1.1 Controller. DEL44 is operated by Artificial Grass Online Ltd, a company registered in England and Wales under company number 10364075, whose registered office is at 5 Carnfield Place, Walton Summit, Bamber Bridge, PR5 8AN ("DEL44", "we", "us" and "our").
1.2 ICO registration. We are registered with the Information Commissioner's Office ("ICO") under registration number ZB940283.
1.3 Privacy contact. For any question about this Privacy Policy or your personal data, contact support@del44.com or write to us at our registered office, marked for the attention of the privacy contact.
2.1 What this policy covers. This policy explains how we handle personal data in connection with the DEL44 order, dispatch, courier and delivery management platform, including our website at https://www.del44.com, the web application, the DEL44 Driver App, Print Station and public delivery tracking pages (together, the "Service").
2.2 Who this policy is for. This policy is relevant to: (a) people at our business customers who use or are contacts for the Service ("Users" and "Customer Contacts"); (b) drivers who use the Driver App for our customers ("Drivers"); (c) people receiving deliveries from our customers ("End Recipients"); and (d) visitors to our website.
2.3 Business service. The Service is supplied only to UK limited companies and limited liability partnerships ("Customers"). Our Terms of Service at https://www.del44.com/terms and Data Processing Terms at https://www.del44.com/dpa govern our relationship with Customers.
2.4 Applicable law. We handle personal data in line with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 ("PECR").
3.1 When we are the controller. We are the controller of personal data we use to run our own business, including User accounts, sign-in and security records, records of acceptance of our legal documents, billing information, support communications and marketing.
3.2 When we are a processor. When a Customer uses the Service to manage its orders and deliveries, the Customer is the controller of the personal data of its End Recipients and Drivers, and we process that data on the Customer's behalf under our Data Processing Terms. This includes recipient names, addresses and contact details, delivery notes, proof of delivery and Driver location.
3.3 What this means for you. If you are an End Recipient or a Driver, the business that delivers to you or engages you decides how your data is used and is responsible for answering your questions and requests. Sections 6 to 8 explain how the Service handles that data so that you understand what happens to it, but the Customer's own privacy notice governs its use.
4.1 Registration. When a Customer registers, we collect the company name and UK company number, and the full name, email address and password of the person registering. Passwords are stored only as one-way hashes.
4.2 Users. When a User is invited, we collect their name, email address, role and permissions, and any two-factor sign-in settings they choose.
4.3 Billing. We collect billing contact details, the Plan selected, subscription status, payment history, Stripe customer references and VAT invoice records. Card details are entered directly with Stripe and we do not receive or store full card numbers.
4.4 Support and correspondence. We keep emails and other messages you send us and our replies.
4.5 Marketing preferences. We record whether you have opted out of marketing email or marketing text messages.
5.1 Sign-in and security records. We record sign-ins and failed sign-ins, password resets, invitations, two-factor changes, User removals, Plan changes, data exports and similar events in our audit log, with the date and time, the person involved and, where available, the IP address.
5.2 Acceptance records. When a User accepts our Terms of Service and Privacy Policy, we record the User's name and email address, the Customer's company name and company number, the date and time, the version of each document accepted, and the IP address and browser details used. Each record holds these details itself, so it continues to show who accepted after the User's account is removed.
5.3 Technical data. Our hosting providers process IP addresses and request data in server logs to deliver and secure the Service.
5.4 No analytics or advertising tracking. We do not use analytics or advertising tools on our website or web application, and we do not use social media pixels or session recording tools. Our fonts are served from our own website.
6.1 End Recipients. For Customers, the Service processes End Recipients' names, delivery addresses and postcodes, telephone numbers, email addresses, order references and contents, delivery instructions, courier and tracking information, delivery status and timestamps, and proof of delivery.
6.2 Drivers. For Customers, the Service processes Drivers' names, login details, assigned routes and vehicles, delivery progress, delivery events, location as described in section 7, and the device token used to send notifications to the Driver App.
