Privacy Policy - ArrowXL 2-Person Home Delivery

1. Introduction

At ArrowXL we respect your privacy and we are committed to processing personal information of our clients and customers securely and in a way that is compliant with our legal obligations.

In order to provide our services ArrowXL sometimes needs to collect information about you. This notice explains how ArrowXL collects, uses and shares any personal information that we may collect about you and your rights in relation to the personal data we hold.

"ArrowXL" is the trading name of Arrow XL Limited. Arrow XL Limited is the data controller for your personal data and is subject to the Data Protection Act 2018 (‘DPA’) and the General Data Protection Regulation (the ‘GDPR’). Arrow XL is registered with the Information Commissioner’s Office (‘ICO’) and its registration number is: Z2929066.

2. How we collect your information

ArrowXL collects personal information from business clients, customers and other recipients of delivery, warehousing or other services we provide in the following ways:

following requests or instructions to complete orders, deliveries or other services;
use of our services and website;
contact made with us for any reason including any enquiry or complaint (made via any form and including telephone calls, letters, emails, SMS, webchat and any other electronic communication methods accepted by ArrowXL);
completed ArrowXL forms and receipts (including proof of delivery and collection receipts);
completed customer satisfaction surveys;
reviews left on third party websites;
information entered or submitted via the ArrowXL website, the askAXL application or other ArrowXL applications;
for entrance to ArrowXL’s sites.

3. The types of information we collect about you

ArrowXL may collect, use, store and transfer different types of personal data about you. This includes information provided from our business clients, information you provide to us and information we create when providing services to you or for other customers. For more details of the personal data we process, and how this data is collected or obtained, see the table below.

Categories of data	Description			Source
Contact information	This includes your name, address, alternative delivery addresses and other contact information, such as your email address and telephone number(s). If you work for one of our business clients we will record your business’s name, your position in the business and the business’s address, email address and telephone number(s). If you visit one of our sites, we will request your name, job role and vehicle registration.			This information is collected from you if you use our services directly or from business clients or other customers when you are a recipient of services from one of our business clients or another customer. Alternatively, we may obtain personal details from third parties. For example, where we acquire third party data or information to verify delivery addresses and or delivery locations. This information is taken to confirm your identity for security purposes.
Contact preferences	Data recording your preference to receive communications about delivery dates and time slots.			This information will be created when you provide contact information and preferences in the course of an interaction with ArrowXL, such as when you are receiving a delivery from us. We will interact with you via: SMS, email, telephone call or live chat depending on the service and your choice.
Financial Details	Records of payments and payment information such as payments for property damage.			You provide this information yourself if we need to make a payment to you.
Client records	Records of services, including warehousing, pick and pack, delivery, recycle and disposal management services that you have used. This includes records of deliveries you have requested and details of customer details provided.			You provide much of this information yourself when you use our services. We will also generate information in the course of providing our services.
Customer records	Records of services and deliveries that have been received by you and all interactions with us.			Information will be provided from our clients you have placed orders with, yourself, interactions with you and records created by us when providing the service.
Address and Address history	We will hold records of addresses, for example, billing, delivery, previous and rearranged delivery addresses and locations used.			Information will be provided from clients, information you provide if you changed or rearranged delivery services or third party address verification services.
Address data	A building or delivery point address including latitude and longitude data may also include personal data (for example, where a delivery point/property is identified by personal data being processed).			Information provided by clients, you or third parties used to verify address details to improve delivery accuracy.
Delivery tracking information	Delivery tracking allowing clients and customers to track their orders in real time.			We use our market-leading askAXL web app to allow you to track your delivery and this is dynamically updated to within 30 minutes of delivery.
Contact history, including enquiries and complaints	These are details of any enquiry, complaint or claim you have made to ArrowXL and may include copies of correspondence and call recordings.			You will provide this information to us when you contact us to make an enquiry or complaint. We will also create records relating to this contact. This will include any information you provide including any sensitive information provided.
Call recordings	Records of calls for training, quality purposes or to investigate complaints or for the detection, investigation and prevention of crime (including fraud).			You will be advised when calling us if a call is being recorded. We will record inbound calls for delivery bookings, enquiries and we record our driver helpline for delivery issues. We will also create records relating to telephone calls.
Proof of delivery information	Records of delivery including the signature, name and address of people who sign for or accept delivery of items.			You provide this information if you accept delivery of an item, including when you accept delivery of an item for another person, such as a neighbour.
Recipient information	If a recipient is different from the customer (for example, if a delivery has been arranged or ordered for a third party). Recipients name and address are used to collect, sort, track and deliver an item. A client or customer may also provide us with contact information, such as your phone number or email address, so that we can provide delivery updates.			We receive this information from clients arranging for deliveries or customers requesting alternative delivery or placing orders on another person’s behalf.
Recordings of you	Images recorded on CCTV and other equipment used to protect our customers, employees and property.			We will record images of you if you a visit a location where CCTV is in operation, such as our warehouses, receptions, transport areas or depots. Some of our vehicles are fitted with reversing cameras as well as forward-facing / cab cameras.
Images	Digital images of products left in situ and delivery exceptions. These may contain location or other information that links the image to a customer or otherwise identifies an individual.			We create this information when digital images of products left in situ, images of property and delivery exceptions are taken.
Customer satisfaction survey data	Completed customer surveys used to review and improve our services.			You provide this information if you agree to complete a survey or questionnaire about the service you received.
Reviews on third party websites	Reviews on third party websites used to evaluate and improve our services.			If you include personal identifiers or order details in your review, ArrowXL will use this to identify your order to evaluate and improve our services.
Cookie data		A cookie is a piece of information in the form of a very small text file, which is transferred to an end user’s device when a website or internet based service/application is accessed by a user.	For details of Cookies used by ArrowXL, please see our Cookies Policy at: https://www.arrowxl.co.uk/cookie-policy.

