Last updated: 21 October 2026
This policy explains what personal data Zatu Limited, trading as Zatu Distribution ("we", "us"), collects when you use distribution.zatu.com (the "Portal"), how we use it, where it is stored and how we protect it. The Portal is a trade-only wholesale service. It is used by businesses and by the people who act for them, so most of the personal data we hold is business contact data about trade account applicants, account holders and their colleagues.
We process your data to run your trade account, take and fulfil your orders and meet our legal obligations. We only use it for other purposes, such as marketing, where you have agreed or where we are otherwise permitted to do so. We share data with trusted partners such as Shopify, Storefeeder and Klaviyo so that we can provide the service. We will not share your data for third party advertising purposes.
Zatu Limited is the data controller of the personal data described in this policy. Our registered office and trading address is 40 Barnard Road, Bowthorpe Employment Area, Norwich, NR5 9JB, United Kingdom. Zatu Distribution is the wholesale arm of Zatu Limited.
You can contact us about this policy or about your data by email at [distribution email], by phone on [distribution phone], or by post at the address above. Data protection enquiries should be marked for the attention of the Data Protection Officer.
This policy applies to the Portal at distribution.zatu.com, the Shopify checkout it uses, the trade account application process, the emails we send you about your account and orders, and your dealings with our trade and customer service teams by email, phone or post. Together these are the "Services".
It applies to personal data: information that identifies you or could reasonably be used to identify you. Information about a company that does not identify a person (for example a company registration number on its own) is not personal data, but where it is held alongside details of named contacts we treat the whole record with the same care.
Our retail websites, including zatu.com, have their own privacy policy. If you also shop with us as a consumer, that policy applies to your retail account and orders.
The Portal is for businesses, sole traders and other organisations buying for resale or professional use. It is not intended for consumers or for anyone under the age of 18, and we do not knowingly collect personal data from children. When you apply for a trade account you confirm that you are at least 18 and authorised to act for the business you are applying on behalf of.
Depending on how you use the Services, we may collect:
Most of the data we hold comes directly from you or your colleagues: when you apply for a trade account, sign in, place an order, update your details or contact us. Some is created as you use the Services, such as your order history and sign-in records. We obtain credit information from credit reference agencies as described below, and Shopify shares order and payment status with us after checkout.
If you give us personal data about other people in your organisation, you confirm that you are authorised to do so and that you have made them aware of this policy.
We do not receive or store your full card details. Card payments are handled by Shopify's payment services, which hold your card information under their own privacy policy.
UK data protection law requires us to have a lawful basis for each use of your personal data. We rely on:
We do not make decisions about you using automated processing that has a legal or similarly significant effect on you. Decisions about trade account applications and payment terms are made by a member of our trade team.
Trade accounts may be offered payment terms. Before granting or extending credit terms, and periodically while you hold them, we may search the records of a credit reference agency about your business. If your business is a sole trader or partnership, that search may include information about you or your partners as individuals. The agency will keep a record of our search, which may be visible to other organisations that search your record. We use this information, together with your payment history with us, to decide what terms to offer and to manage the credit we extend. You can ask us which agency we used and how to contact them.
Your data is stored and processed on secure servers operated by our hosting providers in the UK and European Economic Area, and by Shopify and our other partners under the safeguards described below. Access is limited to staff who need it to do their jobs. We use encryption in transit, hashed passwords, access controls and regular backups, and we review our security measures as the Portal develops.
We keep your data only for as long as we need it:
Trade accounts belong to your business, not to you personally. Colleagues on the same trade account can see shared carts, order history, addresses and company settings. Please bear this in mind when adding details to shared parts of the account, and let us know if someone leaves your organisation so that we can remove their access.
Anything you choose to share with other businesses or on third party platforms is outside our control, and we are not responsible for how those parties use it.
The Portal may link to publisher websites, courier tracking pages, stockist sites and other third party services. Those sites have their own privacy policies and we are not responsible for how they handle your data, so please check them before providing any information.
We share your data with partners who help us run the Services. We provide each of them with the minimum data necessary, and they are only permitted to use it to provide services to us.
Some of these partners process data outside the UK. Where they do, we rely on the UK's adequacy regulations or on contractual safeguards approved under UK law, such as the International Data Transfer Agreement or Addendum.
We will also share your data with the police, HMRC or other authorities where we are required to by law, and with a buyer or successor if our business is sold or restructured.
The Portal uses cookies that are strictly necessary to keep you signed in, remember your settings (such as your display theme) and protect the site. Shopify sets its own cookies during checkout. We do not currently use analytics or advertising cookies on the Portal. If that changes we will update this policy and ask for your consent where required.
Under UK data protection law you have the right to:
To exercise any of these rights, contact us using the details below. We may need to confirm your identity before acting on a request, and we will respond within one month. Because trade accounts belong to a business, some records (such as invoices) must be kept even if an individual contact asks for their data to be deleted. In those cases we will remove the personal details we can and explain what we have kept and why.
We may update this policy to reflect changes to the Portal, our partners or the law. We will post the new version here with an updated date, and where the changes are significant we will tell you by email or through the Portal. Please check this page from time to time.
Zatu Limited (trading as Zatu Distribution), 40 Barnard Road, Bowthorpe Employment Area, Norwich, NR5 9JB, United Kingdom. Email: [distribution email]. Phone: [distribution phone].