Version: 2.1

Effective date: 12 October 2026

Last updated: 12 October 2026

This version replaces version 2.0, which was effective from 9 October 2026 (last updated 9 October 2026). Version 2.1 changes Sections 6.1(b) and 6.8 only. Version 2.0 still applies to amounts invoiced before 12 October 2026 (see Section 6.8(f)). A copy of version 2.0 is available on request from [email protected].

1. About these terms

1.1 These terms are between you and MealShift Ltd, a company registered in England and Wales (company number 12793366) whose registered office is at 410 Naylor Building West, Assam Street, London E1 7QL (“MealShift”, “we”, “us” and “our”). You can contact us at [email protected].

1.2 They apply when you use the MealShift platform: the MealShift-Client app, the MealShift dashboard, the MealShift API and the MealShift-Driver app (together, the “Platform”).

1.3 The Platform is for businesses. If you use it to request deliveries or book Couriers, you confirm that you are doing so for a business (for example a restaurant, shop or delivery partner) and not as a consumer, and that you have authority to accept these terms for that business. In these terms, “you” means that business.

1.4 Couriers use the MealShift-Driver app under the MealShift Courier Agreement, published at mealshift.co.uk/courier-agreement/. For Couriers, if the Courier Agreement and these terms say different things, the Courier Agreement applies. Section 13 explains how these terms relate to Couriers.

1.5 If you have signed an agreement with us, such as a Merchant Service Agreement or a Partner Agreement (“your Agreement”), your Agreement governs our relationship. These terms apply to your use of the Platform only on matters your Agreement does not deal with. If your Agreement and these terms say different things, your Agreement applies. Nothing in these terms changes your Agreement.

1.6 Section 15 and the Data Processing Schedule at the end of these terms explain how we handle personal data when we deliver for you, and they form part of these terms. Our Privacy Policy at mealshift.co.uk/privacy-policy/ explains how we handle personal data as a controller, including data about you and your staff, Couriers and visitors to our website. Our Cookie Policy at mealshift.co.uk/cookie-policy-uk/ explains the cookies our website uses and how to change your cookie choices at any time. The Privacy Policy and the Cookie Policy are for information. They are not part of our contract with you.

1.7 By creating an account or using the Platform you accept these terms. If you do not accept them, please do not use the Platform.

2. How MealShift works: we act for the Couriers

2.1 Couriers are independent, self-employed delivery contractors. They are not our employees or workers, and they are not yours.

2.2 When a Courier accepts a delivery request or an hourly booking you make on the Platform, the Courier supplies that delivery or those hours to you. Your contract for that delivery or booking is with the Courier.

2.3 MealShift does not supply the delivery. We act as the Couriers’ disclosed agent. With the Couriers’ authority, we:

(a) connect your requests with Couriers;

(b) set, quote and agree the price for each delivery and booking on the Couriers’ behalf;

(c) collect the Courier Charges from you on the Couriers’ behalf and pass them on to the Couriers; and

(d) prepare and issue the invoices for the Courier Charges in the Couriers’ names and on their behalf.

2.4 When you pay the Courier Charges to us, that settles what you owe the Courier for them.

2.5 We are paid by the Couriers, not by you. For delivery work, our pay is a commission we charge the Couriers, which we deduct before we pass their money on to them. It is not added to what you pay and it does not appear on your invoice.

2.6 We supply the Platform itself (the apps, dashboard, API, tracking and support) as our own service. Where we charge you for a service of our own, that is a MealShift Service Charge (see Section 5.5).

3. Words we use

“Booking” means booking a Courier for a set number of hours (sometimes called a shift, or a driver by the hour).

“Cancellation Fee” means a fee that may apply when a Delivery or a Booking is cancelled, as described in Section 7.

“Courier” means an independent, self-employed delivery contractor who uses the MealShift-Driver app.

“Courier Charges” means Delivery Charges, Hourly Charges and Cancellation Fees. They are the Couriers’ charges, which we collect as their agent.

“Data Processing Schedule” means the schedule headed “Data Processing Schedule” at the end of these terms.

“Data Protection Laws” means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any other law about personal data or electronic marketing that applies in the United Kingdom, each as amended or replaced from time to time.

