Privacy Policy

Trade Toucan Limited, trading as Toucan Ecommerce (“Toucan”, “we”, “us”), is a specialist Amazon and TikTok Shop agency registered in England and Wales under company number 11237628, with its registered office at 30 Colleton Drive, Twyford, Reading, England, RG10 0AX. Our global head office is at Ariel Way, London W12 7GF, United Kingdom, and we have teams in Miami, Mexico City, Toronto and Melbourne.

For everything described in this policy we are the data controller: we decide what personal information is collected through this website and what happens to it. Where we work inside a client’s Amazon, TikTok Shop or advertising account we act as a processor on that client’s instructions instead — see Client accounts.

You can reach us about anything in this policy at hello@toucanecommerce.com or +44 20 4634 7185.

Information you give us

• The contact form. Your name and email address, which are required, plus your company and phone number if you choose to add them, and whatever you write in the message field.
• Email, phone and LinkedIn. Anything you send us when you get in touch directly, including the contents of the conversation that follows.
• Events and webinars. Registration for Toucan Talks and our webinars is handled on the event platform used for that session. We receive the name, email address, company and job title you gave at sign-up, and whether you attended.
• Job applications. Your CV and covering note, and anything else you send us as part of applying.

Information collected automatically

Our hosting provider records standard server and CDN logs when you load a page: IP address, browser and device user-agent, the pages requested, timestamps and the referring URL. We use these to keep the site available, diagnose faults and block abuse, not to build a profile of you.

If you accept analytics or marketing cookies, Google Analytics also records how you move around the site — pages viewed, time on page, approximate location from a truncated IP address, and the campaign or search that brought you here. Nothing Google-owned loads until you say yes, and you can say no or change your mind at any time. See Cookies below.

Information we do not collect

We take no payments through this website, so we never ask for card or bank details here. We do not ask for special category data (such as health, ethnicity or religious belief), and you should not send it to us through the contact form.

We put cookies into three groups, and only the first is on by default:

• Strictly necessary. Needed to serve the site securely and to remember your cookie choice. Under the UK PECR rules these do not require consent, and they cannot be switched off.
• Analytics. Google Analytics, so we can see which pages people actually read and fix the ones they abandon.
• Marketing. Lets us measure which campaigns bring brands to the site, and show relevant Toucan ads to people who have visited before.

Analytics and marketing cookies load only if you accept them. Nothing Google-owned is fetched before you choose: we do not load the tag and then hold it back, we simply do not load it. If you later withdraw a category, we clear the cookies it set and reload the page so the withdrawal actually takes effect.

Your choice is stored for six months in a first-party cookie called toucan_consent, then we ask again. Change it whenever you like from the Cookie preferences link at the bottom of any page, or block and delete cookies through your browser settings.

Our cookie policy lists every individual cookie, what it does and how long it lasts.

Under UK GDPR we need a lawful basis for every use of your personal information. This is ours, purpose by purpose.

Where we rely on legitimate interests we have weighed those interests against your rights and freedoms. You can object to any of it — see Your rights.

We do not make decisions about you by automated means alone, and we do not profile you.

We do not sell your personal information, and we never have. We share it only with the following, and only as far as each needs it:

• Our website host (Vercel), which serves this site and holds the server logs described above.
• Our email and productivity provider (Google Workspace), where enquiries, documents and notes are stored.
• Google, for analytics and advertising measurement, but only where you have accepted those cookies.
• Our CRM and email marketing tools, which hold business contact records and send marketing email you have opted into.
• Event and webinar platforms, for the sessions you register for.
• Professional advisers — accountants, auditors, insurers and lawyers — where they need it to advise us.
• Regulators, courts and law enforcement, where we are legally required to disclose.

Every supplier acting on our behalf is bound by a written contract that limits them to processing your information on our instructions, keeping it secure, and returning or deleting it when the work ends.

