Privacy Policy — Flash Drive

This privacy policy explains how [YOUR REGISTERED COMPANY NAME] ("we", "us") collects, uses, and protects your personal data when you use the Flash Drive contractor platform.

Who we are

Data controller: [YOUR REGISTERED COMPANY NAME], [REGISTERED ADDRESS], United Kingdom. Contact: nrematco@gmail.com. ICO registration: [ICO NUMBER OR "in progress"].

What data we collect

We collect personal data in three contexts:

Courier applicants: name, email, phone number, proof of address (utility bill / bank statement), driving licence photograph, declaration of right to work in the UK.
Active couriers: name, email, phone, contractor ID, hashed PIN, daily delivery records (parcel counts, drop / round / van numbers, screenshots of stats screens, timestamps), availability declarations, advance-payment requests.
Managers: name, business email, business name, business code, payment-rate configurations.

How we use it

We use the data only for legitimate operational purposes: onboarding and managing couriers, calculating earnings, generating invoices, recording deliveries for our delivery clients, fraud prevention (duplicate-screenshot detection), and compliance with our records-keeping obligations under UK self-employment / IR35 frameworks.

Lawful basis

We rely on (a) contract necessity to administer the courier-contractor relationship, (b) legal obligation for record-keeping required by HMRC, and (c) legitimate interests for fraud prevention.

Where we store data

All data is stored in Supabase (a managed Postgres provider) in EU data centres. Documents (proof of address, driving licence) and screenshots are stored in Supabase Storage with row-level access controls — only the courier's manager can view their files.

Who we share it with

Your data is not sold. It is only seen by:

You and your manager within the platform.
Supabase (as our hosting provider) under their privacy policy.
Resend / EmailJS (for sending you emails) under their respective privacy policies.
HMRC, courts, or other regulators when legally required.

How long we keep it

Application data: 12 months from rejection, then deleted. Active courier records: kept while the contractor relationship is active and for 6 years after closure to meet HMRC retention requirements. You can request earlier deletion subject to those legal limits.

Your rights

Under UK GDPR you have the right to: access your data, correct inaccuracies, request erasure (subject to retention duties above), restrict processing, port your data, and object to processing. Email nrematco@gmail.com to exercise any of these.

Complaints

If you're not happy with how we handle your data you can complain to the UK Information Commissioner's Office at ico.org.uk.

Cookies and tracking

Inside the contractor platform itself we use one technical cookie (a session token) so you stay logged in. No third-party tracking inside the platform.

Our public-facing recruitment pages (e.g. /leeds.html, /harrogate.html, the application form, and the thank-you page) load the Google Ads tag so we can measure how many people who clicked one of our adverts went on to complete an application. Google may set advertising cookies on these pages. If you do not want this, you can decline cookies in your browser, or use an ad-blocker — the application form will still work either way.

← Back to Flash Drive