These Data Processing Terms are made between the Customer that uses the DEL44 Service ("Customer" or "Controller") and Artificial Grass Online Ltd, trading as DEL44, a company registered in England and Wales under company number 10364075, whose registered office is at 5 Carnfield Place, Walton Summit, Bamber Bridge, PR5 8AN ("DEL44" or "Processor"). They form part of the Agreement described in the DEL44 Terms of Service at https://www.del44.com/terms.
1.1 Application. These Data Processing Terms apply to the processing of Customer Personal Data by DEL44 on behalf of the Customer in providing the Service. They are intended to meet the requirements of Article 28 of the UK GDPR.
1.2 Outside scope. These Data Processing Terms do not apply to personal data for which DEL44 is the controller, such as User account, sign-in, security, acceptance, billing, support and marketing data. That processing is described in the DEL44 Privacy Policy at https://www.del44.com/privacy.
1.3 Acceptance. These Data Processing Terms are accepted when the Customer accepts the Terms of Service. The version accepted is recorded as described in the Terms of Service.
2.1 Terms defined in the Terms of Service. Capitalised terms not defined here have the meanings given in the Terms of Service.
2.2 Data protection terms. "Controller", "processor", "data subject", "personal data", "personal data breach", "processing" and "supervisory authority" have the meanings given in the UK GDPR.
2.3 Other definitions. In these Data Processing Terms:
"Customer Personal Data" means personal data within Customer Data that DEL44 processes on the Customer's behalf, as described in Annex 1.
"Data Protection Law" means the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, each as amended or replaced from time to time.
"Restricted Transfer" means a transfer of Customer Personal Data to a country outside the United Kingdom that is subject to the restrictions in Chapter V of the UK GDPR.
"Sub-processor" means a third party engaged by DEL44 to process Customer Personal Data, as listed in Annex 3.
"UK GDPR" has the meaning given in section 3(10) of the Data Protection Act 2018.
3.1 Controller and processor. The Customer is the controller of Customer Personal Data and DEL44 is its processor.
3.2 Third-Party Services. Couriers, marketplaces, sales channels and other Third-Party Services that the Customer connects to the Service receive Customer Personal Data on the Customer's instructions under their own terms with the Customer. They are not Sub-processors of DEL44.
3.3 Navigation apps. Where a Driver opens a stop in Google Maps, Waze or Apple Maps on their device, the address is passed to that application at the Driver's choice. That application is not a Sub-processor of DEL44.
4.1 Annex 1. The subject matter, duration, nature and purpose of the processing, and the types of Customer Personal Data and categories of data subjects, are set out in Annex 1.
5.1 Lawful processing. The Customer is responsible for: (a) having a lawful basis for the processing of Customer Personal Data; (b) giving End Recipients, Drivers and other data subjects the privacy information required by Data Protection Law, including about Driver location tracking and the vehicle position visible on public tracking pages; (c) assessing whether a data protection impact assessment is required and carrying it out where it is; (d) choosing retention settings appropriate to its purposes; and (e) ensuring that its instructions comply with Data Protection Law.
5.2 Workplace monitoring. The Customer must inform Drivers about location recording before they use the Driver App and must not use the Service to monitor Drivers outside their delivery routes. DEL44 provides a template Driver notice that the Customer may adapt.
5.3 Special category data. The Customer must not use free-text fields to record special category data or criminal offence data unless strictly necessary for a delivery and lawful.
6.1 Instructions. DEL44 will process Customer Personal Data only on the Customer's documented instructions, including with regard to Restricted Transfers, unless required to do so by UK law. In that case DEL44 will inform the Customer of that legal requirement before processing, unless the law prohibits this on important grounds of public interest.
6.2 What counts as an instruction. The Customer's documented instructions are the Agreement, the configuration of the Service by the Customer, actions taken by its Users and Drivers in the Service, retention settings chosen by its Admins, integrations it enables, and other written instructions agreed by DEL44.
6.3 Unlawful instructions. DEL44 will inform the Customer immediately if, in its opinion, an instruction infringes Data Protection Law. DEL44 may suspend the affected processing until the instruction is confirmed or changed.
6.4 No other use. DEL44 will not process Customer Personal Data for its own purposes, will not sell it, and will not use it to train artificial intelligence models. DEL44 may create Usage Data, which does not identify any individual, from the Customer's use of the Service, and use it as permitted by the Terms of Service.
7.1 Personnel. DEL44 will ensure that persons it authorises to process Customer Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and that access is limited to those who need it.
8.1 Measures. Taking into account the state of the art, the costs of implementation, and the nature, scope, context and purposes of the processing and the risks to individuals, DEL44 will implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the UK GDPR. The measures in place at the Effective Date are described in Annex 2.
8.2 Updates. DEL44 may update the measures in Annex 2, provided that the overall level of security is not materially reduced.
