Privacy Policy
The DWI Group Trade Ordering app and website (the “Service”) let approved trade customers of Direct Wholesale and Investment Group Ltd (“DWI Group”, “we”) place wholesale orders on account. DWI Group is the data controller. The Service is built and operated on our behalf by BespokeWorks AI Ltd, acting as a data processor under a written agreement.
Accounts are created by DWI Group for approved trade businesses. There is no public signup and no way to register from within the app.
What we collect
- Account details — your name, work email address, and the venue or business your account belongs to.
- Order data — the products, quantities, prices, order notes and dates on orders you place, and your order history.
- Messages — anything you write to us through the in-app message thread.
- Device push token — if you turn on notifications, a token identifying your device, together with whether it is an iOS or Android device, used solely to send you updates about your own orders.
What we do not collect
- No payment details. Customers pay on account by invoice. The app never takes a payment and holds no card data.
- No tracking or advertising. There are no advertising identifiers, no analytics or tracking SDKs, and no third-party trackers in the app or on the website. We do not sell personal data or share it for advertising.
- No location, contacts, photos, camera or microphone access. The app does not ask for any of these and cannot upload files.
- Crash information stays on your device. If the app closes unexpectedly it writes a diagnostic file locally so a fault can be described to support. It is never transmitted to us or anyone else.
How we use it
- To operate the ordering service: show your catalogue and your prices, take and fulfil your orders, and tell you what is happening with them.
- To raise invoices for your orders in our accounting system.
- To answer you when you contact us.
Our lawful bases are performance of a contract (supplying your business) and our legitimate interests in running and securing our wholesale operation. Notifications and emails about your orders are service messages, not marketing.
Who else processes it
We use the following processors. Each acts only on our instructions.
| Provider | What it handles |
|---|---|
| Supabase | Database, sign-in and file storage. Hosted in the EU. |
| Google Cloud | Hosting for the website and staff panel (europe-west1). |
| Expo | Delivery of push notifications to your device. |
| Resend | Sending transactional email such as invitations and password resets. |
| Xero | Accounting. Receives your business contact details and order lines in order to raise invoices. |
| OpenRouter | Only if you email us a purchase order rather than using the app, and only when this feature is enabled: the email subject line and any order lines our own software could not read are sent to an AI service to suggest a reading. No attachments, contact details or prices are sent, and a member of staff checks every suggestion before it is used. |
Some of these providers may process data outside the UK. Where they do, transfers are covered by the UK International Data Transfer Agreement or Addendum, or an adequacy decision.
How long we keep it
- Order and invoice records: six years after the end of the relevant accounting period, as required for UK statutory accounting records.
- Account details and messages: for as long as you hold an account, and removed when the account is closed, except where they form part of an invoice record above.
- Push tokens: deleted when you sign out or turn notifications off.
Security
Data is held on secured cloud infrastructure. Access controls isolate each customer's data so one trade account cannot see another's, sign-in credentials are stored in your device's secure keychain, and all traffic is encrypted in transit.
Your rights
Under UK GDPR you may request access to your personal data, correct it, ask us to delete it, ask us to restrict or stop processing it, object to processing, or receive it in a portable format.
To close your account or delete your data, email trade@dwigroup.co.uk and we will action it. Because accounts are created by DWI Group for approved trade businesses rather than self-registered, there is no account deletion control inside the app itself. We will confirm once your account is closed and your personal data removed, other than records we must keep for statutory accounting.
You may also complain to the Information Commissioner's Office at ico.org.uk.
Changes
If we change this policy we will update the date at the top and, for anything significant, tell you in the app or by email.
Contact
Direct Wholesale and Investment Group Ltd, 17 Highfield Road, Edgbaston, Birmingham B15 3DU · trade@dwigroup.co.uk