Privacy Policy

1. Introduction

This privacy policy explains how pallets.delivery ("we", "us", "our") collects, uses, stores, and protects your personal data when you use our website, services, and platform. We are committed to ensuring that your privacy is protected in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For the purposes of data protection legislation, we are the data controller. If you have any questions about how we handle your personal data, please contact us using the details provided in Section 12 of this policy.

2. Information We Collect

We collect and process the following categories of personal data:

2.1 Information You Provide Directly

• Full name, email address, telephone number, and postal address when you create a booking or account
• Company name and VAT number for business account holders
• Collection and delivery addresses for shipments
• Payment card details (processed securely by our payment processor; we do not store full card numbers)
• Information you include in correspondence with our support team
• Feedback and reviews you submit about our services

2.2 Information Collected Automatically

• IP address, browser type and version, operating system, and device information
• Pages visited, time spent on each page, and navigation paths through our website
• Referring website address and search terms used to find our site
• Cookie data and similar tracking technologies (see our Cookie Policy for details)

2.3 Information from Third Parties

• Tracking and delivery status updates from our carrier partners
• Credit reference information for business account applications
• Information from analytics providers such as Google Analytics

3. How We Use Your Information

We use your personal data for the following purposes:

• To fulfil your booking: Processing your pallet delivery order, arranging collection and delivery with our carrier partners, and providing you with tracking information. (Legal basis: performance of a contract)
• To manage your account: Creating and maintaining your business account, processing credit applications, and managing billing. (Legal basis: performance of a contract)
• To communicate with you: Sending booking confirmations, delivery updates, and responding to your enquiries. (Legal basis: performance of a contract / legitimate interests)
• To improve our services: Analysing website usage, identifying trends, and improving the user experience. (Legal basis: legitimate interests)
• To send marketing communications: Providing you with information about our services, promotions, and industry news, where you have consented to receive such communications. (Legal basis: consent)
• To comply with legal obligations: Meeting our obligations under tax, accounting, and regulatory requirements. (Legal basis: legal obligation)
• To prevent fraud: Detecting and preventing fraudulent transactions and protecting the security of our platform. (Legal basis: legitimate interests)

4. Who We Share Your Data With

We may share your personal data with the following categories of recipients:

• Carrier partners: We share collection and delivery addresses, contact details, and shipment information with our pallet network carriers to fulfil your delivery. These carriers operate as independent data controllers for the data they receive.
• Payment processors: Your payment details are processed securely by our payment service provider, which is PCI DSS compliant. We do not store your full payment card details on our systems.
• Analytics providers: We use analytics services to understand how our website is used. These providers process data in anonymised or pseudonymised form where possible.
• Professional advisors: Our accountants, legal advisors, and auditors may access personal data where necessary to provide their services to us.
• Regulatory authorities: We may disclose personal data to HMRC, the Information Commissioner's Office, or other regulatory bodies where required by law.

We do not sell your personal data to third parties. We do not share your data with third parties for their own marketing purposes without your explicit consent.

5. International Data Transfers

Your personal data is primarily stored and processed within the United Kingdom. Where we use service providers that process data outside the UK (for example, cloud hosting or analytics services), we ensure that appropriate safeguards are in place, such as the UK International Data Transfer Agreement (IDTA), adequacy decisions by the UK Secretary of State, or binding corporate rules approved by the Information Commissioner's Office.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Booking data: Retained for six years from the date of the last transaction to comply with tax and accounting obligations.
• Account data: Retained for the duration of your active account, plus six years after closure.
• Marketing consent records: Retained for as long as you remain subscribed, plus two years after you unsubscribe.
• Website analytics: Retained for a maximum of 26 months.
• Support correspondence: Retained for three years from the date of the last communication.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit using TLS/SSL, encryption of sensitive data at rest, access controls and role-based permissions for our staff, regular security assessments and penetration testing, and staff training on data protection and information security. While we take all reasonable precautions to protect your data, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

8. Your Rights

Under the UK GDPR, you have the following rights in relation to your personal data:

• Right of access: You have the right to request a copy of the personal data we hold about you.
• Right to rectification: You have the right to request that we correct any inaccurate or incomplete personal data.
• Right to erasure: You have the right to request that we delete your personal data in certain circumstances.
• Right to restrict processing: You have the right to request that we restrict the processing of your personal data in certain circumstances.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used, and machine-readable format.
• Right to object: You have the right to object to the processing of your personal data where we are relying on legitimate interests as the legal basis.
• Rights related to automated decision-making: You have the right not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you.

To exercise any of these rights, please contact us at privacy@pallets.delivery. We will respond to your request within one calendar month. In complex cases, we may extend this period by a further two months, but we will notify you of any extension within the initial one-month period.

9. Marketing Communications

We will only send you marketing communications where you have given your explicit consent (opt-in) or where we have a legitimate interest to contact you about services similar to those you have previously used (soft opt-in under the Privacy and Electronic Communications Regulations 2003). Every marketing email we send includes a clear unsubscribe link. You can also update your marketing preferences by contacting us directly. Unsubscribing from marketing communications does not affect transactional messages related to your bookings, such as delivery updates and booking confirmations.

10. Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child under 18, we will take steps to delete that data as soon as practicable.

11. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, services, or legal requirements. When we make material changes, we will notify you by posting a prominent notice on our website and, where appropriate, by email. The date at the top of this policy indicates when it was last updated. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions, concerns, or requests regarding this privacy policy or our data protection practices, please contact us: