Privacy notice

Driver calendar, engagement and running costs

For driver-owned availability and private vehicle, mileage, expense and price tools, UNLIMIT DIGITAL LTD determines the service purposes as controller. Processing necessary to provide the requested tools relies on performance of the driver service contract; proportionate security, abuse prevention and minimal audit records rely on documented legitimate interests, and applicable legal duties use the relevant legal-obligation basis. These purposes are separate from the business-directed delivery/workforce processing described below. The business remains controller of its own engagement declarations, required checks, schedules and delivery purposes. Actual decisions about purposes and means determine roles; calling ourselves a platform does not remove our controller or processor duties.

We record recurring weekly non-working periods and dated time off, the relevant timezone, shift offers, accept/reject/revised decisions and audit metadata. We compare commitments across the driver’s connected businesses to prevent overlapping acceptances and warn about availability or workload. A business sees generic warnings without another business’s name, exact private shift details or private time-off rules. The driver sees their own commitments. Do not enter medical or other sensitive details in shift-decline reasons; these are sent to the business and its authorised recipients.

Private vehicle settings are encrypted. Daily mileage overrides retain the settings used for estimates; automatic mileage uses completed-shift odometer records and is attributed to the shift-ending day. Expenses, fuel quantities, private notes and corrections are recorded separately from estimated consumption. Driver-entered prices keep the fuel type, amount, entered date, observation time and source. Optional price areas are rounded to approximately one kilometre and encrypted. Nearby-price searches use a single phone position in memory without storing or sending it to Fuel Finder; the server searches shared public price data. Drivers can use a manual price without supplying an area. No continuous off-shift tracking is enabled by these tools.

Driver-entered prices and private running costs are not exposed to businesses, other drivers or public price feeds. A future aggregated price service requires a separate documented purpose, lawful-basis and disclosure review; storing records now does not authorise unrestricted reuse. Public UK weekly averages and Fuel Finder station prices, including source/update dates and daily cache snapshots, are kept separately. Weekly averages carried into a daily snapshot remain weekly observations, not newly surveyed daily prices.

Drivers can remove non-working periods, erase individual entered-price records and delete their private cost records in the app. Cost erasure removes vehicle settings, mileage overrides, expenses, entered prices and their areas; minimal deletion counts and security/audit records remain without the erased content. Business-held shift, payment and compliance evidence, processor copies and backups have separate retention and request-handling rules. Private records remain while needed for the driver’s requested history, subject to purpose and inactive-account retention review; this does not authorise indefinite personal-data storage for unspecified future use. Backup expiry and any legal preservation exception must be documented in the production retention schedule.

1. Who is responsible

dropLog. is a product of UNLIMIT DIGITAL LTD, company number 16439193. Our registered office is 31–33 Worcester Street, Gloucester, England, GL1 3AJ.

For business account administration and the security of our service, the company acts as a controller. For customer, driver and delivery records entered by a takeaway, the intended arrangement is that the takeaway is the controller and dropLog. is its processor. Roles must reflect the actual contract and processing; the label alone does not determine them.

UNLIMIT DIGITAL LTD is not the employer, engager or paymaster of any driver and does not allocate work. It does not rate, rank, score or profile drivers, does not use driver data to allocate, offer or withhold work, and does not monitor drivers’ delivery performance for its own purposes. Live location, activity reports, attendance records and customer feedback are processed for the business that engages the driver, which determines whether and how it uses them, subject to section 4 and the Driver & delivery policy. Platform security, fraud-prevention and acceptable-use records are the company’s own controller processing and are not used to evaluate delivery performance.

2. Information in the current application

3. Purposes and lawful bases

For an individual who contracts with us, account processing may be necessary to perform that contract. For a business contact who is not personally the contracting party, account administration and security are intended to rely on documented legitimate interests, subject to a balancing assessment. Specific legal obligations may require processing when they apply; no particular statutory retention duty is assumed here.