8.3 Customer's security responsibilities. The Customer is responsible for the security of its Users' and Drivers' credentials and devices, for deciding whether to require two-factor sign-in for its Users, and for computers running Print Station.
9.1 General authorisation. The Customer gives DEL44 general written authorisation to engage Sub-processors. The Sub-processors in Annex 3 are authorised at the Effective Date.
9.2 Sub-processor terms. DEL44 will engage each Sub-processor under a written contract that imposes data protection obligations providing an equivalent level of protection to these Data Processing Terms, in particular sufficient guarantees to implement appropriate technical and organisational measures. DEL44 remains liable to the Customer for each Sub-processor's performance of those obligations, subject to clause 19.
9.3 Notice of changes. DEL44 will notify the Customer of any intended addition or replacement of a Sub-processor at least 30 days before the change, by email to the Customer's Admins and by updating Annex 3 at https://www.del44.com/dpa.
9.4 Objection. The Customer may object to a change on reasonable data protection grounds by notice to support@del44.com within 14 days after the notice. The parties will discuss the objection in good faith. If it is not resolved within 30 days, the Customer may end the Agreement by notice, and DEL44 will refund any Fees paid for the period after termination.
9.5 Urgent replacement. Where DEL44 must replace a Sub-processor urgently to protect the security or continuity of the Service, it may do so on shorter notice and will notify the Customer as soon as practicable. Clause 9.4 then applies.
10.1 Current transfers. The Customer authorises the Restricted Transfers described in Annex 3. DEL44's core hosting is in the United States, and its file storage is in Western Europe with a United States-based provider.
10.2 Safeguards. DEL44 will make a Restricted Transfer only where a safeguard recognised under Chapter V of the UK GDPR applies. For the United States, DEL44 relies on the UK Extension to the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the International Data Transfer Agreement or the International Data Transfer Addendum to the EU standard contractual clauses issued under section 119A of the Data Protection Act 2018, or on standard contractual clauses included in the Sub-processor's terms. For the European Economic Area, DEL44 relies on UK adequacy regulations.
10.3 Transfer risk assessments. Where DEL44 relies on the International Data Transfer Agreement, the Addendum or standard contractual clauses, it will carry out and document a transfer risk assessment and make a summary available to the Customer on request.
10.4 Lapse of safeguards. DEL44 will check each Sub-processor's certification on the Data Privacy Framework List at https://www.dataprivacyframework.gov before relying on it. If a safeguard ceases to apply, DEL44 will promptly put another recognised safeguard in place or stop the transfer, and will tell the Customer if this affects the Service.
10.5 Change of region. Moving processing to a different country or region is a change to which clause 9.3 applies, except that a move of processing into the United Kingdom requires notice only.
11.1 Assistance. Taking into account the nature of the processing, DEL44 will assist the Customer by appropriate technical and organisational measures, so far as possible, to respond to requests from data subjects to exercise their rights under Data Protection Law. The Service lets the Customer view, correct, export and delete Customer Personal Data, and DEL44 will provide further reasonable help on request.
11.2 Requests received by DEL44. If DEL44 receives a request from a data subject relating to Customer Personal Data, it will pass the request to the Customer without undue delay and will not respond to it except on the Customer's instructions or as required by law.
12.1 Other assistance. Taking into account the nature of the processing and the information available to it, DEL44 will assist the Customer in meeting its obligations under Articles 32 to 36 of the UK GDPR, covering security of processing, notification of personal data breaches to the ICO and to data subjects, data protection impact assessments, and prior consultation with the ICO.
12.2 Costs. DEL44 may charge reasonable costs for assistance under clauses 11 and 12 that goes beyond the features of the Service and information it makes generally available, except where the assistance is needed because of DEL44's breach of these Data Processing Terms.
13.1 Notification. DEL44 will notify the Customer without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting Customer Personal Data. Notice will be given by email to the Customer's Admins.
13.2 Content. So far as the information is available, the notice will describe: (a) the nature of the breach, including the categories and approximate number of data subjects and records concerned; (b) the name and contact details of the DEL44 contact from whom more information can be obtained; (c) the likely consequences of the breach; and (d) the measures taken or proposed to address the breach and reduce its possible adverse effects. Where information is not available at first, DEL44 will provide it in phases without undue further delay.
13.3 Response. DEL44 will take reasonable steps to contain and investigate the breach, and will cooperate with the Customer in its assessment and any notifications. The Customer is responsible for deciding whether to notify the ICO and data subjects, and DEL44 will not notify them on the Customer's behalf unless the Customer instructs it to or the law requires it.
