1. Introduction

DSPilot ("we", "us", or "our") is committed to protecting the privacy and security of your personal data. This Privacy Policy explains how we collect, use, and protect information when you use our DSP management platform.

We are the data processor for the personal data processed through our platform. Each DSP (Delivery Service Partner) using our platform is the data controller for their drivers' personal data.

2. Data Controller Information

For questions about this Privacy Policy or your personal data, contact us at:

Email: hello@dspilot.co.uk
Company: DSPILOT LTD
Location: United Kingdom

3. Personal Data We Collect

We collect and process the following categories of personal data:

DSP Administrators and Managers

Email address
Full name
Account credentials (securely hashed)
DSP company name

Drivers

Full name
Email address (if provided)
Phone number (if provided)
Transporter ID (Amazon-assigned identifier)
Availability submissions
Performance metrics (DCR, POD, Contact Compliance, etc.)
Safety metrics from Netradyne (speeding, following distance, etc.)
Schedule assignments and shift history

Mobile App Users

When you use the DSPilot mobile app and enable notifications, we additionally process:

A push notification device token, so we can send you operational alerts such as schedule changes and van assignments
Basic device information (device type, operating system, and app version) needed to run the app and deliver notifications reliably

4. Legal Basis for Processing

We process personal data under the following legal bases as defined by UK GDPR:

Contractual Necessity (Article 6(1)(b)): Processing is necessary for the performance of our contract with DSPs to provide schedule management, metrics tracking, and fleet management services.
Legitimate Interests (Article 6(1)(f)): We may process data for our legitimate business interests, such as improving our services, preventing fraud, and ensuring platform security.
Consent (Article 6(1)(a)): Where required, we obtain consent for specific processing activities, such as marketing communications.

5. How We Use Your Data

We use personal data to:

Provide and maintain the DSPilot platform
Process and display schedules
Track and display driver performance metrics
Generate leaderboards and rankings
Send operational notifications (shift reminders, availability requests)
Provide customer support
Improve and develop our services
Comply with legal obligations

6. Data Sharing and Sub-Processors

We share personal data with the following third-party service providers (sub-processors) who process data on our behalf:

Supabase (EU): Database hosting, authentication, and backend services. Data is stored in EU data centres with encryption at rest and in transit.
Resend: Email delivery service for transactional emails and notifications.
Twilio: SMS and WhatsApp messaging for shift notifications.
Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging): Delivery of push notifications to the DSPilot mobile app. Your device token is shared with the relevant platform solely to route notifications to your device.
Capgo: Delivery of over-the-air app updates to the DSPilot mobile app.

We do not sell, rent, or trade personal data to third parties for marketing purposes.

7. International Data Transfers

Our primary database is hosted in the European Union. Where data is transferred outside the UK/EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the UK ICO, or transfers to countries with adequacy decisions.

8. Data Retention

We retain personal data for as long as necessary to:

Provide our services to active DSP accounts
Comply with legal and regulatory requirements
Resolve disputes and enforce agreements

When a DSP terminates their account, we retain data for up to 90 days to allow for data export, after which it is permanently deleted. Aggregated, anonymised data may be retained for analytics purposes.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of Access: Request a copy of the personal data we hold about you.
Right to Rectification: Request correction of inaccurate or incomplete data.
Right to Erasure: Request deletion of your personal data in certain circumstances.
Right to Restriction: Request restriction of processing in certain circumstances.
Right to Data Portability: Receive your data in a structured, machine-readable format.
Right to Object: Object to processing based on legitimate interests.
Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise these rights, contact us at hello@dspilot.co.uk. We will respond within one month as required by UK GDPR.

10. Security Measures

We implement appropriate technical and organisational measures to protect personal data:

Encryption of data in transit (TLS/SSL) and at rest
Row-Level Security (RLS) ensuring DSPs can only access their own data
Secure password hashing using industry-standard algorithms
Regular security audits and monitoring
Access controls limiting data access to authorised personnel
Audit trails tracking all data modifications

11. Children's Data

DSPilot is not intended for use by individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify DSP administrators of significant changes via email. The "Last updated" date at the top of this page indicates when the policy was last revised.

13. Complaints

If you have concerns about how we handle your personal data, please contact us first at hello@dspilot.co.uk. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.