Privacy Policy — XLC Driver ​

Last updated: October 2026
Published at: https://www.xlcourier.com/privacy-policy-driver

This policy explains how personal data is used in the XLC Driver mobile app (the “App”) on iOS and Android. The App is used by XLC’s own drivers and by drivers of contracted carriers in Germany and the United Kingdom. It is not for the general public and not for children.

The controller for this App is XL Parcel Transportation GmbH, including for drivers working in the United Kingdom. In this policy, “XLC”, “we” or “us” refers to that company.

The website policy at https://www.xlcourier.com/privacy-policy is a separate page and is not this App’s policy. Do not replace that page with this one.

1. Who is responsible ​

Data controller (decides why and how the data is used):

This company is the controller for the App in Germany and the United Kingdom. Contact this company for questions about your personal data.

UK operations (not the controller):

  • XL Courier Limited, Unit 40, Holly Park Industrial Estate, Spitfire Road, Birmingham, B24 9PB, United Kingdom
  • May employ or authorise drivers for UK work. It does not decide what the App collects or how long it is kept.

Developer and processor (builds and runs the App for XLC):

  • Shenzhen Jiufang E-Commerce Logistics Co., Ltd.
    深圳市九方通逊电商物流有限公司
  • Address: C201, Jinpingguo Innovation Park Plant, No. 9 Ganli 2nd Road, Gankeng Community, Jihua Street, Longgang District, Shenzhen, CN 518000
  • Email: it@tofba.com

The App is published on Google Play and the App Store by the Chinese company above, for use by XLC. XLC decides what the App collects and how long it is kept. The Chinese company processes the data only to develop, host, and support the App.

2. Who this App is for ​

  • XLC employees who work as drivers
  • Drivers of carriers that work for XLC

Accounts are created by XLC administrators. You cannot register by yourself. The App is not directed at children.

3. What we collect and why ​

WhatExamplesWhy
AccountDriver code, password, name, driver type, carrier / service-provider name, countryLog in; show your routes and returns
DeviceApp version, OS version, phone modelSupport and compatibility
Precise location (including in the background)GPS while you work, including when the App is not on screenShow routes, loading and stops; prove delivery / pickup; keep the route running
Driving trackThe path of the trip during a routeOperations, proof of work, and handling disputes
PhotosProof-of-delivery photos, failed-delivery photos (may show doors, labels, people or property)Proof of delivery or failure
SignatureHandwritten signature on a successful stopProof of delivery
Recipient and stop dataName, address, postcode, phone, delivery / pickup instructions, tracking numbers, stop codesComplete the stop; call, SMS, or open a map
What you typeFailure reason notes, finish-route notesOperations and customer service
Other drivers’ return parcels (same carrier)Other drivers’ names, tracking numbers, stop codes on “To return”Warehouse / fleet return handling
Offline copies on the phoneRoutes, photos, results waiting to uploadWork without network; upload when back online
Server logsTime of submit, IP addressSecurity and investigation

We do not use this data for advertising. We do not sell personal data. We do not track you across other companies’ apps for ads.

4. Legal basis ​

We process personal data where this is allowed under GDPR / UK GDPR:

  • Contract: to provide the work App so you can carry out deliveries and pickups for XLC
  • Legitimate interests: to run operations, record proof of work, handle disputes, keep the service secure, and support the App
  • Legal obligation: where the law requires us to keep or disclose data
  • Consent: where the phone requires it for a permission (for example notifications)

5. Location and driving track (please read) ​

The App uses precise location in the background and records the driving track while you are on a route.

  • Location is used to run the route, record where a delivery or pickup was completed, and keep operations accurate.
  • The track is stored on XLC’s servers (Oracle Cloud in Germany) together with the route.
  • You can turn location off in the phone settings. If you do, you may be unable to see routes, start loading, or save a result.

On Android, the App shows its own explanation before the system “Allow all the time” location dialog.

6. Phone permissions ​

The App asks the phone for:

  • Location (including background): routes, results, driving track
  • Camera: scan barcodes; take proof photos
  • Photo library: pick an existing proof photo
  • Notifications: route updates, new instructions, HOLD / intercept
  • Phone and SMS (via the system apps): call or text the recipient
  • Maps: open Google Maps, Apple Maps or Waze with the stop address

If you refuse camera or photos, you cannot submit a result that needs a photo. If you refuse location, you may not be able to work the route.

7. Maps, calls and SMS ​

When you tap navigate, call or SMS, the phone opens another app (Google Maps, Apple Maps, Waze, Phone, Messages). That app then processes the address or number under its own privacy policy. Follow the road, traffic signs and traffic law. Do not use the App or the map while driving.

8. Where the data is stored ​

  • Application data and photos are stored on the same servers: Oracle Cloud in Germany.
  • Support staff of Shenzhen Jiufang E-Commerce Logistics Co., Ltd. in China can open driver and recipient data to develop and support the App.

So data used in Germany and the United Kingdom may be accessed from China. This is done only for running and supporting the App for XLC, not for marketing.

XLC and the Chinese company have signed a written data-processing contract. Access from China is limited to people who need it for support.

9. How long we keep data ​

We keep personal data only as long as needed:

  • Delivery data (routes, location, driving track, recipient and stop details, notes): 6–24 months
  • Proof of delivery (photos, signature): limited retention for claims and disputes
  • Account data: while the account is active
  • Records XLC must keep for accounting or the law: up to 6 years

When a driver leaves:

  • The account is disabled, not deleted.
  • The driver cannot delete the account inside the App.

To ask for access, correction, or deletion, email customerservice@xlcourier.com. Write your driver code and full name. Disabling or deleting an account does not always remove delivery records that XLC must keep for the business or the law.

10. Who we share data with ​

  • XLC staff who need it for operations and customer service
  • XL Courier Limited, for UK operations
  • The driver’s carrier (for contracted drivers), for the work they do for XLC
  • Shenzhen Jiufang E-Commerce Logistics Co., Ltd., as processor (development, hosting, support)
  • Oracle Cloud (Germany), as hosting provider
  • Apple and Google, only as needed to deliver the App and notifications
  • Authorities, if the law requires it

We do not share data with advertisers.

11. Security ​

  • Data is sent over the internet using HTTPS / TLS.
  • Access to the operations system is limited to authorised staff.
  • The phone may keep an offline copy of routes and photos until they upload. Keep the phone locked. Log out if the device is shared.

12. Your rights (Germany / GDPR and United Kingdom / UK GDPR) ​

You may ask XLC to:

  • access your data
  • correct wrong data
  • delete data (where the law allows)
  • restrict or object to certain processing
  • receive a copy (data portability), where it applies

Email customerservice@xlcourier.com. Write your driver code and full name.

You may also complain to:

  • Germany: Landesbeauftragte für Datenschutz und Informationfreiheit Nordrhein-Westfalen (LDI NRW), or your local German data protection authority
  • United Kingdom: Information Commissioner’s Office (ICO), https://ico.org.uk/

Because accounts are created by XLC, some requests (for example full deletion) may be refused if XLC still needs the record for the contract or the law.

13. Children ​

The App is only for adult drivers authorised by XLC or a carrier. It is not for anyone under 16, and not for children.

14. Changes ​

If this policy changes in a material way, we will update this page and the “Last updated” date. When we can, we will also show a notice in the App. The current version is always at https://www.xlcourier.com/privacy-policy-driver

15. Contact ​

XL Parcel Transportation GmbH
Hamburgring 30, 41179 Mönchengladbach, Germany
customerservice@xlcourier.com
+49 177 5831818

Write your driver code and full name.