Privacy policy

Last updated August 2026. This policy explains what we collect and why, under UK GDPR and the Data Protection Act 2018.

Who we are

Undercover Genius Ltd (14013075), 2nd Floor College House, 17 King Edwards Road, Ruislip, London HA4 7AE, is the data controller. Contact: jay@packagingmarketplace.co.uk.

What we collect

Outbound click logs (server-side): which product and supplier you clicked, timestamps, the page you came from, your search dimensions and quantity, a first-party session cookie ID, any UTM tags or Google click ID, and a hashed (not readable) version of your browser's user agent. No name, email or payment data.
Visitor analytics: Hitsteps realtime web statistics runs on every page (always on) to measure traffic; it does not identify you. Google Analytics 4 / Google Tag Manager and, when enabled, a Meta Pixel run only after you accept analytics cookies.
We do not offer accounts and we never take payment on this site.

Why (lawful bases)

Click measurement: our legitimate interest in understanding which suppliers we send traffic to and improving the service. The data is aggregate and does not identify you.
Analytics and advertising cookies: your consent, given through the cookie banner. You can withdraw it at any time.

Retention

Click logs are kept while they are useful for supplier reporting and then aggregated or deleted. Analytics retention follows Google's settings.

Who we share with

Hitsteps (realtime visitor statistics, always on), Google (analytics), Meta (pixel, when enabled), and our affiliate networks and their advertisers, who may set a cookie when you click through to a supplier. We do not sell personal data.

International transfers

Some processors (Google, Meta) may transfer data outside the UK under appropriate safeguards such as the UK addendum to the EU Standard Contractual Clauses.

Your rights

You can ask for access, correction, deletion, or object to processing based on legitimate interest. Email jay@packagingmarketplace.co.uk. You can also complain to the Information Commissioner's Office at ico.org.uk.

Email alerts and newsletter

When you set up a price watch or subscribe to our newsletter, we collect your email address and the box sizes you ask us to watch. Price alerts are the service you request; the monthly newsletter is a separate opt-in you can withdraw at any time without affecting your alerts. We use a transactional email provider (for confirmations and alerts) and MailerLite (for the newsletter) as data processors. We keep unconfirmed signups for 7 days and inactive watches for up to 24 months before deletion. You can manage or delete everything from the link in any email we send you. Alert emails may contain affiliate links, in line with our disclosure.