For records processed on a takeaway’s instructions, that takeaway must establish and communicate its own lawful basis. Registration is not blanket consent to customer processing, employee monitoring or promotional messaging. Where a customer opts in to receive promotional messages from businesses on the platform, dropLog. processes that consent as controller; the lawful basis is the customer’s explicit consent under UK PECR and UK GDPR. Businesses serve approved promotional content; the controller role and the lawful basis for serving a contextual advertisement on the tracking page (no external networks, no cross-site tracking) rely on documented legitimate interests, subject to a completed balancing assessment before launch. These proposed bases require confirmation against the final service arrangement before launch.

4. Driver location and sensitive information

The application stores the latest reported point and limited stop-window anchors, not a complete route history. GPS reports outside an active shift are rejected. The fleet map labels stale positions and shows the last capture time; it does not assume a driver is stationary when GPS is unavailable. Closing a shift clears that driver’s latest coordinate, accuracy and timestamp. Closed stop anchors are erased after fourteen days by default by the worker, while duration records remain for reporting. Last reported battery information can help diagnose loss of updates but does not establish its cause. Backup expiry and abandoned-shift cleanup remain to be implemented.

Drivers may separately choose to share a one-time availability position with their own business, including when off shift. This does not start continuous tracking or a working shift. Nearby results expose approximate distance, not the exact availability coordinate. Positions cease to appear after fifteen minutes and the worker clears the snapshot. Availability can be withdrawn immediately. Work offers require an explicit payment amount and driver acceptance; a business-authorised shift remains required before assignment.

Businesses must inform drivers about monitoring purposes, visibility, retention and review, establish the applicable lawful basis and complete any required impact assessment. Breaks, customer service, traffic and connectivity must be considered before drawing conclusions. Staff must not make automatic pay deductions or disciplinary decisions from a stop or anomaly flag. Map monitoring mode keeps a signed-in session active while the map is visible; protect the monitoring display from unauthorised viewing and use manual lock when needed.

Do not enter payment-card details, identity documents or unnecessary sensitive information into delivery notes. Allergy and accessibility notes can reveal health information; avoid recording them in this release unless the controller has established the necessary safeguards and lawful conditions. Location permission on a phone does not by itself establish a lawful basis for monitoring a worker.

Load board posts: a driver on a cargo vertical may publish a location-based availability post. Location is taken from the device at the moment of posting and updated only while the post is active. Businesses browsing the load board see approximate distance and outcode only; the precise posting coordinate is not disclosed. The platform retains posting coordinates for 90 days after the post closes, after which they are deleted. Publishing a load board post is an opt-in action initiated by the driver; it does not start a shift or enable continuous tracking.

5. Access, recipients and international transfers

Takeaway workspace access is restricted to the business and the signed-in staff role. Roles apply across all outlets within that business. Owners and administrators can invite colleagues and revoke access; managers and finance staff can view audit records. Invitations expire after 48 hours, but expired token hashes and audit records are not automatically deleted. Approved hosting, database and support providers may process information when production services are configured. A complete provider register and contractual safeguards have not yet been finalised. The Subprocessors & services page distinguishes verified application dependencies from unappointed providers.

When a live map is loaded, the browser requests map tiles from OpenStreetMap infrastructure. This can disclose IP address, browser information and the approximate area being viewed. Fonts are served by the Next.js application, rather than requested by visitors directly from Google Fonts.

Businesses browsing the load board see a driver's approximate distance and outcode from an active load board post, but not the precise posting coordinate, the driver's name or any other personal identifier unless the driver's enrolment with that business already makes that information available.

When Firebase notifications are configured and a driver enables them, encrypted device registration tokens are associated with that signed-in phone session. Firebase and Apple notification services may process device identifiers and generic notification text. Customer addresses, payment amounts and receipt contents are excluded from push previews. Provider acceptance is not proof of device delivery or reading. In-app shift and order notices are retained for thirty days; push registration is removed on logout or expiry cleanup. Provider contracts and international-transfer arrangements must be completed before activation.

Shift attendance reports contain the driver’s explanation, schedule and business membership. Explanations and owner alert numbers are encrypted. Authorised business staff can review attendance; the owner can opt into operational SMS and WhatsApp alerts. External alerts contain a generic instruction to sign in, not the private explanation. Drivers should not submit medical details or unnecessary sensitive information. Replacement invitations record the offered shift, fixed and additional delivery pay, payment arrangements, terms and the driver’s response. These agreements and absence records need agreed retention, rights and legal-hold schedules before production; a dashboard display window is not deletion.