6.3 Sources. This information is entered by the Customer and its Users, imported from the sales channels the Customer connects, received from the couriers the Customer uses, or generated when Drivers use the Driver App.
7.1 When location is recorded. The Driver App records location continuously only while the Driver's own route is in progress. Recording starts only after the Driver taps Start Route and our system has recorded the start of the route. While recording, the Driver App records a location point roughly every 75 metres or 50 seconds.
7.2 Single readings. The Driver App also takes one location reading when the Driver taps Start Route, Arrived, Delivered or Failed. Location permission for these single readings is optional.
7.3 When recording stops. Recording stops when the route is completed or cancelled, the Driver signs out, location permission is withdrawn or the Driver's sign-in is rejected. The Driver App checks every 3 minutes whether the route is still in progress. Our servers refuse location points that arrive when a route is not in progress, and refuse them for a route that has been in progress for more than 14 hours with no delivery activity in the previous 14 hours. Refused points are not stored, and each refusal is recorded in our audit log.
7.4 Visibility to the Driver. Android devices display a permanent notification while location is recorded, and iPhones show the system location indicator.
7.5 Who sees location. The Customer's dispatchers see Driver location on the route. End Recipients see the vehicle's position on the public tracking map. Location is also used to send "driver nearby" notifications and to estimate arrival times.
7.6 Retention. Driver location points are deleted automatically after 90 days unless the Customer chooses 30, 60 or 180 days. Different periods up to 365 days apply only where agreed with a Customer in writing.
8.1 Proof of delivery. Drivers can capture photographs and signatures as proof of delivery. These are stored privately in our file storage and may be included in delivery confirmation emails sent on the Customer's behalf.
8.2 Public tracking page. End Recipients can follow a delivery on a public tracking page, which shows delivery status and, while the route is in progress, the vehicle's position on a map. The map is provided by Mapbox, which receives the visitor's IP address and map requests when the page loads. We have switched off Mapbox's usage reporting.
8.3 Delivery notifications. The Service sends delivery status emails and text messages to End Recipients on the Customer's behalf, such as scheduled, out for delivery, driver nearby, delivered, failed and rescheduled messages.
9.1 Companies House. When a Customer registers, we check the company number against the Companies House register to confirm that the company or limited liability partnership is active.
9.2 Stripe. Stripe tells us whether payments have succeeded or failed and gives us limited details about the payment method, such as card type and last four digits.
9.3 Your colleagues. Admins at a Customer give us the names and email addresses of the Users and Drivers they invite.
10.1 Purposes and lawful bases. Where we are the controller, we use personal data for the purposes below. Where we rely on legitimate interests, we have balanced our interests against your rights and you may ask us for details.
| Purpose | Information used | Lawful basis |
|---|---|---|
| Creating and managing accounts, verifying the Customer and providing the Service | Registration, User and Customer details | Legitimate interests in providing the Service our Customers have contracted for |
| Authenticating Users and keeping the Service secure, including audit logs and limits on sign-in attempts | Sign-in, security and technical data | Legitimate interests in protecting the Service, and our legal obligation to keep personal data secure |
| Recording acceptance of our legal documents | Acceptance records | Legitimate interests in being able to show which terms apply |
| Billing, VAT invoicing and accounting | Billing and payment records | Legal obligation to keep tax and accounting records, and legitimate interests in collecting payment |
| Providing support | Support correspondence | Legitimate interests in helping our Customers |
| Sending service messages, such as invitations, password resets, verification, welcome and billing messages | Name and contact details | Legitimate interests in operating accounts |
| Monitoring fair use of Plans | Counts of deliveries and Print Stations per Customer | Legitimate interests in managing our Plans |
| Sending marketing to Users and Customer Contacts | Name, business email and telephone number, marketing preferences | Legitimate interests in promoting our products to business customers |
| Establishing, exercising or defending legal claims | Any relevant information | Legitimate interests in protecting our legal position |
| Restructuring or selling our business | Any relevant information | Legitimate interests in reorganising our business |
| Complying with law and requests from authorities | Any relevant information | Legal obligation |
10.2 Processor activities. Where we act as a processor under section 3.2, the Customer decides the lawful basis for processing End Recipient and Driver data.
