Privacy Policy

The data controller for your personal data is Hector Solutions, Inc., doing business as Athena Wholesale (registered office: 169 Madison Ave, STE 15789, New York, NY 10016).

For any privacy question or request, contact sales@athenawholesale.co.

• Account and application data — your name, business name and address, email, phone number, and the trade details you give on your application (for example company registration and VAT numbers, and where you sell).
• Order and billing data — what you order, delivery and billing addresses, invoices, and payment status. Card payments are processed by Stripe; we never see or store your full card number.
• Partner application and programme data — if you apply as a referral partner, your contact and business details including any optional phone number, country, website or profile, proposed promotion methods, versioned terms and disclosure acceptances, review decisions, referral performance, compliance reviews and payout status. Stripe collects payout identity and bank details directly; we store only its connected-account reference.
• Support and correspondence — emails and messages you exchange with us.
• Usage data — if PostHog is configured and you allow analytics, pages viewed, actions taken, and the exact terms you enter into catalog search, together with device and browser information. Search events also include the catalog, marketplace and number of matching products. For signed-in customers this is linked to an opaque account user ID so we can understand and support real customer journeys. We do not add your account email, URL query strings or referrer paths to analytics profiles or events. Because catalog search is free text, it will contain any personal information you choose to type there.

• To perform our contract with you — running your account, taking orders, arranging delivery, issuing invoices, and providing support.
• To meet legal obligations — tax, accounting and trade-compliance record keeping.
• Legitimate interests — reviewing trade applications, preventing fraud and misuse, reviewing referral-partner applications and promotions, operating and auditing referral attribution, improving the portal, and telling existing customers about relevant stock and services (you can opt out of marketing at any time).
• Consent — where required, for non-essential analytics cookies (see the Cookie Policy).

We do not sell personal data, and we do not use it for automated decision-making that produces legal effects.

We share personal data only with service providers who process it on our instructions:

• Supabase — database and authentication (where your account and order records live).
• Stripe — payment processing.
• Resend — transactional email (account activation, order updates).
• PostHog — optional product analytics, only when configured and allowed by you.
• Google — optional ad conversion measurement (Google Ads), only when configured and allowed by you; used to tell us which of our ads lead to applications and orders, with ad personalisation switched off.
• Slack — internal application alerts containing the applicant’s business and contact name, email, selected marketplace and signup source, so the review team can respond to new applications.
• Mothership — our central wholesale operations platform. When the integration is enabled and you submit the full trade application, it receives the business identifiers, contacts, addresses, sales channels, payment and credit preferences, trade references and signed declaration needed to create and review the wholesale customer record. Confirmed order, invoice, payment and shipment records may also be managed there as the account moves onto that service.
• Hosting and infrastructure providers — the servers the portal runs on.

We may also disclose data where the law requires it, to professional advisers, and — in the ordinary course of a group business — within the corporate group behind Hector Solutions, Inc..

Some of our providers may process data in the United States, and Hector Solutions, Inc. is a US company. Where personal data protected by UK or EU law is transferred internationally, we rely on appropriate safeguards — the UK International Data Transfer Agreement or EU Standard Contractual Clauses, or the EU–US Data Privacy Framework where the provider is certified.

We keep account and application data for as long as your account is open. Order, invoicing and payment records are kept for six years after the end of the relevant financial year, as tax and company law require. Analytics data is kept in aggregate or deleted per our analytics provider’s retention settings. When data is no longer needed we delete or anonymise it.

If you are in the UK or EU, the UK GDPR / EU GDPR give you the right to access your personal data, correct it, have it deleted, restrict or object to its processing, receive it in a portable format, and withdraw consent where processing is based on consent. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, your local data protection authority.

If you are in the United States, you may have similar rights under your state’s privacy law (for example the California Consumer Privacy Act), including the rights to know, delete and correct, and to non-discrimination for exercising them.

To exercise any right, email sales@athenawholesale.co. We may need to verify your identity before acting on a request.

Personal data is held in access-controlled systems, encrypted in transit, with database-level access rules limiting each account to its own records. No system is perfectly secure, but we take reasonable technical and organisational measures appropriate to a trade platform handling business and payment data.

We may update this policy as the service or the law changes. The “last updated” date at the top shows the current version; material changes will be flagged to account holders by email or in the portal.