Keep customer addresses out of shared promotional spreadsheets

A small shop may begin with one spreadsheet for everything: enquiries, orders, addresses, campaign ideas and follow-ups. As helpers join, that convenience becomes a problem. People planning a promotion can suddenly see delivery details they do not need, and copied files become difficult to control.

The practical improvement is to separate the purpose of each record. Marketing needs information about relevant interests and permission, while fulfilment needs the details required to deliver an accepted order.

Inventory the files already in use

List the sheets, shared folders, chat exports and downloaded order files that contain customer information. Include copies used by temporary helpers or external partners.

Record who can access each location and why. Do not paste the customer data into another document merely to conduct the review.

Look for old exports that remain shared after the original task ended. A file can be forgotten by its owner while still accessible through an old link.

Separate fulfilment from promotion

Keep delivery addresses in the controlled order or fulfilment record. A promotional planning sheet rarely needs a house number, landmark or full shipping label.

For campaign planning, use the minimum information needed to decide relevance and permission. Product interest or a broad operational segment may be enough.

Do not assume a past purchase automatically permits every future promotional message. Maintain the relevant consent or preference information for the channel you use.

Replace copied details with references

Where another team member needs to discuss an order, use an internal order reference instead of repeating the address in a general planning sheet.

The reference should lead authorised staff to the controlled record. It should not be a public link that reveals customer information to anyone who receives it.

Avoid embedding personal details in file names, tracking links or screenshots. These can spread beyond the system where you intended to protect them.

Restrict access by the actual task

Give access to the people who need it for packing, support or another defined purpose. Review permissions when someone changes roles or finishes a temporary assignment.

Use individual accounts where your tools support them. Shared credentials make it harder to remove one person's access without disrupting everyone.

Do not describe a spreadsheet as secure merely because the link is obscure. Check the real sharing setting and whether recipients can download or reshare it.

Handle courier handoffs deliberately

A carrier needs appropriate delivery information, but that does not justify attaching an entire customer or marketing database.

Prepare the required shipment fields, confirm the recipient and transfer them through the agreed service. Check the export before sending it.

Keep any retention or deletion practice aligned with your business obligations and professional advice. This is an operational separation guide, not a substitute for legal guidance on personal-data requirements.

Make screenshots safer

Before sharing a screen for troubleshooting, remove unrelated names, phone numbers, addresses and order details. Crop the relevant area or use a synthetic example where possible.

A blurred field may still be readable in the original file or another frame. Check the actual image being sent, not only the editor preview.

Never post a customer label publicly to demonstrate that orders are being dispatched. Product and packing photographs can show the work without exposing the recipient.

Create a cleanup routine

At the end of a campaign or fulfilment task, review whether temporary exports are still needed. Remove unnecessary access and dispose of copies through your approved process.

Keep a record of important access changes without duplicating the sensitive content. Assign an owner so cleanup does not depend on whoever remembers first.

If information is sent to the wrong person, stop further sharing and follow an appropriate incident process. Do not assume deleting your own copy recalls every recipient's copy.

Check the separation in practice

Ask a marketing helper to complete a normal campaign-planning task. Can they do it without a delivery address? Ask a packer whether they can find the correct order without accessing promotional notes.

Fix any workflow that forces people to request broader access than they need.

The goal is not to make a small team slow. It is to keep customer information connected to its purpose, so ordinary collaboration does not create unnecessary exposure.