Privacy Policy

Suply Ltd ("Suply", "we", "us") is a cold chain intelligence company registered in England and Wales. We operate the Suply platform and related services that provide temperature monitoring and evidence records for exporters and logistics operators.

For the purposes of UK GDPR and the Data Protection Act 2018, Suply Ltd is the Data Controller in respect of the personal data described in this policy.

Our contact details: privacy@suply.ai · Suply Ltd, London, United Kingdom.

Account and contact data: Name, work email address, company name, job title, and telephone number when you create an account or contact us.

Shipment and mission data: Cargo type, route, carrier, consignment reference, and shipment parameters you configure in the platform.

Device telemetry data: Temperature and humidity readings captured by Suply Devices, together with timestamps, location inferences from network checkpoints, and device identifiers.

Platform usage data: Log data, feature usage, report access, and session information collected when you use the platform.

Communications data: Content of emails and support conversations you have with us.

Financial data: Billing address and payment reference (we do not store card numbers — payments are processed by our payment provider).

We use the data we collect to:

• Provide, operate, and improve the Suply Service, including generating shipment reports and evidence records.
• Manage your account, process orders, and handle billing.
• Send transactional communications (report delivery, alerts, invoices).
• Provide customer support and respond to enquiries.
• Send product updates and relevant commercial communications where you have consented or where we have a legitimate interest in doing so.
• Detect and prevent fraud, abuse, or security incidents.
• Comply with our legal obligations, including record-keeping requirements.
• Conduct anonymised analytics to understand platform usage and improve our product.

Contract performance: Processing your account data, shipment data, and device telemetry is necessary to deliver the Service you have contracted with us for.

Legitimate interests: We process platform usage data and certain communications data on the basis of our legitimate interests in operating a secure, reliable service and in understanding how customers use our product. We have assessed that these interests are not overridden by your privacy rights.

Consent: Where we send marketing communications to individuals who are not existing customers, we rely on your consent. You can withdraw consent at any time by clicking "unsubscribe" or contacting us.

Legal obligation: We retain certain financial and contract records to comply with applicable law.

We share your data only where necessary:

• Authorised Parties you invite to view your shipment records (importers, surveyors, insurers, brokers, 3PLs). You control this sharing via the platform.
• Cloud infrastructure and hosting providers (data processed under Data Processing Agreements).
• Payment processors for billing.
• Email and communications platforms for transactional and support communications.
• Analytics tools (using anonymised or pseudonymised data).
• Law enforcement or regulatory authorities where required by law.

We do not sell your personal data to third parties. We do not share Customer Data with advertisers.

Suply is based in the United Kingdom. Some of our service providers are located outside the UK and EEA. Where we transfer personal data internationally, we ensure appropriate safeguards are in place, such as UK International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses.

You may request details of the safeguards we rely on for specific transfers by contacting us at privacy@suply.ai.

Active accounts: We retain your data for as long as your account remains active.

Shipment and device data: We retain shipment records for 7 years from the date of the shipment to support potential insurance and trade claims, which can arise years after delivery.

After termination: Following account closure, we retain data for 12 months to allow for data export requests, then delete it subject to any mandatory legal retention obligations.

Marketing data: We retain marketing preferences and suppression records for up to 3 years after your last interaction with us.

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data where we no longer have a lawful basis to retain it.
• Restriction — ask us to restrict processing of your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format where processing is based on consent or contract.
• Object — object to processing based on legitimate interests, including profiling.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at privacy@suply.ai. We will respond within one month. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

We implement technical and organisational security measures appropriate to the risk, including encryption of data in transit and at rest, access controls, and regular security assessments.

No system is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO as required by law.

We use cookies and similar technologies on our website. For details, please see our Cookie Policy.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or via the platform. The effective date at the top of this page will always reflect the latest version.

We encourage you to review this policy periodically.

For any questions, requests, or concerns about how we handle your personal data:

Suply Ltd
London, United Kingdom
privacy@suply.ai