“Delivery” means a single delivery you request on the Platform (sometimes called pay per drop).

“Delivery Charge” means the Courier’s charge for a Delivery.

“End-Customer Delivery Details” means personal data about the people you ask us to deliver to, and anyone who receives a delivery for them, that you give us or that reaches us from an ordering platform or integration you use, so that a Delivery or Booking can be carried out. It includes names, addresses, phone numbers, delivery instructions and order references, and the delivery records and proof-of-delivery photos created when the delivery is made.

“Hourly Charge” means the Courier’s charge for a Booking.

“MealShift Service Charges” means our own charges for our own services, such as an In-House plan, online ordering, aggregation or a partner integration fee.

“Price List” means our published prices at mealshift.co.uk/pricing/, as updated under Section 5.6.

“UK GDPR” has the meaning given in the Data Protection Act 2018. Words such as “controller”, “processor”, “personal data” and “personal data breach” have the meanings they have in the UK GDPR.

“your Agreement” has the meaning in Section 1.5.

4. Your account and how you use the Platform

4.1 You must be at least 18, give us accurate details and keep them up to date. We may check the details you give us.

4.2 Keep your login details secure. You are responsible for everything done through your account, including by your staff. Tell us straight away at [email protected] if you think someone has used your account without permission.

4.3 When you request a Delivery or make a Booking, you must:

(a) give accurate collection and delivery addresses, contact details and order information;

(b) pack the order securely and have it ready for collection at the agreed time;

(c) ask for delivery to a named person at an address a Courier can reach;

(d) send only goods that are lawful and that do not breach any Courier’s insurance restrictions;

(e) comply with all laws that apply to your goods and your business; and

(f) make sure you are allowed to give us and the Courier the recipient’s details for that delivery, as set out in Section 15.3.

4.4 You must not misuse the Platform. That includes trying to get around its security or usage limits, copying, reverse engineering or reselling it except as your Agreement allows, using it for anything unlawful, or using it to build a competing delivery service.

4.5 Couriers decide how to carry out each delivery. You may not direct or control how a Courier works other than through the Platform.

5. Prices

5.1 The Courier Charges are worked out by the Platform using things like distance, vehicle type and demand. We set them on the Couriers’ behalf, under the authority they give us.

5.2 The rates that apply to you are:

(a) if you have an Agreement, the rates in it (Schedule A), including any volume discount it sets out; or

(b) if you do not, the Price List in force when you make the request, unless we have agreed other rates with you in writing.

5.3 The Courier Charges are your total cost for Deliveries and Bookings. Our commission is charged to the Couriers, not to you, so nothing is added on top for it.

5.4 Courier Charges carry VAT only where the Courier who does the work is registered for VAT. Most Couriers are not, so usually no VAT applies to them. MealShift Service Charges carry VAT where the law requires it.

5.5 MealShift Service Charges are our own charges for our own services, supplied by us and not as anyone’s agent. They are set out in the Price List or your Agreement, together with any terms that apply only to that service.

5.6 If you do not have an Agreement, we may change the Price List. We will email you at least 14 days before an increase to the rates for Deliveries or Bookings takes effect. Changed rates apply only to requests you make on or after the date the change takes effect. If you have an Agreement, its rules on rate changes apply instead. This Section 5.6 does not apply to Cancellation Fees (Section 7).

6. Invoices and payment

6.1 How you pay depends on how your account is set up:

(a) Pay as you go: we charge your card for each Delivery or Booking.

(b) Weekly: we invoice you every Monday for the previous Monday-to-Sunday week, and charge the card on your account at the end of each weekly billing week. Each weekly invoice is due on the invoice date. Bank transfer is available only to delivery partners and ordering platforms that we have agreed it with in writing. If you pay by bank transfer, each invoice is due on receipt.

6.2 We issue invoices for Courier Charges in the Couriers’ names and on their behalf. We issue invoices for MealShift Service Charges in our own name.