10.3 Failure to provide information. If a Customer or User does not provide information we need to create or secure an account, we cannot provide the Service.
11.1 Who receives marketing. We may send marketing emails and text messages about DEL44 products, features and offers to Users and Customer Contacts at our Customers. We do not send marketing to End Recipients or Drivers.
11.2 Identifying us and opting out. Every marketing message identifies DEL44 and gives a simple way to opt out. Each marketing email contains a one-click unsubscribe link, and you can reply STOP to any marketing text message. You can also opt out at any time by contacting support@del44.com.
11.3 Text messages. We send marketing text messages only to business telephone numbers provided for the Customer, or to other numbers where PECR permits, including where you have consented.
11.4 Your right to object. You have an absolute right to object to direct marketing. If you opt out, we will stop sending you marketing and keep a record of your choice so that we do not contact you again.
11.5 Service messages continue. Marketing preferences are kept separately from service messages. Opting out of marketing does not stop account, security, billing or delivery messages.
12.1 Who we use. We use the following service providers to operate the Service. Those that process Customer data on our behalf are our sub-processors under the Data Processing Terms.
| Provider | What it does | Location of processing |
|---|---|---|
| Railway | Application server, database containing all Customer data, session and rate-limit store | United States (US East, Virginia) |
| Vercel | Website and web application | United States (server functions in Washington DC); static files from a global network |
| Cloudflare (R2) | Private storage of proof-of-delivery photographs and signatures, labels, logos and Print Station installers | Western Europe; Cloudflare, Inc. is based in the United States |
| Stripe | Subscription payments, SMS credit top-ups and billing portal | United States |
| Twilio | Delivery text messages to End Recipients, account text messages, marketing text messages and STOP handling | United States |
| Resend | Account emails, delivery emails to End Recipients (which may include proof-of-delivery photographs) and marketing emails | United States |
| Mapbox | Main address lookup, route directions and distances, and maps in the web application and on public tracking pages | United States |
| postcodes.io (IDDQD Limited, Ideal Postcodes) | Fallback postcode lookup. Receives only the postcode and the IP address of the request | UK company; hosted in the UK and EU and delivered through Cloudflare's global network |
| Expo (650 Industries, Inc.) | Driver App notifications and over-the-air Driver App updates | United States |
| Notifications to Android devices (Firebase Cloud Messaging) and maps in the Android Driver App | United States | |
| Apple | Notifications to iPhones and maps in the iPhone Driver App | United States |
| Xero (UK) Limited | Issuing VAT invoices and keeping accounting records | United States (hosted on Amazon Web Services) |
| Companies House | Checking a Customer's company number at registration (lookup only) | United Kingdom |
12.2 Safeguards. Our service providers may use personal data only to provide services to us, under written terms that require them to protect it. We remain responsible to our Customers for our sub-processors under the Data Processing Terms.
12.3 Not used. We do not use artificial intelligence or large language model services, error-tracking services or external logging services. Route optimisation runs on our own servers.
12.4 Changes. We tell Customers about new sub-processors in the way described in our Data Processing Terms and keep this list up to date.
13.1 Connected services. Customers can connect the Service by direct API to their own accounts with couriers, including Evri, DX, DHL Express, FedEx, InPost and Royal Mail (through ProShipping), and with sales channels, including Shopify, eBay, Amazon and the B&Q marketplace (operated on the Mirakl platform), and other supported couriers or sales channels added from time to time.
13.2 How data is shared. These services receive the information needed for the integration the Customer has chosen, such as the End Recipient's name, address and contact details for a courier booking. They use it under their own terms and their relationship with the Customer, and they are not our sub-processors.