Product analytics are collected by PostHog, Inc. (US Cloud) to understand usage patterns and improve the platform. PostHog processes page views, feature usage and device metadata on its US-hosted infrastructure. PostHog acts as a processor under a data-processing agreement; the applicable transfer mechanism is the EU–US Data Privacy Framework. No advertising analytics are enabled. The business controller should include PostHog in its own privacy disclosure if it has not already.

Production data locations and support access must be confirmed. Transfers require an applicable adequacy decision or another valid mechanism and any necessary transfer assessment. UK–EEA adequacy does not automatically authorise onward transfers to every vendor. No EU-only hosting or international-transfer compliance claim is made.

6. Retention and deletion

Retention will need to reflect each purpose and any applicable recordkeeping requirements. Operational delivery addresses should not be retained merely because a financial record is retained. There is no approved blanket “keep everything for six years” policy.

7. Your rights and contact route

Depending on the processing and applicable law, you may request access, correction, erasure, restriction or portability, object to processing, and withdraw consent where consent is the basis. These rights are not unconditional. The GDPR & your rights page explains how to identify the relevant controller.

You can write to UNLIMIT DIGITAL LTD, FAO Data Protection, at 31–33 Worcester Street, Gloucester, England, GL1 3AJ. Describe your request and provide a safe reply address. Do not send passwords or unnecessary identity documents. A dedicated privacy email and operational case-handling team are still to be confirmed.

You may complain to the UK Information Commissioner’s Office or the competent European supervisory authority. You do not have to waive that right or accept these policies to raise a concern.

7A. Driver evidence and arrival messages

Driver Pool verification — right-to-work, driving licence, insurance and identity evidence submitted through Account → Driver Pool verification in the driver app — is now implemented. See section 7C for the full notice covering that processing. Business-directed driver compliance records (expiry dates, review decisions and reminders entered by a business for its own enrolled drivers) are implemented; their processing is determined by the engaging business as controller, and the business must provide drivers with the required transparency. The present business-application document facility does not verify drivers. Do not upload driver identity or insurance evidence there or place it in delivery notes.

Native tracking, route optimisation, shared-driver matching and SMS/WhatsApp arrival automation remain planned. Before any such module is activated, the responsible parties must complete the applicable notice and processing schedule: the evidence and contact data required, purpose and lawful basis, source, authorised recipients, country of work, hosting and transfers, retention and rights route. Collect sensitive information only where necessary and with any additional legal condition required.

For business-directed driver-check records, the engaging business determines and performs its required checks. The record includes reviewer, method, decision, restrictions and expiry, with evidence access limited to authorised reviewers. Drivers must be able to correct information and challenge a decision. Records must not be shared with another business merely because it uses this platform.

UK employee right-to-work evidence generally needs to be retained throughout employment and for two years afterwards under the prescribed checks. That does not authorise keeping all GPS, customer contacts or other records for the same period. Driver evidence must have its own reviewed schedule and must not inherit the 30-day business-application-document cleanup period.

Planned arrival messages will use the customer contact and permitted channel for the specific delivery. A receipt phone number does not demonstrate WhatsApp opt-in. The business must provide required information and permissions, respect applicable preferences, and keep service messages separate from marketing. Message providers, sender identities and international transfers must be disclosed before use.

7C. Driver Pool evidence wallet and identity tools

The Driver Pool evidence wallet collects the following categories of personal data from drivers who choose to build one: legal name, date of birth, vehicle category, right-to-work evidence (GOV.UK share code reference, or a photograph of a British or Irish passport or passport card), driving licence details and photographs (not required for Bicycle), delivery insurance details and certificate (not required for Bicycle), a live-capture identity selfie taken in the app, and truthfulness and terms declarations together with up to three separate consents (see below).

