How personal information is handled

Who is responsible for this notice

Basildon Delivery is responsible for the platform records it creates and manages.

Participating shops may also be responsible for how they use order, customer, product, allergen, and support information they receive through the platform for their own shop operations.

Correspondence address:

Basildon Delivery
Office 9899
321-323 High Road
Chadwell Heath
Essex
RM6 6AX
United Kingdom

For privacy questions, use the contact and support page.

Information we collect

• Account details such as name, email address, phone number, login status, role, account state, and saved delivery addresses.
• Order details such as chosen shop, basket items, delivery address, delivery slot or Rush choice, tips, fees, platform fee, payment method, and order status.
• Operational records such as pickup and dropoff PIN state, rider assignment, support messages, problem reports, cancellation records, refund records, dispute records, and order history entries.
• Age-check information where age-restricted goods are ordered, including the checkout date of birth and the result of the delivery check.
• Rider information such as account details, shop assignments, vehicle/carrying setup, availability settings, profile photo, public rider note, document upload status, compliance declarations, and earnings records.
• Shop information such as shop name, address, contact details, opening hours, payment settings, catalogue data, product images, delivery zones, and rider model settings.
• Technical records such as IP address, browser or device information, session data, login/security events, error logs, and anti-spam checks.
• Storefront usage statistics such as daily visitors, visits, page views, product-card impressions, basket additions, checkout starts, orders, category views, the website host used to reach a shop, the referring website domain where supplied, the first page of a visit, and campaign labels such as UTM source, medium, and campaign.

Why we use information

• To create and manage shopper, shop, rider, and admin accounts.
• To let shoppers place orders, pay, track delivery, request support, and manage saved addresses.
• To let shops prepare orders, manage catalogues, receive payment information, and resolve problems.
• To let riders collect, deliver, complete PIN checks, complete age checks, report delivery problems, and receive delivery-related earnings information.
• To handle payment support, refunds, shop credit, payment disputes, fraud prevention, abuse prevention, safety, legal compliance, accounting, and support follow-up.
• To operate the website, secure sessions, prevent spam, diagnose errors, and improve reliability.
• To provide participating shops with aggregate storefront statistics, understand which products are being noticed, see broadly how visitors found the storefront, measure shop-created campaign links, and improve catalogue and ordering usability.

Lawful basis

Depending on the situation, personal information may be used because it is needed to provide the service, because there is a legal obligation, because there is a legitimate operational interest, or because consent has been given for an optional feature.

• Contract: creating accounts, placing orders, arranging delivery, processing payments, refunds, and support.
• Legal obligation: accounting records, age-restricted sales checks, tax or regulatory requirements, and lawful requests from authorities.
• Legitimate interests: fraud prevention, security, dispute evidence, service reliability, rider/shop safety, abuse prevention, and privacy-conscious aggregate storefront statistics used to improve the service and shop catalogues.
• Consent: optional communications or features where the platform clearly asks for consent.

Who can see order information

• The relevant shop can see the information needed to prepare and manage the order.
• The assigned rider can see the information needed to collect and deliver the order.
• Platform admin can see operational details needed for support, safety, payments, fraud prevention, dispute handling, and problem resolution.
• Payment card details are handled by the shop's own payment provider where shop card payment is offered. Basildon Delivery does not collect or store full card details.
• Support messages may be shared with the relevant shop, rider, or platform admin where needed to resolve the issue.

Third parties and service providers

Information may be handled by trusted service providers where needed to run the platform. This may include payment processing, email delivery, hosting, logging, backup, security, and technical support.

Card payments are handled by the shop's own payment provider where shop card payment is offered. That provider may process payment and fraud-prevention information under its own terms and privacy notices.

Age-check privacy

Where a customer provides a date of birth for age-restricted goods, the rider is not shown that stored date of birth. The rider either confirms that the recipient clearly appears 25 or over, or enters the date shown on the customer's ID at the door. The system checks whether the age-check path passes.

If the check fails, the result is recorded so the shop and platform admin can handle the return, cancellation, refund, or credit process.

Rider documents

Rider identity, right-to-work, DBS, or compliance documents are used for rider onboarding and review. They are only accessible to authorised platform admin and are stored outside the public website.

How long information is kept

• Order, payment, refund, billing, and dispute records may be kept as long as reasonably needed for accounting, tax, fraud prevention, support, and legal claims.
• Account records are usually kept while the account is active and for a reasonable period after closure where needed for security, accounting, dispute, or support reasons.
• Rider compliance records may be kept while the rider account is active and for a reasonable period afterwards where needed for audit, safety, dispute, or legal reasons.
• Technical logs are kept for a limited period where practical, unless needed for security, diagnosis, fraud prevention, or legal reasons.
• Detailed storefront analytics events are normally retained for 180 days. The retention period can be changed only through the private configuration and should be reviewed against the purpose of the statistics.

Your privacy rights

Depending on the circumstances, you may have the right to ask for access, correction, deletion, restriction, objection, portability, or review of how your personal information is used.

Some requests may be limited where information has to be kept for legal, accounting, fraud prevention, dispute, safety, or operational reasons.

You can also complain to the UK Information Commissioner's Office if you are unhappy with how personal information is handled.

Cookies, sessions, and storefront statistics

The site uses cookies and session data for login, basket handling, checkout, security checks, and keeping the service working. These are functional parts of the site rather than advertising or marketing extras.

First-party storefront statistics are calculated server-side and do not set or access an additional analytics cookie or browser storage. The server creates pseudonymous daily visitor identifiers and approximate 30-minute visit-window identifiers from limited request information, records shopping activity, and does not store the raw IP address, browser identifier, or customer account ID in the analytics table. Where the browser supplies it, the system may also record only the referring website domain, the first page path of a visit, and campaign labels supplied in utm_source, utm_medium, and utm_campaign. Full referring URLs, search phrases, and unrelated query-string contents are not stored. Participating shops can see aggregate totals and product/category/discovery statistics, not named individual browsing histories.

Storefront statistics ignore obvious automated bots, the relevant shop owner previewing their own storefront, platform administrators, and browsers sending Do Not Track or Global Privacy Control signals.

If advertising, cross-site tracking, or another non-essential analytics service is added later, the cookie wording and consent approach must be reviewed before that tool is enabled.

Security

Basildon Delivery uses practical security measures such as HTTPS, secure session settings, CSRF checks, private configuration files, protected uploads, and role-based access controls. No website can guarantee perfect security, but sensitive operational information should only be accessed by users who need it.

Children

The platform is not intended for children to create accounts or place orders. Age-restricted goods must only be ordered by customers legally old enough to buy them.

Changes to this policy

This policy may be updated as the pilot develops, new shops join, payment flows change, or new support and delivery features are added.