Privacy notice

1. Who we are

The controller of your personal data is DROP DASH UK LTD, a company registered in England and Wales with company number 14749884, whose registered office is at 10 Cranford Gardens, Royston, Barnsley, England, S71 4SP. Our registration with the Information Commissioner’s Office (ICO) is in progress.

We process personal data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025. For any privacy question or to exercise your rights, email office@dropdash.co.uk with “Data protection” in the subject line, or write to us at our registered office.

2. Drivers and applicants

This section applies if you register with DropDash to find delivery work, whether you go on to be approved or not.

What we collect

Why we use it and our lawful basis

Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for details of that assessment and you can object (see your rights).

If you don’t give us information we are legally required to collect — such as right to work evidence — we cannot supply you to clients.

3. Client users

This section applies if you use DropDash on behalf of a courier company or other business (a “client”).

• What we collect: your name, job title, work email and phone, the company you represent, your account activity (jobs posted, reports approved or disputed, signatures captured on supervisor sign-off) and messages you send us.
• Why: to provide the service to your company under our client terms (contract with your employer, and our legitimate interests in managing the account), to invoice, to keep an audit trail of approvals, and to send service messages.
• Data about drivers that you receive: each client is an independent controller of the driver data we share with it for its own operational purposes. We share the minimum needed — see who we share data with.

4. Website visitors and enquiries

• Enquiry and contact forms: your name, company, email, phone, the services and areas you’re interested in and your message. We use these to reply and, for business enquiries, to follow up about our services (legitimate interests). We don’t add you to marketing mailing lists without asking.
• Technical data: our hosting provider processes your IP address, browser type and request logs to deliver and secure the site (legitimate interests).
• Cookies: we only use strictly necessary cookies. See our cookie policy.

5. Criminal records and special category data

Some clients require a basic DBS check. Criminal offence data has extra protection under Article 10 UK GDPR. We process it only where a client requires it for the role, relying on the conditions in Schedule 1 of the Data Protection Act 2018, and we keep an appropriate policy document describing how we protect it. We record only the certificate number, the date of issue and whether the certificate is clear. We do not keep a copy of the certificate, and we follow the DBS code of practice.

We don’t ask for health information, except where you choose to tell us about an injury in an incident report or ask for an adjustment. We use it only for that purpose.

Your nationality and immigration status appear in right to work checks. We use them only for that legal purpose and never to make allocation decisions.

6. Who we share data with

Clients

When you are allocated to a job, the client sees your name, photo, vehicle details and verification status (for example “right to work checked” or “insurance valid”), plus your check-in and check-out times and locations, end-of-day report and photos for that job. Clients do not receive your identity documents, licence check details, DBS information, National Insurance number or bank details. If a client needs evidence of a check for its own legal compliance, we provide confirmation that the check was done and when, not the documents themselves, unless the law requires otherwise.

Service providers (processors)

Each processor acts only on our instructions under a written contract that protects your data.

Others

• The Home Office, HMRC, the DVLA, police or other authorities where the law requires or allows it.
• Insurers, legal advisers and accountants where needed to handle claims, disputes or audits.
• A buyer or investor if our business is sold or restructured, under confidentiality obligations.

We never sell personal data.

7. International transfers

Some providers process data outside the UK. Where a country does not have a UK adequacy decision (or, for the USA, where the provider is not certified under the UK Extension to the EU-US Data Privacy Framework), we use the ICO’s International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, together with a transfer risk assessment. You can ask us for a copy of the relevant safeguards.

8. How long we keep data

We keep data only as long as we need it, then delete or anonymise it:

9. Automated decisions

The platform automatically prevents a driver being confirmed for a job when a required document or check has expired — for example, expired insurance or right to work permission. This protects drivers, clients and the public. Every other allocation, approval, suspension or rejection decision is made or reviewed by a person on our team.

If you think an automated block is wrong, tell us and a member of our team will review it promptly. You have the right to a human review, to express your view and to contest the decision. We do not use automated ratings to discipline drivers.

10. Security

We protect personal data with encryption in transit, field-level encryption for National Insurance and bank details, private document storage with permission checks on every download, role-based access for our staff, and audit logs of who viewed or changed sensitive records. No system is completely secure; if a breach is likely to put you at high risk we will tell you without undue delay.

11. Your rights

You have the right to:

• Access — get a copy of your personal data. We will carry out a reasonable and proportionate search.
• Rectification — have inaccurate data corrected or incomplete data completed.
• Erasure — ask us to delete data, unless we must keep it (for example right to work or tax records).
• Restriction — ask us to limit how we use your data while a concern is looked into.
• Objection — object to processing based on legitimate interests, and to direct marketing at any time.
• Portability — receive data you gave us under contract in a machine-readable format, such as your earnings statements.
• Human review of significant automated decisions (see above).

To use any right, email office@dropdash.co.uk. We may need to confirm your identity. We respond within one month, which can be extended by two months for complex requests — we will tell you if so. There is normally no charge.

12. Complaints

If you are unhappy with how we have handled your personal data, please complain to us first using our complaints procedure. We will acknowledge a data protection complaint within 30 days (in practice, within 5 working days), investigate it and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113. The ICO usually expects you to have raised the issue with us first.

13. Changes to this notice

We will update this notice when our processing changes. If changes are significant we will tell registered users by email or in the app before they take effect, and drivers will be asked to acknowledge the new version.