13.4 No admission. Notification of a breach is not an admission of fault or liability by DEL44.
14.1 Automated retention. During the term, DEL44 applies the following automated retention, which the Customer instructs by accepting these Data Processing Terms and by its choice of settings:
| Customer Personal Data | Retention |
|---|---|
| Driver location points | 90 days by default, or 30, 60 or 180 days as chosen by the Customer's Admin; never more than 365 days |
| End Recipient personal data on completed orders (names, addresses, contact details, delivery notes, copies held elsewhere in the Service, and proof-of-delivery photographs and signatures) | Redacted 6 years after the order is delivered, cancelled, failed or returned by default, or after 1, 2 or 3 years as chosen by the Customer's Admin |
| Delivery notification logs (recipient, event and status) | 12 months |
| Print job records | 12 months |
| Webhook and integration logs | 90 days |
| Duplicate-request records from the Driver App | 7 days |
| Other order, delivery, route, shipment, courier and planning records | Until deleted by the Customer or the Customer's account is closed |
| Print Station log files on the Customer's computers | 14 days, after which Print Station deletes them automatically |
14.2 Deletion by the Customer. The Customer can delete individual orders at any time. Deleted data cannot be recovered.
15.1 Export. Before closing its Workspace, the Customer's Admin can download an export of orders, deliveries and proof-of-delivery links. The export lists proof-of-delivery photographs rather than including them. On request made before deletion, DEL44 will provide reasonable help to return other Customer Personal Data in a commonly used format.
15.2 Closure. When closure starts, access to the Service is withdrawn and integrations are switched off. The Customer may cancel a closure it started within 30 days.
15.3 Deletion. When the 30-day period ends, DEL44 deletes all Customer Personal Data and files held for the Customer and anonymises related audit log entries, unless UK law requires storage. This is the Customer's instruction to delete for the purposes of Article 28(3)(g) of the UK GDPR.
15.4 Residual copies. Any copies in DEL44's hosting provider's logs or backups are overwritten or expire under that provider's retention cycle, and in any event within 90 days of deletion. Until then they remain protected under these Data Processing Terms and are not actively processed.
15.5 Certification. On written request, DEL44 will confirm in writing that deletion has taken place.
16.1 Information. DEL44 will make available to the Customer all information necessary to demonstrate compliance with Article 28 of the UK GDPR, and will allow for and contribute to audits, including inspections, conducted by the Customer or an independent auditor mandated by the Customer.
16.2 Written information first. DEL44 may first respond to audit requests by providing written information, such as completed security questionnaires, descriptions of its measures and relevant certifications or reports held by its Sub-processors, where DEL44 is permitted to share them.
16.3 Conditions. Any audit or inspection must be on at least 30 days' written notice, during business hours, limited to DEL44's processing of the Customer's personal data, subject to appropriate confidentiality undertakings, and conducted so as to minimise disruption and protect the data of other customers. Audits are limited to one in any 12-month period, except following a personal data breach, at the request of the ICO, or where there is reasonable evidence of material non-compliance.
16.4 Costs. Each party bears its own costs of an audit, unless the audit reveals a material breach by DEL44 of these Data Processing Terms.
16.5 Regulators. Nothing in this clause limits the ICO's powers.
17.1 Records. DEL44 will maintain a record of processing activities carried out on behalf of the Customer as required by Article 30(2) of the UK GDPR and will make it available to the ICO on request.
18.1 Requests. If DEL44 receives a request from a public authority for disclosure of Customer Personal Data, it will notify the Customer where lawful, will disclose only what it is legally required to disclose, and will challenge requests it reasonably considers unlawful.
19.1 Limitation. Each party's liability under or in connection with these Data Processing Terms is subject to clause 23 of the Terms of Service. Nothing in these Data Processing Terms limits any data subject's rights against either party under Data Protection Law.
20.1 Precedence. In relation to the processing of Customer Personal Data, these Data Processing Terms prevail over the Terms of Service if there is a conflict. A data processing agreement signed by both parties for the same processing prevails over these Data Processing Terms.
20.2 Duration. These Data Processing Terms apply for as long as DEL44 processes Customer Personal Data, including after the Agreement ends until deletion under clause 15 is complete.
20.3 Changes. DEL44 may update these Data Processing Terms under clause 24 of the Terms of Service. Changes to Annex 3 follow clause 9.
20.4 Governing law. These Data Processing Terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
20.5 Contact. Questions about these Data Processing Terms can be sent to support@del44.com.
Subject matter. Provision of the DEL44 order, dispatch, courier and delivery management Service to the Customer.
Duration. The term of the Agreement and the period until deletion under clause 15 is complete.
Nature of processing. Collection, receipt, storage, organisation, retrieval, geocoding, route calculation, display to authorised Users, display on public tracking pages, transmission to Third-Party Services and to End Recipients by email and text message, redaction and deletion, as configured by the Customer.
