Privacy Policy

DropNPickUp Logistics Ltd (“DropNPickUp”), company number 17266181, registered office Office 1373, 60 Tottenham Court Road, Fitzrovia, London, W1T 2EW, United Kingdom, is the data controller for personal data processed through the DropNPickUp platform. Contact us about privacy at support@dropnpickup.com.

There is one exception. For our fulfilment service, when a merchant uploads their own customers’ delivery details so we can fulfil and deliver their orders, the merchant is the controller of that customer data and DropNPickUp acts as a processoron the merchant’s instructions. Those customers should refer to the merchant’s own privacy notice.

• Account & profile: name, email, phone, address and postcode, role, business name, avatar.
• Driver data: vehicle details and registration, MOT date, service area and working postcodes, languages, equipment, and compliance documents (e.g. licence, insurance, right-to-work) that you upload.
• Crew member data: for white-glove crew members, the identity, right-to-work, DBS/PVG and handling documents you upload. Because these are sensitive, they are held with the same protections as driver compliance documents — access-controlled storage, visible only to you and our verification team, and never shown to the lead driver or other users.
• Business data: company number and Companies House details, expected volume and courier-spend information you provide.
• Fulfilment & merchant data: for merchants who store stock with us, your product catalogue, stock levels, inbound shipments and orders, and the delivery details of your own customers that you upload so we can fulfil and deliver their orders (which we process on your behalf — see section 1).
• Labour-supply data: for day-rate bookings, the site, dates, and booking details you provide.
• Job data: pickup and drop-off addresses, item details, messages exchanged in job chat, proof-of- delivery photos and signatures.
• Location data: while a driver is carrying out a job, their device GPS position is collected so the customer can track the delivery.
• Payment data: processed by Stripe. We do not store full card numbers; we hold transaction records and payout status.
• Technical & usage data: log data, device and browser information, and cookies (see our Cookie Policy).

Under UK GDPR we rely on the following legal bases:

• Performance of a contract — to create your account, match jobs, process payments and payouts, and provide tracking and support.
• Legitimate interests — to keep the platform safe and fair, prevent fraud, verify drivers, improve the service, and operate the visibility/reliability system.
• Legal obligation — to meet tax, accounting and other regulatory requirements.
• Consent — for optional things such as web push notifications and accessing your device location, which you can withdraw at any time.

Driver location is collected only while a job is in progress and only from the assigned driver’s device, so the customer can see the delivery’s progress and estimated arrival. A driver can stop sharing by closing the job page or revoking browser location permission, though this may affect their ability to complete jobs.

If you post in the driver community board, your messages are visible to all other verified drivers; you appear under a pseudonymous handle, not your full name. You can delete your own posts, our team removes content that breaks the guidelines, and we purge community messages older than 12 months.

We share the minimum necessary with other users — for example, a customer and their matched driver see each other’s name, relevant contact details and the job’s addresses. We also use the following service providers (processors), who act on our instructions:

• Supabase — database, authentication and file storage hosting.
• Stripe — payment processing and driver payouts.
• Mapbox — maps, routing and estimated-time calculations.
• Resend — transactional email delivery.
• Ideal Postcodes and postcodes.io — UK address and postcode look-up.
• Companies House — business verification.
• Google — advertising-conversion measurement and remarketing, loaded only where you have consented (see our Cookie Policy).
• Web-push services operated by your browser/OS vendor for notifications you opt into.

We may also disclose data where required by law, or to protect our rights, users, or the public.

Some providers may process data outside the UK. Where they do, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.

We keep account and job data for as long as your account is active and for a reasonable period afterwards to meet legal, accounting and dispute-resolution needs. Compliance documents and financial records are kept for the periods required by law. We delete or anonymise data when it is no longer needed.

Under UK data-protection law you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have data erased, or its processing restricted, in certain circumstances;
• object to processing based on legitimate interests;
• data portability for data you provided, where applicable;
• withdraw consent where we rely on it.

To exercise any of these, email support@dropnpickup.com. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk— though we’d appreciate the chance to put things right first.

We protect data with measures including encryption in transit, row-level access controls in our database, restricted access to production systems, and payment handling delegated to Stripe. No system is perfectly secure, but we take reasonable steps to protect your information.

DropNPickUp is not intended for anyone under 18. We do not knowingly collect data from children.

We may update this policy. The “last updated” date above will change, and we will notify you of material changes.

Privacy questions or requests: support@dropnpickup.com.