Several of the providers above, Google among them, are US-based, and our own teams in Miami, Mexico City, Toronto and Melbourne may see enquiries relevant to their market. Where personal information leaves the UK or EEA we rely on one of the following safeguards:

• UK adequacy regulations, where the destination country has been found to offer equivalent protection; or
• the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, together with a transfer risk assessment.

Email us at hello@toucanecommerce.com if you would like details of the safeguard used for a particular transfer.

We keep personal information only as long as we need it for the purpose we collected it for, then delete it or anonymise it. How long that is depends on what the information is, so rather than quote one figure, these are the criteria we apply:

• what we collected it for, and whether that purpose is still live;
• whether we still have a relationship with you, or a realistic prospect of one;
• how long the law requires us to keep it, since contract, tax and employment records carry minimum periods that are set for us rather than chosen by us;
• whether we still need it to defend a legal claim or to show a regulator what we did;
• the risk of holding it at all, and whether an anonymised version would do the same job.

You can ask us at any time how long we expect to hold something of yours, or ask us to delete it sooner — see Your rights.

Under UK and EU data protection law you have the right to ask us to:

• Give you a copy of the personal information we hold about you, and tell you how we use it.
• Correct it if it is wrong or incomplete.
• Delete it, where we no longer have a good reason to keep it.
• Restrict how we use it while a question about it is being resolved.
• Stop using it where we rely on legitimate interests. If you object to direct marketing we must stop, with no balancing test.
• Port it to you or another provider in a machine-readable format, where we rely on consent or contract.
• Withdraw your consent at any time, where consent is what we relied on. This does not affect anything we did before you withdrew it.

To exercise any of these, email hello@toucanecommerce.com. It is free, and we will respond within one month. We may ask you to confirm your identity first, so that we do not hand your information to someone else.

We do not sell your personal information. We do share advertising measurement data with Google where you have accepted marketing cookies, which some US state privacy laws would treat as “sharing” or “targeted advertising”. That is the only such sharing this site does, and it never happens unless you have opted in first.

To opt out, open Cookie preferences at the bottom of any page and turn Marketing off, or choose Reject all. We will clear the cookies already set and stop. You can also refuse everything outright when the banner first appears — rejecting is exactly as easy as accepting, and costs you nothing on the site.

Every marketing email we send carries an unsubscribe link, and it works immediately. You can also email hello@toucanecommerce.com and ask to come off the list.

A large part of our work is running Amazon, TikTok Shop and advertising accounts on behalf of client brands. Where we handle personal information inside those accounts we do so as a processor, on the client’s documented instructions and under a data processing agreement. The brand is the controller, and its own privacy notice governs how shopper data is used.

If you are a shopper who bought from one of our clients and you want to exercise your rights, contact that brand. We will support them in answering you, but we cannot act on their data without their instruction.

Where we analyse advertising performance in Amazon Marketing Cloud, the signal is pseudonymised by Amazon before we see it: identifiers such as name, email and phone number are replaced with a code, and we do not receive shopper identities.

We use encryption in transit (HTTPS across the whole site), multi-factor authentication on our business systems, and least-privilege access so that people can reach only the information their role needs. Access is reviewed when someone changes role or leaves, and everyone is trained on handling personal and client data.

No system is perfectly secure. If a breach ever affected your personal information and posed a risk to your rights, we would notify the ICO within 72 hours and tell you directly where the law requires it.

This is a business-to-business website aimed at brands and the people who work for them. It is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe a child has sent us their details, email hello@toucanecommerce.com and we will delete it.

We update this policy when our practices change or the law does. The date at the top of the page always shows when it was last revised, and we will tell affected people directly if a change materially affects how we use information we already hold.

If something here concerns you, please tell us first — hello@toucanecommerce.com reaches the people who can fix it, and we would rather resolve it with you directly.

You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office, at any time:

• ico.org.uk/make-a-complaint
• 0303 123 1113
• Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

If you are in the EEA, you can complain to the supervisory authority in the country where you live or work instead.