Privacy Policy

1. Who we are

BeeSeen Labs Ltd (company number 16455267), trading as ReturnKits ("ReturnKits", "we", "us", "our"), provides managed IT hardware recovery, employee offboarding logistics, and data-wipe/redeployment services for businesses. This policy explains what personal data we collect, why, and how we handle it — for our business customers, their employees whose devices we help recover, and visitors to this site.

2. What data we collect

• Account data: name, work email, company name, billing address and phone number, provided when you register for a ReturnKits account.
• Order data: kit type, device reference (asset tag or serial number), and the shipping and return addresses you provide when booking a return kit.
• Recipient data: the name, email and delivery address of the person receiving or returning a kit — who may be an employee, contractor, or care recipient, not necessarily the account holder.
• Payment data: processed directly by Stripe. We never see or store full card numbers; we retain a Stripe customer/session reference only.
• Device custody data: for wipe and redeploy services, we log dispatch, receipt, storage, wipe method, wipe date, and (where applicable) a wipe certificate.
• Tracking data: courier tracking numbers and delivery status from our shipping partners.
• Usage data: standard technical data such as IP address, browser type, and pages visited.

3. Why we process this data

• To fulfil return kit orders: packaging, dispatch, courier handoff, and delivery confirmation.
• To process payment for kits and optional insurance via Stripe.
• To provide chain-of-custody records and, where purchased, certified data wiping and device redeployment.
• To communicate order status, including dispatch, delivery, and any delays or issues.
• To operate customer accounts and the company portal.
• To maintain business records for accounting, fraud prevention, and legal compliance.
• To improve the service and, where you've agreed to be contacted, for sales and marketing communications.

4. Who we share data with

We share personal data only where necessary to deliver the service:

• Stripe, for payment processing.
• Courier and shipping partners (e.g. Royal Mail, Sendcloud), to dispatch kits and process returns.
• Cloudflare, for bot protection (Turnstile) on our forms.
• HubSpot, as our CRM, for managing customer and prospect relationships.
• Google Analytics (GA4), for website usage analytics — only loaded if you accept analytics cookies.
• Lovable, our application development platform, which we use to build and run our customer portal.
• Supabase, our database provider, which stores account and order data on our behalf.
• Retool, used internally by our team to manage orders, support customers, and administer the service.
• Sentry, for error monitoring and diagnostics to help us maintain and troubleshoot the service.

5. International data transfers

Some of the providers listed above may store or process personal data outside the UK, including in the United States. Where this happens, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or the UK International Data Transfer Addendum, or that the transfer is made to a country covered by UK adequacy regulations. You can contact us for more information about the safeguards used for a specific transfer.

6. Data retention

We retain order and custody records for as long as needed to meet contractual, accounting, and legal obligations — typically 6 years for financial records, in line with UK requirements. Wipe certificates and custody logs are retained for the period agreed with the relevant business customer. You can ask us to delete account data that is no longer needed for these purposes at any time.

7. Your rights

If you are in the UK or EU, you have rights under UK GDPR / the GDPR, including the right to access, correct, or request deletion of your personal data, to object to or restrict certain processing, and to data portability. To exercise any of these rights, contact us using the details below. If you are not satisfied with our response, you can complain to the UK Information Commissioner's Office (ico.org.uk).

8. Security

We use industry-standard safeguards to protect personal data, including encrypted connections (HTTPS), access controls on internal systems, and role-based permissions so that customer data is only visible to the account it belongs to. Device data wiping, where purchased, follows the NIST 800-88 standard.

9. Cookies

We use a small number of strictly necessary cookies to run our site and portal — including keeping you logged in and Cloudflare Turnstile for spam and bot protection on our forms — and these don't require consent. With your permission, we also use Google Analytics (GA4) to understand how our marketing site is used, and HubSpot to support our marketing and follow-up with prospective customers. You'll see a cookie banner on your first visit to returnkits.com letting you accept all, reject all non-essential cookies, or choose which categories to allow. You can change your choice at any time using the "Cookie Preferences" link in the footer.

10. Children's data

ReturnKits is a business-to-business service and is not directed at children. We do not knowingly collect personal data from anyone under 16.

11. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by an updated "last modified" date at the top of this page.

12. Contact us

For any questions about this policy or your personal data, contact us at privacy@returnkits.com.