Privacy Policy

1. Introduction

This Privacy Policy explains how EcoQuick (“EcoQuick”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data when you use our website, mobile application, and related services (together, the “Platform”) to send or receive hyper-local same-day parcel deliveries in the United Kingdom.

We handle personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy applies to:

• check_circleCustomers who browse the Platform, request quotes, or book deliveries — you can review services without an account, but must register to complete checkout
• check_circleIndependent riders who register to perform deliveries via the Platform
• check_circleVisitors to our website

2. Who We Are

EcoQuick is the data controller responsible for the personal data described in this policy.

• check_circleCompany name and registration number: EcoQuick Parcel Delivery Services Limited, Company No. 16192069
• check_circleRegistered office address: 24 Park Road House, Park Road, Kingston Upon Thames, England, KT2 6DF
• check_circleContact for privacy matters: support@ecoquickdelivery.co.uk or call +44 7417 366028

3.1 Data We Collect — Customers

You can browse the Platform and review orders or pricing without creating an account. However, to complete checkout and place a booking, you must register for an account. When you register and make a booking, we may collect:

• check_circleFull name, email address, and phone number
• check_circlePickup and drop-off addresses
• check_circleParcel description and, where applicable, declared value
• check_circlePayment details, processed by our payment provider, Stripe (we do not store full card numbers)
• check_circleAccount login credentials
• check_circleRecords of your communications with our customer support team

3.2 Data We Collect — Independent Riders

To onboard as a rider, our current process (carried out manually while our rider portal is being built) collects the following:

For motorbike riders:

• check_circleFull name, address, phone number, and email address
• check_circleDriving licence details
• check_circleVehicle details
• check_circleProof of courier insurance
• check_circleEmergency contact information

For bicycle riders

• check_circleIdentity verification documents
• check_circleEmergency contact details
• check_circleA signed rider agreement

3.3 Technical and Location Data

When you use our website or app, we automatically collect:

• check_circleDevice and browser information
• check_circleIP address
• check_circleLocation data used to plan and track deliveries, via our mapping providers (Mapbox and Ordnance Survey)
• check_circleApp usage and diagnostic data
• check_circleCookies and similar technologies (see our separate Cookie Policy for details)

5. Cookies

Our website and app use cookies and similar technologies to operate core functionality, remember your preferences, and understand how the Platform is used. Full details, including how to manage your preferences, are set out in our separate Cookie Policy.

6. Who We Share Your Data With

We only share personal data where necessary, and currently share it with:

• check_circleIndependent riders, limited strictly to the information needed to complete a specific delivery (such as names, addresses, contact numbers, and parcel details). Riders are independent contractors, not EcoQuick employees, and must use this information solely to complete that delivery.
• check_circleService providers who process data on our behalf, including Stripe (payments), Supabase (database, authentication, and storage), Vercel (application hosting), Hostinger (domain management), and Mapbox and Ordnance Survey (mapping and routing)
• check_circleProfessional advisers, including insurers, accountants, and legal advisors, where relevant to operating our business
• check_circleRegulators and law enforcement agencies, where we are required to do so by law
• check_circleA buyer or successor business, in the event of a merger, acquisition, or restructuring

7. International Data Transfers

Some of our service providers are based or host data outside the UK. Where personal data is transferred outside the UK, we ensure an appropriate safeguard is in place to protect it.

Our primary database and authentication provider, Supabase, hosts EcoQuick’s data in the West EU (Ireland) region. Ireland is an EU member state and is covered by the UK’s adequacy regulations, meaning the UK government has determined that the EU provides an equivalent level of data protection to the UK. No additional transfer mechanism is therefore required for data held by Supabase.

Our hosting provider, Vercel, operates a globally distributed content delivery network. Application traffic may be routed through servers outside the UK as part of normal CDN operation; however, no personal data is stored persistently by Vercel beyond access logs, which are subject to appropriate safeguards under Vercel’s data processing terms.

Our payment provider, Stripe, and mapping providers, Mapbox and Ordnance Survey, may also process data outside the UK. Each provider operates under appropriate contractual safeguards including standard contractual clauses or applicable adequacy decisions.

8. Data Retention

We keep personal data only for as long as necessary for the purposes described in this policy, including to meet legal, accounting, or reporting requirements. Our retention periods are as follows:

• check_circleCustomer account data: retained for the duration of your account, plus 12 months after closure to allow resolution of any post-closure disputes or queries
• check_circleBooking and delivery records: retained for 3 years from the date of the delivery, covering the standard limitation period for contractual disputes
• check_circleProof of delivery records: retained for 24 months from the date of delivery for dispute resolution and audit purposes
• check_circleRider verification documents (driving licence, insurance, identity documents): retained for the duration of the rider’s active account, plus 12 months after departure
• check_circleFinancial and payment records: retained for 6 years, as required by HMRC
• check_circleCustomer support communications: retained for 2 years from the date of the communication
• check_circleTechnical and diagnostic logs: retained for 12 months for security monitoring purposes
• check_circleMarketing consent records: retained for the duration of consent, plus 3 years after withdrawal, as required under PECR

9. How We Protect Your Data

We take the security of your personal data seriously. Measures we currently use include:

• check_circleHTTPS and TLS encryption of data in transit
• check_circleAES-256 encryption of data at rest
• check_circleRole-based access controls and row-level security within our database
• check_circleSecure authentication managed through Supabase Auth

10. Your Rights

Under UK GDPR, you have the right to:

• check_circleAccess the personal data we hold about you
• check_circleRequest correction of inaccurate data
• check_circleRequest erasure of your data, in certain circumstances
• check_circleRestrict or object to certain types of processing
• check_circleRequest portability of your data
• check_circleWithdraw consent, where processing is based on consent

11. Children’s Privacy

Our Platform is intended for use by individuals aged 18 and over. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time, for example to reflect changes to our services or to the law. Where changes are material, we will notify active users by email or in-app notice. The “last updated” date at the top of this policy shows when it was last revised.

4. How We Use Your Data, and Our Legal Basis

We rely on different legal bases depending on the purpose of processing, as summarised below.

To exercise your rights, contact us at support@ecoquickdelivery.co.uk. We will respond to your request within one month, as required by law.

If you are unhappy with how we have handled your personal data, you also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.