6.3 You authorise us to charge the card on your account for all amounts due, and you must keep a valid card on file.

6.4 You must pay each invoice in full. You may not hold back, deduct or set off any amount, except sums we have agreed in writing that we owe you, sums a court has ordered us to pay you, or where the law requires it. If you have a claim against us or against a Courier, including for goods lost or damaged, raise it separately and still pay the invoice.

6.5 If you think an invoice is wrong, tell us in writing within 7 days of the invoice date, saying which charges are wrong and why. If you do not, the invoice is treated as agreed, unless there is an obvious error. Querying part of an invoice does not let you hold back the rest.

6.6 Our Platform records of Deliveries and Bookings, including times, addresses, distance and the Courier assigned, are evidence of those things unless there is an obvious error. You may show us evidence that they are wrong.

6.7 Late payment. If you pay late, we may charge interest, for ourselves and as the Couriers’ agent, on the overdue amount at 8% a year above the Bank of England base rate, from the due date until you pay. We may also claim, for ourselves and as the Couriers’ agent, the fixed compensation allowed by the Late Payment of Commercial Debts (Interest) Act 1998. You must also pay our reasonable costs of recovering the debt, including £25 for each formal demand we send after the due date (up to two per invoice), the fees of any debt collection agency we use, court fees and our legal costs.

6.8 If a payment fails or is not made.

(a) Card: if the card charge for a weekly invoice fails, we will try the card again automatically. If that also fails, we will email you, and text you if there is a mobile number on your account, asking you to update your card. If the amount is still unpaid at 9am UK time on the day after we send that message, we may pause your account.

(b) Bank transfer: if an invoice you pay by bank transfer is still unpaid at 9am UK time on the day after the invoice date, we may pause your account. We will email you, and text you if there is a mobile number on your account, when we do.

(c) Any other amount: if any other amount is more than 7 days overdue, counted from its due date, we may write to you asking you to pay within 3 working days. If you still do not pay, we may pause your account.

(d) What a pause means: while your account is paused you cannot request Deliveries or make Bookings, and we may cancel any Deliveries and Bookings that no Courier has yet accepted (no Cancellation Fee applies to those). Work a Courier has already accepted will be completed and charged. A pause is a suspension of your account, not the end of it or of these terms. We will lift the pause automatically once the amount is paid (for a card payment, as soon as it goes through), but we may then ask you to pay as you go.

(e) We may also pass the debt to a debt collection agency, share your payment history with credit reference agencies, or take court action.

(f) Paragraphs (a) and (b) apply to amounts invoiced on or after 12 October 2026. An amount invoiced before that date is dealt with under the version of these terms in force when it was invoiced.

7. Cancellations

7.1 There is no Cancellation Fee if you cancel a Delivery before a Courier accepts it, or a Booking before a Courier is hired. After that, Cancellation Fees may apply when a Delivery or Booking is cancelled, depending on how far it has progressed.

7.2 The Cancellation Fees that apply are those applied to your account on the Platform at the time of the cancellation. They may differ from those applied to other accounts. If you have an Agreement, it also applies.

7.3 When you cancel in the MealShift-Client app or the MealShift dashboard, we normally show you a warning before you confirm the cancellation. A Cancellation Fee may still apply if no warning is shown.

7.4 A Cancellation Fee is the Courier’s charge. We collect it from you on the Courier’s behalf, in the same way as other Courier Charges, and pass it on to the Courier, less our commission.

7.5 If an order is not ready when the Courier arrives, the Courier may choose to wait or to cancel.

8. Lost or damaged goods

8.1 The Courier who carries an order is responsible to you for loss or damage caused by the Courier’s fault or negligence. MealShift is not the supplier of the delivery and is not responsible for it as principal.

8.2 Tell us in writing within 48 hours of the scheduled delivery time, with reasonable evidence of the value of the goods (for example a purchase invoice or wholesale price list) and of the loss or damage (for example photos or order records).

8.3 Where the Courier was at fault, we may choose to arrange a goodwill payment to you and recover it from the Courier. Goodwill payments are capped at the lower of the documented wholesale value of the goods and £50 per Delivery, unless we agreed a higher limit in writing before the Delivery. This is the published cap referred to in our agreements.

