Privacy Policy

XL Courier Limited

Last updated: January 2026

1. Data Controller

XL Courier Limited is the data controller responsible for your personal data.

2. Scope of This Policy

This Privacy Policy applies to:

  • Visitors to our website
  • Users of our mobile applications (including driver apps)
  • Business customers (merchants)
  • Delivery recipients
  • Drivers and logistics personnel

3. Categories of Personal Data

3.1 Customer and Delivery Data

  • Name, phone number, email
  • Collection and delivery address
  • Parcel information (where provided)

3.2 Delivery Execution Data

  • Delivery status and timestamps
  • Route and job assignment data
  • GPS location data (see Section 4)

3.3 Proof of Delivery Data

  • Signatures
  • Delivery photos

Purpose:

  • Confirm delivery
  • Resolve disputes
  • Provide evidence to senders

3.4 Driver / Courier Data

  • Identity and contact details
  • Driving licence and verification documents
  • Work activity and delivery history
  • Location data during active deliveries

3.5 Technical and Usage Data

  • IP address
  • Device and operating system
  • App usage logs
  • Crash and diagnostics data

4. Location Data (Important)

We collect location data strictly for delivery operations:

  • Foreground location - when the app is in use
  • Background location - only during active delivery jobs

We do NOT track users continuously outside working/delivery periods.

Purpose:

  • Real-time tracking
  • Delivery verification

Users can control location permissions via device settings.

5. App Permissions

Our mobile applications may request:

  • Location access (foreground and background)
  • Camera access (for proof of delivery)
  • Storage access (for uploading images)
  • Network access

Permissions are requested only where necessary for service functionality.

6. Legal Basis for Processing

We process personal data where necessary to:

  • perform our contractual obligations (e.g. delivery services)
  • comply with legal obligations
  • pursue legitimate interests such as service improvement and fraud prevention
  • obtain consent where required (e.g. cookies or optional permissions)

7. How We Use Personal Data

We use personal data to:

  • Provide and manage delivery services
  • Assign and optimise delivery routes
  • Enable tracking and proof of delivery
  • Communicate with customers and drivers
  • Improve service performance and reliability

8. Role of Parties (Controller vs Processor)

Depending on the service context:

  • Business customers (merchants) act as Data Controllers for personal data of their customers (senders and recipients)
  • XL Courier Limited acts as a Data Processor when processing such data on behalf of business customers

We process data only:

  • On documented instructions from our customers
  • For the purpose of providing logistics services

9. Customer Responsibilities

Business customers are responsible for:

  • Providing privacy notices to their end users
  • Ensuring lawful data collection
  • Handling data subject rights requests

10. Data Sharing

We may share personal data with:

  • Drivers and delivery personnel
  • Business customers (senders/receivers)
  • IT and cloud service providers
  • Authorities where legally required

All third parties are required to comply with GDPR.

11. International Data Transfers

Where data is transferred outside the UK/EEA, we ensure safeguards such as:

  • Standard Contractual Clauses (SCCs)
  • Adequacy decisions

12. Data Retention

We retain personal data only as necessary:

  • Delivery data: 6-24 months
  • Proof of delivery: limited retention
  • Financial data: up to 6 years
  • Account data: while active

13. Data Security

We implement appropriate technical and organisational measures:

  • Encryption (in transit and at rest)
  • Access control and authentication
  • Monitoring and logging

14. Your Rights

Under GDPR, you have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Request erasure
  • Restrict processing
  • Data portability
  • Object to processing
  • Withdraw consent

Contact: customerservice@xlcourier.com

You also have the right to lodge a complaint with a supervisory authority (e.g., UK ICO or German data protection authorities).

15. Cookies

We use cookies to:

  • Ensure website functionality
  • Analyse usage
  • Improve user experience

16. Children

We do not knowingly collect data from children under 13. If you are aware that we have collected such information, please contact us.

17. Changes to This Policy

We may update this Privacy Policy. Updates will be published on this page.