Privacy policy
Last updated: 6 October 2026
1. Who we are
Pawthentic is a trading name of 339 Ltd, a company registered in England and Wales with company number 16096234. Our registered office is 5a Poole Road, Bournemouth BH2 5QJ. We are registered with the Information Commissioner's Office (ICO) under registration number ZB859940.
We help independent veterinary practices in the UK run their pet healthcare plans. We provide the online platform the plans run on, we collect plan payments from pet owners on the practice's behalf, and we arrange for products such as flea and worm treatments to be delivered to pet owners' homes.
If you have any questions about this policy or how we use your information, you can contact us at privacy@pawthentic.co.uk or by post at the address above, marked for the attention of Data Protection.
2. Two different roles
Data protection law distinguishes between a controller, who decides why and how personal information is used, and a processor, who uses it on a controller's behalf and on their instructions. We act in both roles, depending on whose information it is and why we have it.
If you are a pet owner on a plan with your vet
Your vet practice is the controller of your information. The practice decides what its plans include and what happens to your information, and we act on its behalf as its processor. The practice's own privacy notice explains how it uses your information, and it is the practice you should contact first about your rights. We explain in section 4 what we do on your practice's behalf, so that you can see the whole picture.
There are a small number of things we are responsible for ourselves, because the law or the Direct Debit scheme places obligations on us directly. For those, we are the controller. They are set out in section 5.
If you work at a vet practice, contact us, or visit our website
We are the controller of your information. Section 6 explains how we use it.
3. Our commitments
- We never sell personal information.
- We never use pet owners' information for our own marketing. If we ever communicate with pet owners about anything other than their plan, it will be together with, and in the name of, their vet practice, and only where the practice is permitted to send that communication.
- We only share information with the people who need it to run your plan, collect your payments and deliver your products. Every service provider who handles information for us is bound by a written contract with us.
- We keep information in the United Kingdom wherever we can, and where a provider is outside the UK we make sure your information is protected in a way the law allows (see section 8).
4. What we do on your vet practice's behalf (pet owners)
When you join a plan with your vet practice, we use the following information on the practice's behalf.
| Information | Examples |
|---|---|
| Your identity and contact details | Name, title, date of birth, postal address, email address, telephone number. |
| Your pet's details | Name, species, breed, date of birth, and the plan your pet is on. |
| Your plan | Start date, status, payment schedule, changes and cancellation. |
| Your payments | For Direct Debits: the account holder name, sort code and account number, and the record of your Direct Debit Instruction. For card payments: a secure token from our card payment provider plus the card type, last four digits and expiry date. We never see or store your full card number. We also keep a record of each payment, including failed payments, refunds and any claim you make under the Direct Debit Guarantee. |
| Deliveries | Delivery address and instructions, products ordered, and despatch and tracking information. |
| Our communications with you | Emails, text messages, letters and notes of phone calls. |
We use it, on the practice's instructions, to:
- set up and manage your plan membership;
- collect your plan payments by Direct Debit or card, as the practice's collection agent, and pass them to the practice;
- send you messages about your plan, such as your welcome email, notice of upcoming Direct Debit collections, receipts, failed payment notices and delivery updates. These are service messages, not marketing, and you will receive them for as long as you are a plan member;
- arrange for products included in your plan to be picked, packed and delivered to you by a veterinary wholesaler and its courier; and
- help you and the practice with any questions about the above.
Where your plan includes home delivery, we pass the wholesaler only what it needs to get the parcel to you and deal with any problems: your name, delivery address and any delivery instructions, the order and the products, the vet practice it comes from, your pet's name where it must appear on a dispensing label, and, where the courier needs them for delivery updates, your phone number or email address. The wholesaler does not receive your bank or card details.
The legal basis for this use is decided by your vet practice as controller, and is explained in its privacy notice.
5. What we are responsible for ourselves (pet owners)
For the following, we are the controller of your information and we rely on the legal bases shown.
| What we do | Legal basis |
|---|---|
| Keeping records of payments we have collected for tax and accounting purposes | Legal obligation (tax and company law) |
| Carrying out checks to prevent fraud and financial crime, and meeting any anti-money laundering and sanctions requirements that apply to us. This includes verifying the identity of the person paying for a plan, using their name, address and date of birth. We use an identity verification provider to check these details against the records it holds. This is not a credit search | Legal obligation, and our legitimate interests in preventing fraud and misuse of the payment system |
| Meeting our obligations under the rules of the Direct Debit scheme, which apply to us as the organisation collecting your Direct Debits. This includes keeping your Direct Debit Instruction and the evidence that you authorised it, providing a copy to your bank if it asks, and dealing with any claim made under the Direct Debit Guarantee | Our legitimate interests in operating the Direct Debit scheme correctly and protecting you and us from mistaken or unauthorised payments |
| Dealing with complaints, disputes and legal claims, including card chargebacks and Direct Debit Guarantee claims | Our legitimate interests in establishing, exercising and defending legal claims |
| Producing statistics from which no one can be identified, to understand and improve our service | Our legitimate interests in improving our service. Once information has been made anonymous it is no longer personal information. |
6. Vet practices, enquirers and website visitors
If you work at, or own, a vet practice
We use the business contact details of partners, directors, practice managers and staff (name, job title, practice, work email, work phone) to discuss our services with the practice, to set up and manage our agreement with it, to give practice staff access to our platform, to provide support, and to send updates about our services. We also use them, together with information about the practice and its owners, to carry out identity, business verification and anti-money laundering checks (sometimes called KYC, KYB and AML checks) before and during our agreement. We may use a specialist verification provider to carry out these checks.
