Privacy policy: Despatch Sync for Click & Drop

Publisher: GPT Shop Ltd, a company registered in England and Wales (company number 15766335). Registered office: Goodison Middleton, Winterslow, Salisbury SP5 1QR, United Kingdom.

Contact and support: hello@gptshopltd.com · Despatch Sync home

Last updated: 17 October 2026

This app is an unofficial integration. It is not made, endorsed or supported by Royal Mail Group.

What the app does

It sends your Shopify orders to your Royal Mail Click & Drop account, and writes the tracking numbers back to Shopify as fulfilments.

Data we access

From your store, through Shopify's API, we read:

• Orders: order number, dates, totals, tax, shipping charge, line items (title, SKU, quantity, price) and notes.
• Customer delivery details on those orders: name, company, address, phone and email.
• Product shipping data: weight, HS code and country of origin.

From your Click & Drop account we read order status, despatch date and tracking numbers.

Shopify permissions the app asks for: read_orders (to read paid orders), read_products (for weights and customs data), and read and write merchant-managed fulfillment orders (to create the fulfilment and add the tracking number).

Data we store

• Your shop domain, your app settings, and your Click & Drop API key. The key is encrypted at rest with AES-256-GCM.
• One sync record per order: Shopify order ID, order number, Click & Drop order ID, tracking number, status and any error text.
• A sync log of events, for example "Order 1001 sent to Click & Drop".
• The Shopify session tokens the app needs to run.
• An access log entry each time the app reads an order's customer details to send it to Click & Drop: Shopify order ID, order number, which fields were read and why. It does not contain the details themselves.

We do not store customer names, addresses, phone numbers or email addresses. They are passed directly from Shopify to Click & Drop when an order is sent, and are not written to our database.

Why we use it (legal basis)

We process this data only to provide the service you install, which is performance of our contract with you. For your customers' data, you are the controller and GPT Shop Ltd is your processor. Royal Mail processes the data you send to Click & Drop under its own terms.

Sharing

• Royal Mail Group Ltd (Click & Drop): the order and delivery details needed to create a shipment.
• Our hosting and database providers (sub-processors). The database holding the data listed above is in the UK (London). Requests are handled on our hosting provider's global network, so data in transit may be processed outside the UK; where it is, we rely on safeguards recognised under UK data protection law.

We never sell data, and we never use it for advertising or analytics profiling.

Retention

• Sync log entries are deleted after 180 days.
• Sync records for orders that are fulfilled, skipped or in error are deleted 180 days after their last update. Records for orders still waiting to be sent or waiting for tracking are kept until the order completes, or until your shop's data is deleted.
• Customer-data access log entries are deleted after 30 days.
• When you uninstall the app, we delete your session and your stored Click & Drop API key straight away and stop all syncing.
• All data for your shop is deleted within 48 hours of Shopify's shop/redact notice, which Shopify sends 48 hours after you uninstall.
• When Shopify sends a customers/redact request, we delete the sync records, sync log entries and access log entries for that customer's orders.
• When Shopify sends a customers/data_request, nothing extra is collected. We hold no customer names, addresses, phone numbers or email addresses, so on request we tell you, the merchant, what we hold for the orders listed: Shopify order ID, order number, Click & Drop order ID, tracking number and sync status.

Security

• All traffic is encrypted with TLS.
• API keys are encrypted at rest.
• Access to production systems is limited to the publisher.

Your rights

Under UK GDPR you can ask for access to your data, correction, deletion, restriction or portability, and you can object to processing. Email hello@gptshopltd.com. You can also complain to the Information Commissioner's Office (ico.org.uk).

Changes

We will post any changes on this page and update the date above.