Processing step, purpose and lawful basis — (a) Capturing, encrypting and storing the evidence wallet documents and selfie, and a human reviewer visually comparing the selfie with the identity document photograph: the purpose is to operate the Driver Pool evidence wallet and sharing service; the lawful basis is UNLIMIT DIGITAL LTD's documented legitimate interests under Article 6(1)(f) UK GDPR in providing identity tooling to drivers and to the businesses that engage them. Per ICO guidance, photographs become biometric data only when processed by specific technical means for unique identification; a human reviewer comparing two photographs alongside each other is ordinary personal data processing and does not engage Article 9. (b) Automated face comparison where the driver has given explicit consent and the operator has enabled an automated provider: this step is biometric recognition; the lawful basis is the driver's explicit consent under Article 9(2)(a) UK GDPR. (c) AWS Face Liveness video processing where the driver has given explicit consent and the operator has enabled it: during a liveness session, video frames are streamed to Amazon Web Services in Ireland (EU, eu-west-1); this is also biometric recognition and relies on the driver's separate explicit consent under Article 9(2)(a) UK GDPR. (d) Comparing the reference selfie with the identity document photograph (document face match), whether by a human reviewer or an automated provider: the purpose is to confirm that the person submitting evidence holds the submitted document; lawful basis as (a) for the human path and as (b) for the automated path. (e) Periodic identity re-verification checks and sending push notifications about them, where an automated provider is configured and face-match consent is current: purpose is ongoing integrity of the wallet; lawful basis is the same legitimate interests as (a). (f) Sharing wallet documents and reference data with businesses the driver is actively enrolled with, with the driver's sharing consent: the purpose is to enable each business to carry out its own legally required checks; the lawful basis is the driver's consent under Article 6(1)(a) UK GDPR; each business acts as an independent controller for its own compliance records made using that evidence. (g) Recording declarations, consent versions and server timestamps: purpose is accountability; lawful basis is legitimate interests.

Three separate consents are presented on a dedicated Declarations screen, clearly labelled and not bundled with the driver terms. Consent (I): automated face comparison — you consent to the platform sending your selfie and an identity document photograph to AWS Rekognition in London (United Kingdom, eu-west-2) to compare them automatically. Consent (II): AWS Face Liveness video processing — you consent to video frames from a liveness session being streamed to Amazon Web Services in Ireland (EU, eu-west-1) for a certified liveness check. Consent (III): sharing with enrolled businesses — you consent to your Driver Pool profile documents, selfie and reference numbers (share code, passport number, licence number and policy number) being shared with the businesses you are actively enrolled with so they can carry out their legally required checks. Each consent is given separately and can be withdrawn at any time. Withdrawing the sharing consent switches Driver Pool off until it is given again. Withdrawing a biometric consent does not affect Pool access; the human-review path remains available. Biometric consents apply only when the operator has enabled the respective AWS feature and the operator's AWS account has opted out of AI-services data use under the AWS AI Services Opt-Out Policy. Consent wording version: consent.v2.

A Data Protection Impact Assessment is required before identity checks (selfie capture) can be enabled. The platform settings record when the DPIA acknowledgement was made and by whom; identity checks are not available until that acknowledgement exists. The DPIA requirement reflects the systematic monitoring of workers involved in the feature.

International transfers: AWS Rekognition CompareFaces runs in London (eu-west-2), which is in the United Kingdom; no transfer to the EEA is involved for that step. AWS Face Liveness runs in Ireland (eu-west-1), which is in the EEA; the transfer from the UK to the EEA relies on the adequacy regulations made under section 17A of the Data Protection Act 2018 (the UK–EU adequacy decisions in force on the date of transfer). Both steps are covered by the AWS Data Processing Addendum. AWS has opted out of using data submitted under these processing steps to improve its own AI models, confirmed by an AWS AI Services Opt-Out Policy applied by the operator to the AWS account covering these regions.