8.4 Unless we agreed otherwise in writing before the Delivery, no goodwill payment is made for: cash, vouchers or gift cards, alcohol, tobacco products, prescription medicines, jewellery, watches, precious metals or stones, works of art, antiques, mobile phones, tablets, laptops or other consumer electronics, or any single item worth more than £100 to replace. If you send goods like these, or goods worth more than the cap, without our written agreement, you do so at your own risk.

8.5 No goodwill payment is made for goods that were not packed adequately, goods damaged before the Courier collected them, loss or damage reported more than 48 hours after the scheduled delivery time, or claims arising from your failure to follow Section 4.3.

8.6 We do not insure your goods. Please arrange your own insurance for them.

8.7 If the recipient refuses the goods, the Courier will tell you and will return or dispose of them as you or we instruct. Couriers are not responsible for delays against estimated delivery times.

9. Our responsibility to you

9.1 Nothing in these terms limits or excludes liability for death or personal injury caused by negligence, for fraud, or for anything else the law does not allow us to limit or exclude.

9.2 We provide the Platform with reasonable care and skill. We do not promise that it will always be available or free of errors, or that a Courier will always be available to accept a request.

9.3 We are not liable for loss of profits, revenue, business opportunity or goodwill, or for any indirect or consequential loss.

9.4 Our total liability to you in connection with these terms is limited to the total of the Courier Charges we collected from you and the MealShift Service Charges you paid us in the 12 months before the event giving rise to the claim. We use the Courier Charges only to measure this limit. Collecting them as the Couriers’ agent does not make them our income.

9.5 Apart from what these terms say, all terms implied by law are excluded as far as the law allows.

10. Your responsibility to us

10.1 You will cover any loss, cost (including reasonable legal costs) or liability we suffer because of a claim by someone else that arises from goods you send breaking the law, from inaccurate information you give us, or from your breach of these terms.

11. Suspending or ending your use of the Platform

11.1 You can stop using the Platform at any time. To close your account, email [email protected]. Amounts already due still have to be paid, including for work a Courier has already accepted.

11.2 We may close your account for any reason by giving you 30 days’ notice by email.

11.3 We may suspend or close your account straight away if you break these terms in a serious way and do not put it right within 14 days of our written notice (or it cannot be put right), if you become insolvent, if you use the Platform unlawfully or in a way that harms MealShift or Couriers, or as set out in Section 6.8.

12. Changes to these terms

12.1 We may update these terms, for example to reflect changes in the law, in our services or in how the Platform works.

12.2 We will email you, at the address on your account, at least 30 days before a change that affects you takes effect, and we will post the new version on this page with its effective date. A change the law requires, or one that only benefits you, may take effect sooner. A change to the Cancellation Fees applied to your account is not a change to these terms, and we do not need to give notice of it.

12.3 If you do not agree with a change, you can close your account before it takes effect. If you keep using the Platform after that date, the new terms apply to you.

12.4 Changes to the Price List follow Section 5.6. These terms cannot change your Agreement. That needs a written change signed by both of us.

13. Couriers

13.1 Couriers use the Platform under the MealShift Courier Agreement. It sets out that Couriers are self-employed, supply deliveries to the businesses they deliver for, appoint MealShift as their agent to set prices, collect Courier Charges and issue invoices in their names, and pay MealShift a commission. It also covers Couriers’ pay, self-billing, tax and VAT.

13.2 Couriers are free to accept or decline any offer, to work for others, and to decide how they carry out each delivery.

13.3 Couriers must have the equipment each job needs, including a suitable insulated delivery bag, must check that their vehicle and equipment are suitable before accepting a job, and must behave professionally. If a Courier uses a substitute, the Courier is responsible for making sure the substitute meets these standards.

13.4 If a Courier cancels work they have already accepted several times within a short period, we may pause their access to that type of work for a limited time. We set the limits, and the app shows the Courier the limit and what will happen before they cancel.

14. Recipients and complaints

14.1 The people who receive deliveries are not parties to these terms. Nothing in these terms affects anyone’s legal rights as a consumer.

14.2 If you have a complaint, email [email protected]. We will try to resolve it fairly and promptly. We may help to resolve a dispute between you and a Courier, but we do not have to.