13.3 Navigation apps. A Driver can open a stop in Google Maps, Waze or Apple Maps on their device. The stop address is then passed to the app chosen by the Driver, which handles it under its own privacy terms.
14.1 Legal requirements. We may disclose personal data where required by law, court order or a regulator, or where necessary to protect the rights, property or safety of DEL44, our Customers or others, including to prevent fraud.
14.2 Professional advisers. We may share personal data with our accountants, lawyers and insurers where needed for their services to us.
14.3 Business changes. If the DEL44 business is transferred to another company in our group, to a new company formed to carry on the DEL44 business, or to a buyer, personal data may be transferred to that company, which will continue to protect it in line with this policy.
14.4 No sale of data. We do not sell personal data.
15.1 Where data is processed. Our main hosting and several of our service providers are in the United States, and our file storage is in Western Europe. Personal data is therefore transferred outside the United Kingdom.
15.2 Transfer mechanisms. We transfer personal data outside the United Kingdom only where a safeguard recognised under UK data protection law applies. For the United States, we rely on the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge") where the provider is certified under it. Otherwise, we rely on the International Data Transfer Agreement or the International Data Transfer Addendum to the EU standard contractual clauses issued by the ICO, as included in the provider's data processing terms, or standard contractual clauses included in the provider's terms. For the European Economic Area, we rely on UK adequacy regulations.
15.3 Risk assessment. Where we rely on the International Data Transfer Agreement, the Addendum or standard contractual clauses, we carry out a transfer risk assessment for that transfer.
15.4 Checking certifications. We check each provider's status on the Data Privacy Framework List at https://www.dataprivacyframework.gov before relying on it. If a certification lapses, we will put another recognised transfer mechanism in place or stop the transfer.
15.5 Details. Annex A sets out each transfer and the safeguard we rely on. You can ask us for more information about these safeguards by contacting support@del44.com.
16.1 Our approach. We keep personal data only for as long as we need it. A daily automated job deletes or redacts data once the periods below have passed.
16.2 Retention schedule.
| Record | Retention period |
|---|---|
| Driver location points | 90 days by default. The Customer may choose 30, 60, 90 or 180 days. A different period up to 365 days may be agreed in writing. |
| End Recipient personal data on completed orders, including names, addresses, contact details, delivery notes, copies held elsewhere in the system, and proof-of-delivery photographs and signatures | Redacted 6 years after the order is delivered, cancelled, failed or returned, unless the Customer chooses 1, 2 or 3 years. Non-personal order data is kept for reporting. |
| Other order, delivery, route, shipment, courier and planning records, and the SMS credit ledger | While the Customer's account is open, until the Customer deletes them or closes its account |
| Audit log, including sign-in, security and settings events | 24 months |
| Delivery notification logs (recipient, event and status) | 12 months |
| Print job records | 12 months |
| Webhook and integration logs | 90 days |
| Duplicate-request records from the Driver App | 7 days |
| Registrations never verified | 7 days |
| User account details | While the Customer's account is open, and then deleted or anonymised under the closure process in section 16.3 |
| Records of acceptance of our Terms of Service, Privacy Policy and Data Processing Terms (name, email address, company name and number, document versions, date and time, IP address and browser details) | Six years after the Customer's account is closed, then deleted, so that we can show which terms applied if a claim arises |
| Print Station log files on the Customer's computers | 14 days, after which Print Station deletes them automatically |
| Server logs held by our hosting provider | No more than 90 days, under our hosting provider's retention cycle |
| Billing, payment and VAT invoice records | Six years from the end of the accounting period to which they relate, to meet tax and accounting requirements |
| Minimal record of a closed account (internal identifier, company name, closure and deletion dates, Stripe references) | Six years after deletion, to reconcile billing and meet tax requirements |
| Support correspondence | While the Customer's account is open and for up to 2 years after the enquiry is resolved |
| Marketing opt-out records | For as long as needed to make sure we do not send you marketing again |
16.3 Account closure. When a Customer closes its account, the account is restricted immediately and the Customer has 30 days to cancel the closure. After those 30 days, all of the Customer's records and files are deleted, audit log entries are anonymised and contact details are cleared, except for the minimal record and the acceptance records described above.