Recipients: (a) Where the driver has given sharing consent: businesses the driver is actively enrolled with, each acting as an independent controller for its own compliance records. Each such business controls its own processing of the evidence; you can ask it separately about your rights in its records. The business is required by law to keep right-to-work evidence for at least two years; withdrawing sharing consent does not erase what a business has already accessed. (b) Where the driver has given face-match consent and the operator has enabled it: AWS Rekognition in London as processor for the document and selfie comparison. (c) Where the driver has given liveness consent and the operator has enabled it: AWS in Ireland as processor for the liveness session. (d) Business-route notice: when a business records and confirms its own checks for a driver, the driver receives a notification naming the business. The business holds its own compliance records independently; that processing is the engaging business's controller responsibility. AWS Rekognition is listed in the Subprocessors register. No biometric template is stored by the platform or by AWS. The platform does not approve, verify or decline Pool drivers; its role is storing evidence and providing identity tooling.

No location metadata is retained from photographs. Every JPEG has its EXIF segments removed and every PNG has its text and location chunks removed before the file is encrypted and stored. The platform records only the document kind, size and a content digest; it never stores GPS coordinates from a selfie or document photo.

Retention — all wallet evidence (documents, selfie, reference data) is kept while the profile is active. After the driver withdraws the profile or the account is locked: documents are erased within 30 days; selfies are erased within 90 days. Face check selfies (identity re-verification): encrypted bytes are deleted within 30 days after the check is decided. GOV.UK share code: the code itself is deleted 90 days after the evidence is provided; outcome and dates remain. Events and audit records are kept; they contain no images or identifiers. The employer two-year right-to-work retention duty rests with each engaging business in its own compliance records, not with the platform. A retention hold can be placed on individual documents where legally necessary; holds are audited.

Evidence pack: the platform can export a ZIP archive (summary, document copies and event timeline) for the purposes of responding to a regulatory or law-enforcement request, a subject-access request, an internal audit or a legal hold. The export is audited with purpose, case reference and document count. For a subject-access request, the pack covers Driver Pool wallet records only; other records held by the platform are addressed through the standard data-rights process.

Disclosure to authorities: the platform may disclose personal data, including photographs and the evidence pack, to a regulator or law-enforcement authority where required by law or on a lawful written request relying on an applicable legal basis (for example Schedule 2 Part 1 paragraph 2 of the Data Protection Act 2018 for the prevention or detection of crime or the control of immigration). Any disclosure is approved by the data-protection contact, is limited to information reasonably necessary for the stated purpose, and the written request is retained for two years. You will ordinarily be informed before or after any such disclosure, except where the requesting authority provides a written statement that notification would prejudice the purpose of the request and an applicable exemption applies under the Data Protection Act 2018.

Security suspension: the platform may apply a security suspension (for fraud, impersonation or evidence integrity concerns) with a driver-visible reason. You can contact dropLog. through the Driver Pool profile screen in the app. This is distinct from a business declining to confirm its checks for you.

Consent withdrawal and contact: you can withdraw any of the three consents at any time from the Declarations card in the Driver Pool profile screen. Withdrawal of biometric consent takes effect immediately for future checks; it does not affect processing already completed. If you believe personal data about you has been handled incorrectly, you can write to UNLIMIT DIGITAL LTD, FAO Data Protection, 31–33 Worcester Street, Gloucester, England, GL1 3AJ. You may also complain to the ICO at ico.org.uk/make-a-complaint/ or to the competent supervisory authority.

7B. AI-assisted receipt reading — server-side processing

Where the platform administrator or business enables server-side receipt reading, the driver photographs a printed receipt; on-device optical character recognition extracts text; the extracted text and/or the image may then be sent to a third-party AI language model service to identify order number, customer name, delivery address and amounts. The result pre-fills the driver's order form as a suggestion only; the driver must check and confirm every field before saving.

The personal information submitted to an AI provider may include the customer's name, delivery address and telephone number, and order amounts visible on the receipt. The platform administrator selects the provider; the current options are Groq, Google Gemini, Anthropic Claude, OpenAI and self-hosted inference servers. The engaging business is the controller of receipt data; UNLIMIT DIGITAL LTD acts as its processor. The business must establish its own lawful basis (performance of its delivery service contract, or documented legitimate interests) and give customers and drivers the required transparency before enabling this feature.