15. Personal data

15.1 When we act for you. When you give us End-Customer Delivery Details so that a Delivery or Booking can be carried out, you are the controller of those details and we handle them for you as your processor. If you use In-House to run your own drivers, we also handle for you, as your processor, the details of those drivers that we hold because they work for you (their names, contact details, when they are on duty, their location while on your deliveries and their delivery records). The Data Processing Schedule sets out what we promise you as your processor.

15.2 When we are responsible ourselves. We are a controller, and responsible ourselves under Data Protection Laws, for: (a) your account and the details of your staff who use the Platform; (b) Couriers’ personal data, including their location while they are working and their delivery records, except where Section 15.1 applies; (c) data we use to keep the Platform secure and to prevent and investigate fraud, abuse and disputes; (d) billing and payment records, and recovering money owed to us or to Couriers; (e) the limited records of deliveries we keep afterwards to deal with complaints, claims, tax and our legal duties; and (f) information we have made anonymous, such as statistics about deliveries. Our Privacy Policy explains how we handle this data.

15.3 What you are responsible for. As controller of the End-Customer Delivery Details, you must:

(a) have a lawful basis under Data Protection Laws for giving them to us, and tell your customers in your own privacy information that you use delivery partners to deliver their orders;

(b) give us only the details needed for the delivery;

(c) not include health information (such as allergies or medical conditions) or any other special category data, or information about criminal offences, in delivery instructions or order details, unless the recipient has asked for it to be passed to the Courier; if it reaches us we will treat it as End-Customer Delivery Details and use it for nothing else;

(d) make sure your instructions to us about personal data are lawful; and

(e) deal with requests from your customers about their personal data that we pass on to you.

15.4 If you act for other businesses. If you send us orders on behalf of other businesses (for example as an ordering platform or delivery partner), you confirm that you have their authority to engage us, and we act as your sub-processor on the terms of the Data Processing Schedule.

15.5 Tracking and proof of delivery. While a Courier is on your Delivery or Booking, the Platform shows you the Courier’s name, phone number, type of vehicle and live location, and the progress of the delivery. The tracking link for a Delivery shows the recipient the same Courier details and live location, and the delivery address. When a Courier completes a Delivery, the Platform may show you a proof-of-delivery photo. We delete these photos about 10 days after the delivery, so save a copy if you need it for longer, for example for a claim under Section 8. If you connect an ordering platform or other integration, we send it the delivery status and the same Courier details, location and proof-of-delivery photo for the orders it sends us.

15.6 Courier details you receive. You receive the Courier details described in Section 15.5 as a separate controller. You may use them only to manage that Delivery or Booking and any complaint about it. You must keep them secure, not keep them longer than you need them for that, not pass them to anyone else unless the law requires it, and not use them for any other purpose, including marketing.

15.7 If you have a signed Agreement. If your Agreement contains its own data processing terms (for example Schedule B of a Merchant Service Agreement), those terms apply instead of Sections 15.1 to 15.4 and the Data Processing Schedule. If your Agreement says only that we will agree data processing terms on request, or does not deal with the processing of personal data for you at all, the Data Processing Schedule is those terms and applies to you.

16. Intellectual property

16.1 We, or those who license to us, own the Platform and everything in it, including its software, the MealShift name and logos. We give you a limited, non-exclusive right to use the Platform for your business while these terms apply. You get no other rights in it.

17. Other websites

17.1 The Platform may link to other websites and services. We do not control them and are not responsible for them, and a link is not an endorsement.

18. General

18.1 These terms (including the Data Processing Schedule) and the Price List are the whole agreement between us about the Platform, unless you have an Agreement (see Section 1.5). Our Privacy Policy and Cookie Policy are not part of it.

18.2 We may transfer our rights and obligations under these terms to another company in our group or to a buyer of our business. You may not transfer yours without our written consent.

18.3 A Courier may enforce the terms that concern the Deliveries and Bookings the Courier supplies to you, including your obligation to pay the Courier Charges. If we have paid a Courier for a Delivery or Booking before you pay us, we may enforce your obligation to pay those Courier Charges in our own name, and your payment repays our advance to the Courier. Apart from that, no one else has any rights under these terms under the Contracts (Rights of Third Parties) Act 1999.

