Effective date: 26 September 2026
This Privacy Policy explains how Kapstone Holdings Limited, trading as Rocklab Systems ("we", "us", "our"), processes personal data in connection with ParcelLoop.
Company number: 021997V
Registered office: First Floor, 11–13 Hill Street, Douglas, Isle of Man, IM1 1EF
Privacy and support contact: support@rocklabsystems.com
ParcelLoop is an independent integration and is not affiliated with or endorsed by Royal Mail.
1. Who we are
Kapstone Holdings Limited is the operator of ParcelLoop.
For personal data we collect for our own business purposes, such as account administration, support, security, and service operation, we act as a data controller.
When ParcelLoop processes order and customer information solely to provide the integration for a merchant, we generally act as a processor on that merchant's behalf, while the merchant remains responsible for its own customer relationship and lawful basis for processing.
The exact legal role can depend on the circumstances and purpose of processing.
2. Data protection law
We process personal data in accordance with applicable Isle of Man data protection law, including the Data Protection Act 2018 and the Isle of Man's applied GDPR framework.
3. Information ParcelLoop may process
Depending on how the app is used and configured, ParcelLoop may process:
Merchant and account information
- account or site identifiers;
- business name and contact details;
- app installation and subscription status;
- configuration settings;
- shipping method mappings;
- product or SKU shipping profiles;
- support communications.
Customer and order information
- customer or recipient name;
- delivery address;
- telephone number and email address where supplied with the order;
- order number and order identifiers;
- products ordered, quantities, SKUs, weights, and shipping information;
- selected delivery method;
- fulfilment and shipment status;
- tracking number and related shipment information.
Technical and operational information
- sync status;
- timestamps;
- error messages;
- retry history;
- app and API events;
- security and diagnostic information reasonably required to operate, troubleshoot, or protect the service.
We do not need your customers' payment card details to provide ParcelLoop and do not intentionally collect full payment card details through the app.
4. How we use personal data
We may use personal data to:
- provide and operate ParcelLoop;
- transfer shipment information between supported systems;
- create or update shipment related records;
- return tracking and fulfilment information;
- apply merchant configured weights and service mappings;
- maintain sync history and retry failed operations;
- authenticate installations and protect accounts;
- provide customer support;
- diagnose faults and improve reliability;
- administer subscriptions and entitlements;
- prevent abuse, fraud, and security incidents;
- comply with legal and regulatory obligations;
- establish, exercise, or defend legal claims.
5. Lawful bases
Where we act as a controller, we rely on one or more lawful bases as appropriate, including:
- performance of a contract;
- legitimate interests in operating, securing, supporting, and improving ParcelLoop;
- compliance with legal obligations;
- consent where consent is required for a particular activity.
Where we act as a processor for a merchant, we process the relevant personal data on the merchant's documented instructions as necessary to provide ParcelLoop.
6. Wix
ParcelLoop is distributed through Wix and integrates with Wix services.
Wix may process account, billing, subscription, website, and other data under its own terms and privacy arrangements.
Wix handles checkout, subscription billing, invoices, and payment processing for ParcelLoop subscriptions. We do not receive or store your full payment card details from Wix checkout.
7. Royal Mail Click & Drop
Where you connect and use Royal Mail Click & Drop, ParcelLoop may send shipment information required to perform the integration. This can include recipient details, delivery address, order contents, parcel weight, shipping service information, and other shipment related data.
Royal Mail processes information under its own terms and privacy arrangements.
You are responsible for ensuring that your use of Royal Mail services and the transfer of customer data to Royal Mail is lawful and appropriate for your business.
8. Other service providers
We may use service providers to host, secure, monitor, maintain, or support ParcelLoop.
Where a provider processes personal data on our behalf, we take reasonable steps to use providers subject to appropriate contractual and security obligations.
We do not sell personal data to advertisers.
9. International transfers
The systems involved in providing ParcelLoop, including Wix, Royal Mail, and infrastructure or technical service providers, may process data in different jurisdictions.
Where we are responsible for an international transfer of personal data, we take appropriate steps required by applicable data protection law to protect that data.
10. Data retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including service delivery, troubleshooting, security, accounting, dispute resolution, and legal compliance.
Operational logs and shipment sync records may be retained for a reasonable period to allow merchants to review activity and diagnose failed or disputed shipments.
Retention periods may vary depending on the type of data, the merchant's use of ParcelLoop, legal obligations, security requirements, and technical needs.
When data is no longer required, we take reasonable steps to delete or anonymise it.
11. Security
We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure.
No internet based service can guarantee absolute security.
Merchants are responsible for protecting their Wix, Royal Mail, and other account credentials and for restricting access to authorised users.
12. API credentials
Where ParcelLoop requires credentials or tokens to connect to a third party service, those credentials are used only as necessary to provide the integration.
You must not share API credentials publicly or send them in ordinary support messages unless we specifically provide a secure method for doing so.
13. Your rights
Depending on applicable law and the circumstances, individuals may have rights relating to their personal data, including rights to:
- access personal data;
- correct inaccurate personal data;
- request deletion;
- restrict processing;
- object to certain processing;
- receive certain data in portable form;
- withdraw consent where processing is based on consent;
- complain to the relevant data protection supervisory authority.
Where your request concerns data held by a merchant using ParcelLoop, you should normally contact that merchant first because the merchant may be the controller responsible for the order data.
You may also contact us at support@rocklabsystems.com.
14. Complaints
If you have concerns about our use of personal data, please contact us first so we can investigate.
You may also have the right to complain to the Isle of Man Information Commissioner or another competent supervisory authority where applicable.
15. Children's data
ParcelLoop is a business service and is not intended for use by children.
The app may process recipient information contained in merchant orders, but merchants are responsible for determining whether they may lawfully collect and use that information.
16. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to ParcelLoop, our processing activities, legal requirements, or third party integrations.
The latest version will be published at the public Privacy Policy URL with an updated effective date.
17. Contact us
Kapstone Holdings Limited t/a Rocklab Systems
Company number: 021997V
First Floor, 11–13 Hill Street
Douglas
Isle of Man
IM1 1EF
Email: support@rocklabsystems.com