Privacy Policy

1. About this Privacy Policy

This policy applies to customers, business account users, delivery recipients, drivers, fleet partners, website visitors, support contacts and people who contact us by phone, email, web form, chat or social media.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Dropdsh is the controller of the personal information described in this policy, except where we explain that another organisation is responsible.

2. Personal information we collect

2.1 Account information

• name, email address and phone number;
• password or other login credentials;
• account type and profile photo;
• communication and marketing preferences; and
• support history.

2.2 Customer and booking information

• pickup and drop-off addresses, including saved addresses;
• recipient name and phone number;
• delivery notes and instructions;
• package description, package photos, item category and declared item value;
• selected cover level;
• order, cancellation and dispute history; and
• reviews and ratings.

2.3 Business account information

• business name, company number and VAT number;
• billing address and business contact details;
• staff users and account permissions;
• monthly invoice details and API usage;
• business delivery history; and
• recipient details supplied by the business.

If a business customer gives us a recipient's name, address, phone number or delivery instruction, we use it to arrange and manage the delivery.

2.4 Driver and fleet partner information

• name, address, email address, phone number, date of birth and profile photo;
• driving licence and right-to-work information;
• vehicle details and vehicle registration number;
• insurance documents, MOT details and proof of address;
• DBS status where required for selected work;
• bank details for payouts;
• ratings, job acceptance and cancellation history;
• earnings and payout history;
• location data during active deliveries; and
• incident reports, support messages and appeal records.

2.5 Location and tracking information

We may collect driver location data when the driver is online, has accepted a job, is travelling to pickup, is completing a delivery, when live tracking is required, or when an incident, SOS, failed delivery or dispute occurs. Live tracking is intended to stop when the delivery is completed, cancelled or no longer active. Customers may see limited live driver location only for their own active delivery.

2.6 Payment and wallet information

• payment status, transaction reference and amount;
• refund status;
• wallet and Dash Coins balances;
• top-up and payout records;
• invoice records; and
• card payment status returned by our payment provider.

We do not store full card numbers. Card payments are processed by Stripe, which handles payment information under its own privacy terms.

2.7 Device, app and technical information

• IP address, device type and operating system;
• app version and browser type;
• device identifiers and push notification token;
• login, fraud and security logs;
• crash reports;
• cookie identifiers; and
• analytics events.

2.8 Communications

We may collect messages and records from support tickets, live chat, driver and customer chat, emails, phone calls, SMS, WhatsApp or similar messaging services where used, complaint forms, dispute evidence and reviews. Driver and customer chat may be stored for safety, support, dispute and audit purposes.

3. How we collect personal information

We collect information directly from you when you create an account, book a delivery, create a business account, register as a driver, upload driver documents or delivery evidence, use live tracking, make or receive payments, contact support, use referral or promotion features, leave a review, or otherwise use our website or app.

We may also receive information from business customers who provide recipient details, from drivers who provide delivery evidence, from fleet partners, payment and identity-verification providers, and from administrators who record operational notes.

Where information is required to create an account, make a booking, verify a driver, take payment or comply with law, failing to provide it may mean that we cannot provide the relevant service.

4. Why we use personal information

Where we rely on legitimate interests, our interests include operating a reliable logistics platform, protecting users, preventing fraud, resolving disputes and improving our services. We assess whether those interests are overridden by your rights and freedoms.

Driver documents may reveal special category data or criminal-offence information. We process this only where permitted by data protection law and, where required, under an additional condition in the Data Protection Act 2018—for example for legal obligations, safeguarding, insurance, preventing fraud or establishing legal claims.

5. Driver location data

We use driver location data to:

• show customers live delivery progress;
• help drivers navigate;
• support dispatch and operations;
• confirm pickup and delivery events;
• prevent fraud;
• investigate complaints, failed deliveries and disputes; and
• improve safety and service performance.

Customers only see live driver location for their own active order. We do not show a customer a driver's location when the driver is offline or not assigned to that customer's order.

6. Delivery proof, photos and signatures

Drivers may be required to upload pickup proof, delivery proof, failed-delivery proof, damage proof, vehicle-recovery condition photos, signature proof and OTP/PIN confirmation.

Proof may include a timestamp, GPS location, order ID, driver ID and proof type. We use it to confirm delivery, protect customers, support drivers, investigate disputes and prevent fraud.

7. Dash Coins, referrals and promotions

If we offer Dash Coins, wallet credits, referral bonuses or promotions, we may use personal information to issue credits, prevent abuse, track referrals, process refunds for unused purchased credits, apply expiry rules to bonus or referral credits and manage promotion eligibility.

Bonus and referral credits may have different rules from purchased credits. The applicable Dash Coins and referral terms provide the full rules.

8. Marketing

We may send marketing messages where permitted by law. You can opt out at any time using the unsubscribe link, changing your app preferences or contacting hello@dropdsh.co.uk. Where we rely on consent, withdrawing it does not affect processing carried out before withdrawal.

