Internal Data Protection Policy

As of 4 November 2026

This internal policy sets out how Techno Tronics Limited (trading as ZYBUX) protects personal data processed through its systems, including ZYBUX-OMS, ZYBUX Stock, and ZYBUX AI.

Purpose and scope

This policy sets out how Techno Tronics Limited (trading as ZYBUX) protects personal data internally, across the systems used to run the business: ZYBUX-OMS (order and inventory management), ZYBUX Stock (warehouse pick/pack/inventory app), and ZYBUX AI (marketplace advisor service). It applies to all staff with access to these systems.

Personal data we process

We process customer order data (name, delivery/billing address, email, phone, order reference) received from our own website and from marketplace integrations (Amazon, eBay, Shopify, Temu, Shein, AliExpress, TikTok Shop), plus staff account data (login credentials, role, activity logs) needed to operate our systems securely.

Roles and responsibilities

Jatinder Singh Bajaj, as owner of Techno Tronics Limited, is responsible for this policy and for data protection decisions across the business. Staff with system access are granted only the permissions needed for their role (e.g. pickers/packers do not see full order or customer data beyond what's needed to fulfil an order), and access is reviewed when staff join, change role, or leave.

Technical and organisational measures

Personal data (PII) held in our systems is encrypted at rest using Fernet symmetric encryption (AES-128-CBC with HMAC-SHA256 authentication). Encryption keys are managed per machine via Windows DPAPI (Data Protection API), so keys are never stored in plaintext alongside the data they protect. Systems require individual staff logins; access to customer and order data is limited to what each role needs.

Retention and deletion

Order and transaction records are retained for 6 years (72 months) to meet UK VAT record-keeping rules (Value Added Tax Regulations 1995) and the Companies Act 2006's accounting-records requirement. Data is not kept beyond this period except where a longer legal requirement applies. Daily encrypted backups are taken of system data, stored separately from the live database.

Incident response procedure

If a security incident involving personal data is identified, we follow a four-step process: (1) Detect — unusual access patterns or data integrity issues are flagged through system logging; (2) Contain — affected credentials or access are revoked and suspended; (3) Notify — affected marketplaces and, where required, the ICO and affected individuals are notified within the legally required timeframe (marketplace partners are notified within 24 hours of confirming an incident); (4) Remediate — the root cause is fixed, affected data is reviewed, and the incident is documented.

Handling data subject rights requests

Any request from a customer to access, correct, delete, or restrict use of their personal data (including requests relayed to us by a marketplace partner) is directed to info@zybux.co.uk and handled personally by Jatinder Singh Bajaj, who confirms the requester's identity, locates the relevant data across our systems, and responds within one month as required by UK GDPR.

Policy review

This policy is reviewed at least annually, and whenever we add a new sales channel, system, or data processor, to ensure it reflects how personal data is actually handled. See also our Privacy Policy.