UNLIMIT DIGITAL LTD does not store receipt content at AI providers for its own purposes beyond the immediate request. Each provider processes submitted data under its own terms; see the applicable provider privacy policy for the provider's own retention practices. Receipt images and confirmed order text are kept with the order record under the existing retention arrangements for deliveries described in section 6.

Where confirmed order details from a business's completed orders are retained internally as accuracy-improvement examples for that same business only, UNLIMIT DIGITAL LTD acts as controller for that processing, not as the business's processor. The lawful basis for that retention is UNLIMIT DIGITAL LTD's documented legitimate interests in improving reading accuracy, balanced against data-subject rights. That retained data is not used to train shared models and is not shared with other businesses.

No solely automated decision with a legal or similarly significant effect on any individual is made from receipt reading; a human driver confirms every order before it is saved. The business's lawful basis for submitting receipt content to an AI provider is performance of the delivery service contract, or its documented legitimate interests as controller. As processor for that submission, UNLIMIT DIGITAL LTD does not require a separate lawful basis. Providers based outside the UK/EEA require adequate transfer safeguards to be confirmed before appointment.

7C. Promotional messages and the tracking-page advertisement

UNLIMIT DIGITAL LTD is the controller for promotional messaging. When a customer gives consent during delivery tracking, we record: the mobile number (stored encrypted and as a one-way hash), the selected channels (SMS, WhatsApp or both), the date and time of the consent action, the version of the consent wording shown, the source order and the business associated with it, and the request context (IP address and session identifiers). We use this record solely to send promotional messages on behalf of restaurants and takeaways that use dropLog. and to honour withdrawals.

Messages are sent by SMS (using the dropLog sender name via PureSMS) and by WhatsApp (using a Meta-approved business account). We send at most one promotional message in any rolling 14-day period and at most two in a single UK calendar month. Messages are sent only between 10:00 and 19:00 Europe/London time. Every message identifies dropLog. as the sender acting on behalf of the named restaurant or takeaway.

Consent records are kept for 12 months after the last positive action (a consent given or renewed). When a consent lapses, we hold a suppression marker for 30 days and then delete the record. Withdrawal takes effect the same day through any of the routes described below. When you withdraw, your consent record is marked as inactive so no further promotional messages are sent; the record continues to act as a suppression marker with your encrypted number retained for up to 30 days, after which it is deleted. You may re-consent at any time by returning to the tracking page. Separately, platform administrators maintain a block list for platform-level suppression after complaints; entries on that list are created and managed by platform administrators only and are not affected by the customer withdrawal flow described here.

You can withdraw consent at any time by: following the Stop link included in every promotional message; visiting the tracking page for any of your recent orders and using the consent panel; or writing to us using the contact details in section 7 and stating that you object to promotional messages. We will apply the withdrawal the same day.

Businesses that use dropLog. submit promotional campaigns for administrator approval before any message is sent. Approval covers content only; it is not a warranty that the offer is accurate or that the business meets its legal obligations. Businesses never see whether any individual customer has given or withdrawn consent. Your consent status and your withdrawal are not disclosed to any restaurant or takeaway.

Where you view the tracking page for a delivery, an approved advertisement from a restaurant or takeaway that uses dropLog. may appear in the ad slot. This placement involves no external advertising networks, no cross-site tracking technologies and no cookies. One anonymous click through per order is recorded without identifying you as an individual. The lawful basis for this contextual placement is documented legitimate interests, subject to a balancing assessment completed before activation. You can ignore the advertisement without any effect on your delivery tracking.

8. Children, automated decisions and changes

This service is for business delivery operations, not a service directed at children. The current release does not use automated driver scoring or solely automated decisions producing legal or similarly significant effects on any individual. Native route planning remains a planned feature and will need fresh privacy assessment before activation. AI-assisted receipt reading is available as described in section 7B; it produces pre-filled suggestions subject to human confirmation by the driver and does not make solely automated decisions producing legal or similarly significant effects.

Account fields are necessary to create a workspace; if they are not provided, registration cannot complete. Optional notes should be limited to the delivery purpose. This version is a review draft, not evidence that every operational safeguard has been deployed. Material changes must be communicated before new processing begins.