Service messages are not marketing. We may still send important messages about your account, order, payment, delivery, driver status, support request or security.

9. Cookies and similar technologies

Our website and app may use cookies, pixels, software development kits, local storage and similar technologies. We use essential technologies to make the service work and keep it secure.

We ask for consent before using non-essential technologies, such as analytics or advertising cookies, unless a legal exemption applies. You can accept or reject non-essential cookies through our cookie banner and can change your choice by clearing the saved preference and revisiting the site. Rejecting non-essential technologies does not prevent access to core services.

10. Who we share personal information with

We may share only the information reasonably necessary with:

• drivers, delivery partners and fleet partners completing a delivery;
• customers and recipients where needed for tracking, communication and proof;
• payment providers, including Stripe;
• mapping and geocoding providers;
• SMS, email, push-notification and communication providers;
• hosting and cloud providers;
• analytics providers where permitted;
• customer-support tools;
• identity, document or DBS-verification providers;
• accountants, auditors and professional advisers;
• insurers or cover providers where applicable;
• law enforcement, regulators or courts where required; and
• buyers, investors or advisers if we restructure, sell or transfer part of the business.

We do not sell personal information.

11. International transfers

Some suppliers may process personal information outside the UK. Where this happens, we use a lawful transfer mechanism and appropriate safeguards where required. These may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses or another legally recognised mechanism. Contact us if you would like more information about the safeguard used for a particular transfer.

12. How long we keep personal information

We keep personal information only for as long as necessary for the purpose for which it was collected. We consider contractual, operational, tax and accounting requirements; safety and fraud risks; limitation periods; ongoing disputes; and legal or regulatory duties. Our current retention framework is:

We may keep information longer if a legal hold, complaint, dispute, fraud concern or regulatory request applies. When information is no longer needed, we delete it securely or anonymise it.

13. Your data protection rights

Depending on the circumstances and the lawful basis used, you may have the right to:

• access your personal information;
• correct inaccurate or incomplete information;
• request deletion;
• restrict processing;
• object to processing;
• request data portability; and
• withdraw consent where processing is based on consent.

To exercise a right, email hello@dropdsh.co.uk. We may need to verify your identity. We normally respond within one month, subject to lawful extensions for complex or multiple requests. Rights are not absolute and we will explain if an exemption applies.

14. Complaints

If you believe we have not handled personal information properly, email hello@dropdsh.co.uk with enough information for us to investigate. We facilitate complaints electronically and by other reasonable means. In accordance with the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, we will acknowledge a data protection complaint within 30 days and respond to it without undue delay, keeping you informed where appropriate.

You also have the right to complain to the UK's independent data-protection regulator, the Information Commission (commonly known through the ICO service). You can use the ICO complaint service, call 0303 123 1113, or write to ICO Head Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester, M1 7BL. We would appreciate the opportunity to address your concern first, but you do not have to contact us before approaching the regulator.

15. Security

We use appropriate technical and organisational measures designed to protect personal information, including access controls, encryption, secure authentication, role-based permissions, audit logs, secure file storage, staff access controls, monitoring for misuse, and backup and recovery procedures.

No online service is completely risk-free. Keep your login details secure and tell us immediately if you believe your account has been compromised.

16. Children

Dropdsh is not intended for children. Drivers must meet the minimum age, licensing, insurance and legal requirements that apply to their work. Customers must be legally able to enter into a contract with us. If you believe a child has provided personal information contrary to these requirements, contact us so we can investigate and take appropriate action.

17. Automated decision-making and fraud checks

We may use automated or semi-automated checks to detect suspicious activity, prevent fraud, assess driver eligibility for certain jobs, identify high-risk orders, flag unusual cancellation or refund patterns and protect customers, drivers and the platform.

Important account, suspension, refund, dispute or driver-approval decisions may be reviewed by a member of our team where appropriate. If a solely automated decision produces a legal or similarly significant effect, we will provide the information and safeguards required by law, including a way to request human intervention and challenge the decision where applicable.

18. Drivers and self-employed status

We use driver information to manage driver accounts, job allocation, delivery evidence, payouts, compliance and safety.

Using the Dropdsh platform does not automatically make a driver an employee. Driver status depends on the real working relationship and applicable law. Drivers should read the Driver Partner Agreement before registering.

19. Business customer recipient data

Business customers may provide recipient information so we can complete deliveries. Business customers must ensure they are allowed to provide this information and should tell recipients how it will be used.

Depending on the arrangement, a business customer and Dropdsh may act as separate controllers, joint controllers, or controller and processor. Larger or more complex arrangements may require a separate data processing or data sharing agreement.

20. Changes to this Privacy Policy

We may update this policy from time to time. If we make an important change, we may notify you by email, app notification, website notice or dashboard message. The effective date and the page's last-updated date show when the current version applies.

We keep previous versions where necessary for legal, audit and dispute purposes.

21. Contact us