18.4 If a court decides that part of these terms cannot be enforced, the rest still applies.

18.5 If we do not enforce a right straight away, we can still enforce it later.

18.6 We will send notices to the email address on your account. Send notices to us at [email protected].

18.7 These terms are governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.

Data Processing Schedule

This schedule forms part of the MealShift Terms and Conditions. It sets out what MealShift Ltd (“we”) promises when we handle personal data for you as your processor under Section 15.1. It does not apply if your signed Agreement contains its own data processing terms (see Section 15.7). Words defined in the Terms and Conditions have the same meaning here.

DP1 Words. “Personal Data we process for you” means the End-Customer Delivery Details and, if you use In-House, the details of your own drivers described in Section 15.1. “Sub-processor” means anyone we engage to process Personal Data we process for you. Other words have the meanings in Section 3 and in the UK GDPR.

DP2 Roles. You are the controller and we are your processor for the Personal Data we process for you. Section 15.2 lists the data for which we are a controller ourselves. Each of us is responsible for complying with Data Protection Laws in our own role, including having a lawful basis and giving any notices our own data subjects need.

DP3 What we process and why. Annex 1 describes the subject matter, duration, nature and purpose of the processing, and the types of personal data and data subjects.

DP4 Your instructions. We process the Personal Data we process for you only on your documented instructions, unless the law requires us to do something else, in which case we will tell you first if the law allows. Your instructions are these terms (including this schedule), the requests you make and settings you choose on the Platform, and any other instructions you give us in writing. We will tell you straight away if we think an instruction breaks Data Protection Laws.

DP5 Our people. Everyone we authorise to process the Personal Data we process for you is bound to keep it confidential.

DP6 Security. We keep appropriate technical and organisational measures in place to protect the Personal Data we process for you, including those in Annex 3. We may change them, but not in a way that materially reduces the overall level of security.

DP7 Sub-processors.

(a) You give us general authorisation to use sub-processors. Annex 2 lists the types of provider we use. The list of the providers themselves, with where they process data, is available to you on request to [email protected].

(b) We will tell you at least 14 days before we add or replace a sub-processor that will process End-Customer Delivery Details, by email to the address on your account. The notice will say what type of service the provider supplies, and we will give you its name and location if you ask. You may object on reasonable data-protection grounds within those 14 days. If we cannot resolve your objection, you may close your account or stop using the affected service, and we will not charge you for doing so.

(c) We put written data protection terms in place with each sub-processor that protect the data at least as well as this schedule, in a way that fits the service they provide. The Courier assigned to your delivery is bound by the Courier Agreement to use the delivery details only for that delivery, to keep them confidential and not to keep them afterwards. We remain responsible to you for our sub-processors as if their acts were our own.

DP8 Requests from individuals. We will help you, as far as we reasonably can, to respond to people exercising their rights under the UK GDPR. If one of your customers asks us about their End-Customer Delivery Details, we will pass the request to you without undue delay and will not respond ourselves, except to acknowledge it and tell them we have passed it to you, unless you instruct us otherwise or the law requires us to.

DP9 Other help. We will give you reasonable help with your obligations on security, personal data breaches, data protection impact assessments and prior consultation with the Information Commissioner (UK GDPR Articles 32 to 36), taking into account the nature of the processing and the information we have.

DP10 Personal data breaches. We will tell you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting the Personal Data we process for you. We will tell you, as far as we then know: what happened, including where possible the categories and approximate number of people and records affected; the likely consequences; what we have done or propose to do about it; and who to contact at MealShift for more information. If we do not have all the information at once, we will give it to you in stages without further undue delay. Separately, we keep a documented incident response procedure, which includes telling the Information Commissioner’s Office within 72 hours about any notifiable breach of data for which we are the controller.

DP11 Audit. We will give you the information reasonably needed to show that we comply with this schedule, and allow for and contribute to audits, including inspections, by you or an independent auditor you appoint. You must give us at least 30 days’ written notice, carry out the audit during normal business hours, audit no more than once in any 12 months (unless the Information Commissioner requires it or after a confirmed personal data breach), follow our reasonable confidentiality and security rules, pay your own costs and not unreasonably disrupt our operations.

