The short version
- We collect business details you give us, plus basic technical data when you use the site.
- We use it to run accounts, match requirements, manage trades, deliver paid services and keep the platform secure.
- We share information only with service providers that help us run Shelrock, and with trade counterparties on a need-to-know basis.
- We never sell personal data or share it with advertisers.
- You can ask to see, correct or delete your information at any time.
01Who we are
Shelrock is the digital sourcing, trade-intelligence and managed-trade service of Shim International Import Export Co. (“SIIECO”), with a team in London, United Kingdom and an operations team in India. For this policy, Shelrock is the controller (under UK GDPR) and data fiduciary (under India's Digital Personal Data Protection Act 2023) of the personal data described here.
Privacy questions and requests: info@shelrock.com (subject: “Privacy request”) or the Contact page.
02What we collect
| Category | Examples |
|---|---|
| Identity & contact | Name, job title, company, business email, phone or WhatsApp number. |
| Account | Login email, hashed password, account type (buyer or supplier), sign-in and security records. |
| Buyer requirements | Products, specifications, quantities, packing, destination, timing and commercial preferences. |
| Supplier information | Company and registration details, products, capacity, certifications, test reports, product photos and documents. |
| Trade records | Quotations, orders, milestones, documents, claims and correspondence linked to a trade. |
| Payments | Order reference, amount, status and billing details. Card details are handled by our payment provider, not stored by Shelrock. |
| Messages & AI chats | Contact form messages and text you type into Shelrock AI. |
| Technical & usage | IP address, device and browser type, pages viewed, approximate location and diagnostic logs. |
We do not ask for sensitive personal data (such as health, religion or political views), and please don't send it to us.
03Where it comes from
- From you: when you register, fill in a form, submit a requirement or listing, pay, chat with Shelrock AI or email us.
- From your use of the site: through cookies, analytics and server logs.
- From public sources: UK government trade statistics (HMRC UK Trade Info), company registers (such as Companies House) and companies' own public websites. We use these for buyer intelligence and supplier verification.
- From service providers: for example, payment confirmations from our payment provider.
04How we use it, and our lawful bases
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Create and run your account, and let you sign in | Contract |
| Match buyer requirements with verified suppliers, and negotiate and manage trades | Contract; legitimate interests |
| Verify suppliers and screen listings and photos | Legitimate interests (a trustworthy marketplace) |
| Deliver paid services (reports, UK-Ready Pack, plans) and take payment | Contract |
| Answer enquiries and support requests | Legitimate interests; contract where relevant |
| Enforce our Terms, including confidentiality and non-circumvention | Legitimate interests; legal claims |
| Security, fraud prevention and platform improvement | Legitimate interests |
| Analytics cookies | Consent where required; legitimate interests otherwise |
| Tax, accounting and legal obligations | Legal obligation |
Under India's DPDP Act, we process personal data for the specified purposes you provide it for, and for legitimate uses permitted by the Act.
05Buyer intelligence reports and business contact data
Our Find Buyers service builds reports on UK importers from public sources, such as HMRC trade data, company registers and company websites. These reports may include business names, addresses, websites and role-based business contact details (for example, procurement@company.com). We do this on the basis of legitimate interests in supporting business-to-business trade.
Customers who buy these reports may use them only for their own internal business use, under our Terms. If your business appears in a report and you would like it removed, or you object to this use, email info@shelrock.com and we will act on your request.
06Shelrock AI and automated checks
When you use Shelrock AI, your messages and the related sourcing context are processed to understand your request and help structure it. We use AI service providers for this and for researching public business information for reports.
When suppliers upload product photos, the photo is checked for company or brand names. Part of this check runs in your own browser, and our server also checks the text stored inside the image file.
We do not make decisions with legal or similarly significant effects about you based solely on automated processing. Supplier approval, lead allocation and badges are reviewed by people.
07Who we share information with
| Recipient | Why |
|---|---|
| Hosting and infrastructure providers | To run the website, accounts and databases. |
| Google Analytics | To understand site traffic and usage. |
| Payment provider (Razorpay) | To process payments securely. |
| Email delivery provider (Resend) | To send account emails, reports and notifications. |
| AI service providers (such as OpenAI) | To power Shelrock AI and research public business information. |
| Content delivery network (jsDelivr) | To load the photo-check tool that runs in your browser. |
| Trade counterparties | Only what a trade needs, when it needs it. For example, a buyer's requirement is shared with shortlisted suppliers, and supplier identities stay behind Supplier IDs until a deal needs more. |
| Logistics, inspection and trade-service partners | To carry out an agreed trade. |
| Professional advisers and authorities | Where required by law, or to protect our rights, including enforcement of our Terms. |
We never sell personal data and do not share it with advertisers. If Shelrock is reorganised or sold, information may transfer to the new owner under the same protections.
08International transfers
Shelrock operates between the UK and India, and some of our service providers are based in other countries, including the United States. Where personal data leaves the UK, we use safeguards recognised under UK law, such as adequacy regulations or the UK International Data Transfer Agreement or Addendum. We also only transfer data where Indian law permits.
09How long we keep it
| Information | Typical retention |
|---|---|
| Account data | While your account is open, then up to 2 years. |
| Trade records, quotations and invoices | Up to 7 years, for tax, legal and dispute purposes. |
| Records needed to enforce non-circumvention | For the protection period plus 2 years. |
| Contact form messages | Up to 2 years after the last reply. |
| Analytics data | As set in our analytics settings, usually up to 14 months. |
10Security
We use technical and organisational measures to protect information, including encrypted connections, hashed passwords, access controls, and restricted access to data folders and admin tools. No online service is completely secure, so please keep your password private and tell us straight away if you suspect misuse.
11Your rights
Depending on where you are, you have the right to:
- Access: ask for a copy of your personal data.
- Correction: fix inaccurate or incomplete data.
- Erasure: ask us to delete data, unless we must keep it, for example for trade records or legal claims.
- Restriction and objection: including to processing based on legitimate interests and to direct marketing.
- Portability: receive data you gave us in a usable format.
- Withdraw consent: where we rely on it.
- Grievance redressal and nomination: under India's DPDP Act.
To make a request, email info@shelrock.com from the business email linked to your account. We may need to confirm your identity.
If you are in the UK and unhappy with our response, you can complain to the Information Commissioner's Office (ico.org.uk). In India, you may approach the Data Protection Board of India once you have used our grievance process.
12Cookies and analytics
We use essential cookies and browser storage to keep you signed in, remember preferences and saved products, and protect forms. We also use Google Analytics cookies to understand how the site is used. You can block or delete cookies in your browser settings, but some features may not work without essential storage.
13Business communications
We may send account holders service emails about their account, trades, reports and programme progress. Where the law allows, we may also send occasional B2B updates about relevant Shelrock services. You can opt out of non-essential emails at any time using the link in the email or by contacting us.
14Children
Shelrock is a business service for people aged 18 and over. We do not knowingly collect data from children.
15Changes and contact
We may update this policy as Shelrock develops. The latest version is always on this page with its update date, and material changes will be notified to account holders.
Contact: info@shelrock.com · Contact page · Terms of Use