16.4 Backups and logs. Any copies of deleted data in our hosting provider's logs or backups are overwritten or expire under that provider's retention cycle, and in any event within 90 days.
16.5 Print Station logs. Print Station keeps log files on the Customer's own computer for 14 days and deletes older files automatically. Those files are under the Customer's control.
16.6 Third parties. Stripe, Twilio, couriers, marketplaces and other third parties keep information under their own retention policies and legal obligations.
17.1 Our measures. We use technical and organisational measures appropriate to the risks of the Service, including:
(a) separation of each Customer's data at database level using row-level security and a restricted database role;
(b) passwords stored only as one-way hashes, and sign-in sessions that expire after 8 hours;
(c) optional two-factor sign-in for Users, which Admins can make compulsory for their team, and compulsory two-factor sign-in for DEL44 staff and for our accounts with service providers;
(d) limits on the number of sign-in, two-factor, registration and password reset attempts;
(e) encryption of integration credentials and two-factor secrets by our own software, and encryption of stored data at storage level by our hosting provider;
(f) private access to stored files;
(g) access by DEL44 staff limited to a small number of authorised people, with no feature allowing staff to sign in as a Customer, and staff actions in our administration tools recorded in the audit log; and
(h) automated retention and deletion under section 16.
17.2 Your part. Please keep your password secure and turn on two-factor sign-in. No system is completely secure, and we cannot guarantee the security of information sent over the internet.
17.3 Personal data breaches. If a personal data breach occurs, we will act on it promptly and, where the law requires, notify the ICO, affected Customers and affected individuals.
18.1 What we use. We use only storage that is strictly necessary to provide the Service you request. We do not use analytics, advertising or social media cookies.
18.2 Cookie and storage table.
| Name or type | Set by | Purpose | Duration |
|---|---|---|---|
| dispatch_token (cookie, HttpOnly) | DEL44 | Keeps you signed in and passes your authenticated session to the DEL44 API. Not readable by page scripts. | Up to 8 hours |
| del44_session (cookie) | DEL44 | Tells the web application that you are signed in. Holds no sign-in token. | Up to 8 hours |
| Interface preferences (browser local storage) | DEL44 | Remembers table layouts and map settings you choose | Until you change them or clear your browser storage |
| Mapbox map library (on the dispatcher planning map and public tracking pages) | Mapbox | Displays the map. Mapbox receives your IP address and map requests and may store map resources in your browser cache. Usage reporting is switched off. | Managed by your browser |
| Push notification token (Driver App) | DEL44, through Expo, Apple and Google | Sends route and job notifications to the Driver's device | While the Driver App remains signed in for the Customer |
18.3 Consent. Because this storage is strictly necessary to provide the Service, PECR does not require consent for it, and we do not display a consent banner.
18.4 Future changes. Before introducing any analytics or other non-essential cookies or similar technologies, we will update this policy and ask for consent where the law requires it.
18.5 Managing cookies. You can block or delete cookies in your browser settings, but you will not be able to sign in to the web application without the sign-in cookie.
19.1 No significant automated decisions. We do not make decisions about individuals based solely on automated processing that produce legal effects or similarly significant effects.
19.2 Automated features. The Service uses automated processes for route optimisation, arrival time estimates, the 14-hour location cut-off described in section 7.3, retention and fair use monitoring of Customer accounts. These support operational decisions taken by Customers and do not decide matters such as a Driver's employment or pay.
20.1 No AI processing. We do not use artificial intelligence or large language model services to process personal data, and we do not use personal data to train any such model. If this changes, we will update this policy and notify Customers in advance under our Data Processing Terms.