Purposes. Importing and managing orders; fulfilment workflows; courier booking and label creation; route planning and optimisation; Driver assignment and Driver workflows; live tracking by dispatchers; public delivery tracking and arrival estimates; delivery notifications; proof of delivery; marketplace and sales channel fulfilment updates; printing; and support requested by the Customer.
Categories of data subjects. End Recipients and other customers of the Customer; Drivers, whether employees, workers or contractors of the Customer; and contacts named in orders or delivery instructions.
Types of personal data. Names; delivery addresses and postcodes; telephone numbers and email addresses; order references, contents and values; delivery instructions and notes; courier, shipment and tracking information; delivery status, events and timestamps; proof-of-delivery photographs and signatures; location associated with delivery events; Driver login details, assigned routes and vehicles; Driver location points during active routes; Driver App notification tokens.
Special category data. None intended. See clause 5.3.
Frequency. Continuous for the term of the Agreement.
Retention. As set out in clauses 14 and 15.
Access control. Individual logins for each User and Driver; role-based permissions controlled by the Customer's Admins; sign-in sessions that expire after 8 hours; limits on sign-in, two-factor, registration and password reset attempts by email address and IP address.
Authentication. Passwords stored only as bcrypt hashes; optional two-factor sign-in for Users using an authenticator application, which Admins can make compulsory; two-factor recovery codes that are single-use and stored only in hashed form; authenticator secrets stored encrypted.
Encryption. Integration credentials and two-factor secrets encrypted by DEL44's own software using Fernet (AES-128 with HMAC-SHA256) with a separately held key; stored data encrypted at storage level by DEL44's hosting provider; connections to the Service made over HTTPS.
Customer separation. Each Customer's data separated at database level using row-level security in strict mode and a restricted database role, applying also to audit records, acceptance records and recovery codes.
DEL44 personnel. Administrative access limited to a small number of authorised DEL44 personnel, each required to use two-factor sign-in; no feature allowing DEL44 personnel to sign in as a Customer's User; staff actions in DEL44's administration tools recorded in the audit log; two-factor sign-in enabled on DEL44's administrator accounts with its hosting, payment, messaging and code providers.
Audit logging. Audit log of sign-ins and failed sign-ins, password resets, invitations, User removals, Plan changes, data exports, refused location points, two-factor changes, acceptances of legal documents and staff actions, kept for 24 months.
Location minimisation. Continuous Driver location recorded only during an active route, with server-side refusal of points outside an active route and after the 14-hour inactivity cut-off; Customer-selectable retention periods.
File storage. Proof-of-delivery files, labels and logos held in private storage.
Data minimisation and retention. Automated daily deletion and redaction under clause 14.
Sub-processor management. Written data processing terms with each Sub-processor and review of transfer safeguards under clause 10.
Incident response. Breach handling and notification under clause 13.
| Sub-processor | Processing | Location | Transfer safeguard |
|---|---|---|---|
| Railway Corp. | Application server, database containing all Customer Personal Data, session and rate-limit store | United States (US East, Virginia) | International Data Transfer Addendum to the EU standard contractual clauses in Railway's data processing agreement |
| Vercel Inc. | Website and web application, including server functions | United States (Washington DC); static files from a global network | UK Extension to the EU-US Data Privacy Framework; International Data Transfer Agreement in Vercel's data processing terms |
| Cloudflare, Inc. (R2) | Private storage of proof-of-delivery photographs and signatures, labels and logos | Western Europe (provider based in the United States) | UK Extension to the EU-US Data Privacy Framework |
| Twilio Inc. | Delivery text messages to End Recipients and STOP handling | United States | UK Extension to the EU-US Data Privacy Framework; International Data Transfer Agreement in Twilio's data processing terms |
| Resend | Delivery emails to End Recipients, which may include proof-of-delivery photographs | United States | UK Extension to the EU-US Data Privacy Framework |
| Mapbox, Inc. | Address lookup, route directions and distances, and maps in the web application and public tracking pages | United States | UK Extension to the EU-US Data Privacy Framework |
| IDDQD Limited (Ideal Postcodes), operator of postcodes.io | Fallback postcode lookup. Receives only the postcode and the IP address of the request | United Kingdom, with hosting in the EU and delivery through Cloudflare's global network | No restricted transfer for UK processing; UK adequacy regulations for the EEA; UK Extension to the EU-US Data Privacy Framework for Cloudflare |
| Expo (650 Industries, Inc.) | Driver App notifications and over-the-air updates | United States | UK Extension to the EU-US Data Privacy Framework |
| Google LLC | Notifications to Android devices (Firebase Cloud Messaging) and maps in the Android Driver App | United States | UK Extension to the EU-US Data Privacy Framework |
| Apple Inc. | Notifications to iPhones and maps in the iPhone Driver App | United States | Standard contractual clauses in Apple's terms |