Our legal basis is the performance of our contract with the practice, or steps taken at the practice's request before entering into one; for verification and anti-money laundering checks, our legal obligations and our legitimate interests in preventing fraud and financial crime; and otherwise our legitimate interests in running and developing our business. We will only send marketing emails or text messages where the law allows. Where your practice is a sole trader or an unincorporated partnership, that means we will ask for your permission first, unless you are an existing customer and we are telling you about similar services, in which case you can opt out at any time. Every marketing message we send includes a simple way to unsubscribe.
If you contact us or register your interest
If you use the form on our website, email us or call us, we use your name, practice, contact details, role and anything else you tell us to respond to you and to follow up on your enquiry. Our legal basis is our legitimate interests in responding to enquiries, or, where you have ticked the box asking us to keep in touch, your consent, which you can withdraw at any time. Our website form is provided by Tally, which processes the information on our behalf.
If you visit our website
Our website is hosted by Netlify, which records technical information such as your IP address and the pages requested, to deliver the site securely. Our website uses fonts provided by Google Fonts, which means your browser connects to Google's servers and shares your IP address with Google.
Our website does not use cookies or similar technologies to track you, and we do not use analytics or advertising tools on it. Our registration form is provided by Tally and shown inside our page. When you use it, Tally stores a small amount of information in your browser that the form needs to work, such as keeping your answers while you fill it in. It is not used for advertising.
If you apply for a job with us
We use the information in your application, and from interviews and any references you agree to, to assess your application. Our legal basis is taking steps at your request before entering into a contract, and our legitimate interests in recruiting the right people. We keep unsuccessful applicants' information for six months after the recruitment process ends, unless you agree we can keep it longer.
7. Who we share information with
We share personal information only where we need to, and only with:
- your vet practice, if you are a pet owner on one of its plans;
- veterinary wholesalers and their couriers, to deliver products included in your plan;
- payment providers, including our bank (National Westminster Bank plc, which sponsors us in the Direct Debit scheme), our Direct Debit bureau, our card payment provider, and your own bank or card issuer, to collect and process payments;
- service providers who help us run our business, such as our platform hosting provider, our email and text message providers (including VoodooSMS), our website host (Netlify), and our website form provider (Tally). They act on our instructions;
- identity verification and fraud prevention providers, to verify the identity of people paying for plans and to carry out checks on vet practices;
- professional advisers, such as our lawyers, accountants and insurers, where they need it to advise us;
- regulators, law enforcement and courts, where the law requires it or where it is needed to prevent fraud or to establish or defend legal claims; and
- a buyer or successor, if our business or part of it is ever transferred, in which case your information would continue to be protected in line with this policy.
8. Information transferred outside the UK
Most of the information we hold is kept in the United Kingdom. Some of our providers are based in, or use servers in, the European Economic Area or the United States. Where your information is transferred outside the UK, we make sure it is protected in one of the ways the law allows, for example because the UK government has recognised the country as providing adequate protection, because the provider is certified under the UK Extension to the EU-US Data Privacy Framework, or because we have signed the ICO's International Data Transfer Agreement or Addendum with the provider. You can ask us for details of these providers and the safeguard used for each.
9. How long we keep information
| Information | How long we keep it |
|---|---|
| Pet owner information we hold for vet practices | For as long as the practice instructs us. When our agreement with the practice ends, we return the information to the practice and then delete it within a short period set out in our agreement with the practice, except for the records below. |
| Payment records | Six years from the end of the financial year in which the payment was made, for tax and accounting purposes. |
| Direct Debit Instructions and the evidence that they were authorised | For as long as the Direct Debit is in place and for six years after it is cancelled, because a claim under the Direct Debit Guarantee can be made at any time. |
| Information used for fraud and financial crime checks | Five years from the end of the relationship, or longer where the law requires. |
| Vet practice contacts and our agreement with the practice | For the duration of our relationship with the practice and six years after it ends. |
| Enquiries that do not lead to an agreement | Two years from our last contact with you. |
| Job applications | Six months after the recruitment process ends. |
| Website server logs | 30 days, as set by our website host. |
10. Your rights
You have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct information that is inaccurate or incomplete;
- ask us to delete your information, or to restrict how we use it, in some circumstances;
- object to our use of your information where we rely on our legitimate interests, and to object at any time to direct marketing;
- ask us to transfer information you have given us to you or to another organisation, in some circumstances; and
- withdraw your consent at any time, where we rely on consent.
If you are a pet owner and your request is about your plan, please contact your vet practice, or contact us and we will pass your request to the practice within three working days and help it respond. If your request is about something we are responsible for ourselves (section 5), we will deal with it directly.
We will respond within one month of receiving your request, or within three months if your request is complex, in which case we will tell you within the first month. We may need to confirm your identity before we act on a request.
We do not make decisions about you based solely on automated processing that have a legal or similarly significant effect on you.
11. Complaints
If you are unhappy with how we have used your personal information, please tell us first, using the contact details in section 1. You can complain by email, by post or by phone. We will acknowledge your complaint within 30 days, look into it properly, and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
12. Changes to this policy
We will update this policy when the way we use personal information changes. The date at the top shows when it was last updated. If we make a significant change to how we use the information of pet owners or vet practice staff, we will tell them by email before it takes effect. For anything else, please check this page from time to time.