Privacy Policy

Last updated: 21 March 2026

1. Who We Are

Deliverman ("we", "us", "our") is a multi-tenant SaaS platform operated by BIT Develop Ltd, registered in England and Wales. We provide fleet and workforce management software for Delivery Service Providers (DSPs) operating in the United Kingdom.

Data Controller: BIT Develop Ltd
Contact: privacy@deliverman.com

2. What Data We Collect

2.1 DSP Company Data (Tenant)

• Company name, address, registration number

• VAT registration number

• Bank details for payment processing

• Amazon DSP credentials and operational data

2.2 Driver & Staff Personal Data

• Full name, email address, phone number, date of birth

• National Insurance (NI) number

• Unique Taxpayer Reference (UTR)

• VAT registration number (if applicable)

• Driving licence number and DVLA check results

• Bank account details for invoicing

• Home address and emergency contact

• Profile photo and clock-in selfies

• Employment/engagement status and onboarding documents

2.3 Operational Data

• GPS location data (clock-in/out geofencing, trip logging)

• Vehicle inspection photos and reports

• Route assignments and delivery performance metrics

• Timesheets, invoices, and payment records

• Signed documents and electronic signatures

• Training completion records and certificates

2.4 Technical Data

• IP address, browser type, device information

• Audit trail logs (actions, timestamps, user agent)

• Authentication tokens (JWT)

3. Legal Basis for Processing

We process personal data under the following UK GDPR lawful bases:

• Contract performance (Art. 6(1)(b)) — Processing necessary to provide our platform services to DSPs and their drivers

• Legal obligation (Art. 6(1)(c)) — HMRC tax compliance (VAT checks, UTR validation), DVLA licence verification, employment law compliance

• Legitimate interest (Art. 6(1)(f)) — Fraud prevention, platform security, performance analytics, operational efficiency

• Consent (Art. 6(1)(a)) — Optional features such as GPS trip logging, push notifications, WhatsApp notifications

4. How We Use Your Data

• Workforce scheduling, roster management, and dispatch

• Invoice generation, payment processing, and financial reporting

• Vehicle fleet management, inspections, and maintenance tracking

• Driver onboarding, document signing, and compliance verification

• DVLA driving licence checks (automated, staggered over 30-day cycles)

• HMRC VAT number verification for self-employed contractors

• Performance scoring and bonus calculations

• Training delivery and certification

• Communication via email, push notifications, and in-app messaging

5. Third-Party Processors

We share data with the following processors, all of whom are contractually bound to protect your data:

• Cloudflare (R2 Storage) — File and document storage

• Railway — Backend hosting (EU/UK region)

• Vercel — Frontend hosting

• Resend — Transactional email delivery

• Firebase (Google) — Push notifications (FCM)

• Stripe — Payment processing

• Yapily — Open banking payment initiation

• Xero — Accounting integration (when enabled by tenant)

• HMRC — VAT number verification (government API)

• DVLA — Driving licence checks (government service)

• Meilisearch — In-app search indexing

We do not sell your personal data to any third party.

6. Data Retention

• Active account data — Retained while the tenant account is active

• Audit logs — 12 months rolling retention, then automatically purged

• Signed documents — Retained for the duration required by UK law (typically 6 years for employment/tax records)

• Deleted records — Soft-deleted (marked as deleted but retained for legal compliance), hard-deleted after retention period

• DVLA check results — Retained for 13 months (rolling annual cycle)

• Invoice and payment records — 7 years (HMRC requirement)

7. Data Security

• All data transmitted over HTTPS/TLS encryption

• Schema-based multi-tenant isolation — each DSP's data is stored in a separate database schema, preventing cross-tenant access

• JWT authentication with short-lived access tokens and refresh rotation

• Role-based access control (RBAC) with feature-level permission gating

• Append-only audit trail on all data mutations

• Secrets managed via environment variables, never hardcoded

• Pre-signed URLs for secure file uploads (no direct storage access)

8. Your Rights (UK GDPR)

You have the right to:

• Access — Request a copy of your personal data

• Rectification — Correct inaccurate or incomplete data

• Erasure — Request deletion of your data (subject to legal retention requirements)

• Restriction — Limit how we process your data

• Portability — Receive your data in a machine-readable format

• Object — Object to processing based on legitimate interest

• Withdraw consent — Where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at privacy@deliverman.com. We will respond within 30 days.

9. Cookies

Deliverman uses only essential cookies and localStorage for authentication (JWT tokens) and user preferences (language, theme). We do not use tracking cookies, analytics cookies, or third-party advertising cookies.

10. International Transfers

Your data is primarily processed within the United Kingdom and European Economic Area. Where data is transferred to processors outside the UK/EEA (e.g., Firebase for push notifications), appropriate safeguards are in place including Standard Contractual Clauses (SCCs) and adequacy decisions.

11. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via the platform. The "Last updated" date at the top indicates the most recent revision.

12. Complaints

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113