DP12 When the service ends. When your account closes, or earlier if you ask about data no longer needed for the delivery, we will, as you choose, return the Personal Data we process for you to you as a file or delete it, and delete existing copies, within 30 days. If you do not tell us your choice within 30 days of the account closing, we will delete it. We may keep data where the law requires it (including for tax, accounting or legal claims), for as long as it requires, and will protect it from any other use. While your account is open, we keep End-Customer Delivery Details and delete proof-of-delivery photos as set out in Annex 3. The limited records we keep as a controller are covered by Section 15.2(e) and our Privacy Policy.

DP13 Transfers outside the UK. We will transfer the Personal Data we process for you outside the United Kingdom only with a safeguard that the UK GDPR recognises, such as UK adequacy regulations, the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You authorise us to enter into those safeguards with sub-processors on your behalf where needed.

DP14 Liability. Liability under this schedule is subject to Section 9, except that nothing in these terms limits liability where Data Protection Laws do not allow it to be limited. Where compensation is paid to an individual under Article 82 of the UK GDPR, you and we will share it between us according to each party’s responsibility for the damage.

DP15 How long it lasts. This schedule applies from the date these terms take effect for you, and for as long as we process personal data for you. DP10, DP11, DP12, DP13, DP14 and this DP15 continue after your account closes for as long as they are needed.

DP16 Order of priority. If this schedule and the rest of these terms say different things about the processing of personal data for you, this schedule applies. Both come before our Privacy Policy. Data processing terms in a signed Agreement come before this schedule (see Section 15.7).

DP17 Contacts. Our contact for anything under this schedule, including requests from individuals, breach reports and objections to sub-processors, is [email protected]. Your contact is the email address on your account, unless you tell us another in writing.

Annex 1. Details of the processing

Subject matter: arranging deliveries of your orders, and Bookings of Couriers, through the Platform, and (if you use In-House) running your own drivers on the Platform.

Duration: while you use the Platform, and afterwards only as DP12 allows.

Nature: collecting, recording, organising, storing, sending to the assigned Courier, displaying in tracking, retrieving, using, combining, restricting, anonymising and deleting.

Purposes: (a) arranging and tracking your deliveries and Bookings; (b) customer support and complaints about them; (c) invoicing and reconciliation between you and us; (d) fraud prevention, dispute resolution and safety on the Platform; (e) meeting legal and regulatory duties; and (f) if you use In-House, allocating your deliveries to your own drivers and showing you their progress.

Data subjects: your customers and anyone receiving a delivery for them; and, if you use In-House, your own drivers.

Types of personal data: name; delivery address and its map position; contact phone number; order reference; delivery instructions; times of order, dispatch, collection and delivery; proof-of-delivery photos where taken; other data reasonably needed to complete the delivery; and, for In-House drivers, name, contact details, duty status, location while on your deliveries and delivery records.

Special category data: none expected. See Section 15.3(c).

Annex 2. Types of sub-processor

Hosting and databases; communications (email, SMS, WhatsApp, telephony and app notifications); maps, address lookup and route calculation; payment processing; customer relationship management and helpdesk; error reporting and analytics; business software and automation tools we use to run support and operations; and the independent Courier assigned to each delivery. The providers’ names and locations are available on request (DP7).

Annex 3. Security measures and retention

Encryption in transit: TLS for all external web and API traffic.

Access control: role-based access on the principle of least privilege; access reviewed periodically.

Network and infrastructure: a separate production environment, firewall controls, vulnerability scanning and routine security patching.

Operations: monitoring for unusual activity and controlled changes.

People: written confidentiality duties for staff with access to personal data.

Incidents: a documented incident response and breach notification procedure (see DP10).

Resilience: regular backups of the production database.

Retention: we keep End-Customer Delivery Details while your account is open and deal with them under DP12 when it closes. We delete proof-of-delivery photos about 10 days after the delivery.

Suppliers: written data protection terms with each sub-processor (DP7).