else for marketing.
Our systems are hosted by service providers who process data on our behalf, including Microsoft (email) and Supabase (database hosting).
How long we keep it
We keep supplier contact information for as long as the company is a supplier we might reasonably invite to tender. Where we have had no correspondence with a contact for three years, we delete that contact. Where a company has ceased trading, we mark the record and delete the contacts.
Your rights
You can ask us to:
- tell you what we hold about you
- correct anything that is wrong
- delete your details
- stop using your details, by objecting to our legitimate interests
Email matt@parallelpurchasing.co.uk with the word Data Request in the subject line and we will action it. Section 10 sets out the full list of your rights. If you ask us to delete your contact details, we will remove them and prevent them being re-added from future correspondence.
You can also complain to the Information Commissioner's Office at ico.org.uk.
Marketing
Requests for quotation are not marketing: they are business correspondence about a specific purchase. If we ever send supplier newsletters or promotional email, we will ask for your consent first where the law requires it.