21.1 Business service. The Service is designed for businesses and is not directed at children. We do not knowingly collect personal data from children as controller. Customers are responsible for any End Recipient data they enter.
22.1 Your rights. Subject to conditions and exceptions in the law, you have the right to: (a) access your personal data; (b) have inaccurate data corrected; (c) have data erased; (d) restrict our processing; (e) object to processing based on legitimate interests, and to object at any time to direct marketing; (f) receive data you have provided to us in a portable format where processing is based on consent or contract and carried out by automated means; and (g) withdraw consent at any time where we rely on it.
22.2 How to exercise them. Contact support@del44.com. We may need to verify your identity. We will respond within one month, which may be extended by up to two further months for complex or numerous requests, in which case we will tell you why.
22.3 End Recipients and Drivers. Where we process your data for a Customer, please contact that Customer, which is the controller. If you contact us, we will pass your request to the Customer and help it respond as required by our Data Processing Terms.
23.1 Complaining to us. If you are unhappy with how we have handled your personal data, please contact support@del44.com first. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay.
23.2 The ICO. You also have the right to complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113, website https://ico.org.uk.
24.1 Third-party services. The Service links to and connects with services we do not control, including couriers, marketplaces, Stripe and navigation apps. Their privacy policies govern their use of your information.
25.1 Updates. We will update this policy when our processing changes. We will publish the new version at https://www.del44.com/privacy with its effective date, tell Users about material changes by email or in the Service, and ask Users to confirm the new version in the web application.
25.2 Contact.
Artificial Grass Online Ltd, trading as DEL44
Company number: 10364075 (registered in England and Wales)
Registered office: 5 Carnfield Place, Walton Summit, Bamber Bridge, PR5 8AN
ICO registration number: ZB940283
Email: support@del44.com
This Annex forms part of section 15. It lists the providers that receive personal data outside the United Kingdom and the safeguard we rely on for each.
| Provider | Data transferred | Destination | Safeguard |
|---|---|---|---|
| Railway Corp. | All Customer data held in the database, sessions and application processing | United States | International Data Transfer Addendum to the EU standard contractual clauses, as included in Railway's data processing agreement |
| Vercel Inc. | Requests to the website and web application, including IP addresses and data passing through server functions | United States | UK-US data bridge, with the International Data Transfer Agreement in Vercel's data processing terms as a further safeguard |
| Cloudflare, Inc. | Proof-of-delivery photographs and signatures, labels and logos | Stored in Western Europe; provider based in the United States | UK-US data bridge |
| Stripe | Billing contact details, payment and subscription records | United States | UK-US data bridge |
| Twilio Inc. | Telephone numbers and content of delivery, account and marketing text messages; STOP replies | United States | UK-US data bridge, with the International Data Transfer Agreement in Twilio's data processing terms as a further safeguard |
| Resend | Email addresses and content of account, delivery and marketing emails, including proof-of-delivery photographs | United States | UK-US data bridge |
| Mapbox, Inc. | Delivery addresses for lookup and routing, map requests and IP addresses of map viewers | United States | UK-US data bridge |
| Expo (650 Industries, Inc.) | Driver device tokens, notification content and Driver App update requests | United States | UK-US data bridge |
| Google LLC | Android notification tokens and content; map requests from the Android Driver App | United States | UK-US data bridge |
| Apple Inc. | iPhone notification tokens and content; map requests from the iPhone Driver App | United States | Standard contractual clauses in Apple's terms |
| IDDQD Limited (Ideal Postcodes), operator of postcodes.io | Postcodes and the IP address of the request | United Kingdom, with hosting in the EU and delivery through Cloudflare's global network | UK adequacy regulations for the EEA; UK-US data bridge for Cloudflare |
| Xero (UK) Limited | Billing contact details and VAT invoice records | United States (hosted on Amazon Web Services) | International Data Transfer Addendum to the EU standard contractual clauses, as included in Xero's data processing addendum |