1. Who we are
1.1 Tarlu Ltd (“Tarlu”, “we”, “us”) is a company registered in England and Wales, company number 10080954, with its registered office at 17 Factory Road, Poole, Dorset, BH16 5SN. We provide third-party logistics and fulfilment services.
1.2 For the personal information described in this notice, Tarlu is the data controller.
1.3 You can reach us by email at enquiries@tarlu.com, by phone on +44 (0) 330 223 2218 (Monday to Friday, 9am to 5pm), or by post at the address above. Please mark data protection enquiries for the attention of the Data Protection Lead.
2. What this notice covers
2.1 This notice explains what personal information we collect when you use www.tarlu.com, why we collect it, who we share it with, how long we keep it and what rights you have.
2.2 It does not cover the personal data we handle on behalf of our clients when we pick, pack and despatch their orders. Where we act on a client’s instructions we are a processor rather than a controller; see section 13.
2.3 This notice was last updated on 11 August 2026.
3. Information you give us through our forms
3.1 Contact form. The form on our contact page collects your company name, email address and message, which are required, and your first name, which is optional. We use these only to answer you.
3.2 Complaints form. Our complaints form collects your full name, company, email address, phone number, whether you are an existing client, the category of complaint, your description of what happened and the resolution you are looking for. We use these to investigate and respond.
3.3 Client mailing list. If you join our mailing list we collect your full name, company, email address and the topics you select. We also record that you consented and the date and time you did so, because we are required to evidence consent.
3.4 Submissions from these three forms are stored in our own administration system and are visible only to authorised Tarlu staff.
3.5 You can always contact us by email or phone instead of using a form.
4. The complete enquiry form
4.1 The longer enquiry form on our website is a Google Form, embedded from Google’s servers. If you complete it, your answers are submitted directly to Google and stored in Google Sheets on our behalf. They do not pass through our own website or database.
4.2 Simply opening the page that contains the form causes your browser to contact Google, which will receive your IP address and standard browser information even if you do not fill anything in.
4.3 If you would rather not use a Google service, email or call us and we will take the same details directly.
5. Information collected automatically
5.1 When you submit any form on this website we also record the IP address the submission came from and your browser’s user-agent string. We use these to detect and block automated abuse of our forms and to investigate submissions that appear fraudulent. We do not use them to build a profile of you.
5.2 Our hosting providers keep standard server logs, which include IP addresses, for security and diagnostics.
5.3 Fonts. Our pages load typefaces from Google Fonts. That request tells Google your IP address and basic browser details each time you load a page. We are reviewing whether to serve these fonts from our own servers so that this no longer happens.
5.4 This website does not use advertising trackers, social media pixels or any form of cross-site tracking.
6. Why we use your information, and our legal basis
6.1 To answer your enquiry or quote for work. Our legal basis is our legitimate interest in responding to people who contact us, and where relevant taking steps at your request before entering into a contract.
6.2 To investigate and resolve a complaint. Our legal basis is our legitimate interest in handling complaints properly, and compliance with our obligations to clients.
6.3 To send you mailing-list updates. Our legal basis is your consent, which you can withdraw at any time.
6.4 To measure how the website is used. Our legal basis is your consent, given through the banner shown on your first visit.
6.5 To keep our forms and systems secure. Our legal basis is our legitimate interest in preventing abuse, fraud and disruption of our services.
6.6 To meet our legal and accounting obligations. Our legal basis is compliance with a legal obligation.
7. Information stored on your device
7.1 This website does not use cookies.
7.2 It stores a single entry in your browser’s local storage, named tarlu_consent_v1, which records whether you accepted or declined optional analytics. It holds no identifier, nothing about you, and is never transmitted to us; it exists so that we do not ask you again on every page.
7.3 Clearing your browser’s site data for tarlu.com removes it, and the consent banner will appear again on your next visit.
8. Analytics
8.1 If you accept analytics, we load Plausible Analytics to count page views and see which pages are useful. Plausible does not use cookies, does not collect personal data that identifies you, and does not track you across other websites.
8.2 If you decline, no analytics script is loaded at all. Declining does not limit your use of the site in any way.
9. Who we share your information with
9.1 We use the following service providers, who process information on our instructions and are not permitted to use it for their own purposes: Hostinger (website hosting), Vercel (hosting for our administration system), Supabase (database), Google (the complete enquiry form, and web fonts) and Plausible (analytics, only where you have accepted).
9.2 We may also share information with our professional advisers, insurers and auditors where they need it, and with regulators or law enforcement where we are legally required to do so.
9.3 We do not sell your personal information, and we do not share it for third-party advertising.
10. Transfers outside the UK
10.1 Some of the providers listed above process information outside the United Kingdom. Where that happens we rely either on UK adequacy regulations for the country concerned, or on the International Data Transfer Agreement or the UK Addendum to the European Commission’s standard contractual clauses.
10.2 You may ask us for details of the safeguards that apply to a particular transfer.
11. How long we keep your information
11.1 Enquiries. Up to 24 months after our last contact with you, unless you go on to become a client, in which case your information is retained under our client contract.
11.2 Complaints. Six years from the date the complaint is closed, so that we have a record if it is revisited.
11.3 Mailing list. Until you unsubscribe. We then keep a minimal record of your withdrawal so that we do not contact you again by mistake.
11.4 IP addresses and user-agent strings. Up to 12 months, after which they are deleted from form submissions.
11.5 We delete or anonymise information once it is no longer needed for the purpose we collected it for.
12. Keeping your information secure
12.1 Everything you send us through this website travels over an encrypted HTTPS connection.
12.2 Access to submitted information is restricted to authorised Tarlu staff, who sign in to our administration system with individual accounts and are granted only the permissions their role requires.
12.3 If a breach occurs that is likely to affect your rights, we will notify the Information Commissioner’s Office, and you, as required by law.
13. Personal data we handle for our clients
13.1 In the course of fulfilling orders we handle personal data belonging to our clients’ customers, such as recipient names, delivery addresses, telephone numbers and email addresses. For that data our client is the controller and Tarlu is the processor: we act only on their documented instructions.
13.2 If you are a customer of a brand that Tarlu ships for and you want to exercise your rights over that data, please contact the brand directly, as they decide how it is used. If you contact us we will pass your request to them.
13.3 The terms on which we process that data are set out in the data-processing schedule of our terms and conditions.
14. Your rights
14.1 You have the right to ask us for a copy of the personal information we hold about you; to have inaccurate information corrected; to have information erased; to restrict how we use it; to object to our use of it where we rely on legitimate interests; and to receive it in a portable format where it was provided by you and we rely on consent or contract.
14.2 Where we rely on your consent, you may withdraw it at any time. That does not affect anything we did before you withdrew it.
14.3 To exercise any of these rights, email enquiries@tarlu.com. We will respond within one month, and will tell you if we need longer because the request is complex.
14.4 We do not make any decisions about you by automated means, and we do not carry out profiling.
15. Complaints
15.1 If you are unhappy with how we have handled your personal information, please tell us first so that we can put it right.
15.2 You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at ico.org.uk/make-a-complaint or on 0303 123 1113. Complaining to us first does not affect that right.
16. Changes to this notice
16.1 We may update this notice when our practices or the law change. The date in section 2 shows when it was last revised, and the current version is always the one published here.
16.2 If a change materially affects how we use information you have already given us, we will take reasonable steps to tell you.