4. How we use your personal data

ArrowXL uses the information that we collect for a number of different purposes in order to:

provide our delivery services to our clients and to improve that service;
process orders and to provide after sales services;
enhance or improve customers' experience of our services via customer satisfaction surveys or reviews on third party websites;
analyse your delivery preferences or how you interact with or use our websites and applications;
record and monitor outbound and inbound telephone conversations to ensure consistent service levels, prevent or detect fraud, resolve queries and complaints and for performance management and training purposes;
use digital imagery to help maintain the safety and security of our drivers, property, deliveries and the public; and
undertake research for analytical and statistical purposes.

ArrowXL will only process your personal data if there is a legal basis under data protection laws and the table below identifies these (more than one lawful basis may apply in some situations). In summary, these are:

Consent: you give consent for us to process your data for a specific purpose;
Contract: the processing is necessary for a contract or agreement with you;
Legal Obligation: the processing is necessary to comply with the law; or
Legitimate Interests: the processing is necessary for legitimate interests pursued by ArrowXL or another party.

The purposes for which ArrowXL processes personal data and the legal bases for doing so in each case are:

Purpose	Lawful bases for processing
Providing services to you where there is a contract or agreement in place (between the customer and the client) as a result of an order you placed with one of our clients.	Contract – we need to process your data to provide our services to you in accordance with that contract or agreement terms.
Providing delivery services to a third party recipient, such as when someone sends you a delivery to another party and we use your data to deliver it or provide delivery updates.	Legitimate Interests – we need to process your data to provide these delivery services and fulfil our contracts with other parties, including delivering the items to you and providing additional services, such as delivery updates.
Providing delivery via a third party, where a third party has agreed to accept delivery of an item on behalf of another person (such as a neighbour) and you have provided details to enable us to record the delivery, including where we inform the sender and the intended recipient that the third party has taken delivery of the item.	Legitimate Interests and consent – we need to process your data to provide the sender and recipient with your details in order to complete the delivery and to allow the delivery to be properly tracked within our records and Customer Relationship Management system.
As part of the askAXL application and Customer Relationship Management system, where we provide a service which informs both the sender and recipient of services about the delivery status and timing of that service.	Contract and Legitimate Interests – we need to monitor the delivery status of items to keep senders and recipients informed and to improve our service delivery and provide better information to our clients and customers.
Customer services – dealing with enquiries, complaints or claims relating to our services.	Contract and Legitimate Interests – we may need to process your data so we can handle and resolve any enquiry, complaint or claim raised by you or another person related to a contract and or other issue.
Providing data services to our business clients, to help them run their businesses better and fulfil their contracts with you. For example, we provide services for the delivery of items ordered from our clients and for the purposes of maintaining and updating accurate address data used for delivery, to process order status information.	Contract and Legitimate Interests – our business clients may have contractual obligations with you to be fulfilled and have a legitimate interest to process data in these ways, and we have a legitimate interest to process personal data to support them to do so. In each case, we need to process your personal data to fulfil contractual obligations and or to pursue those Legitimate interests.
Enhancing our client and customers' experience of our services and websites. For example, we use information on your visits to our websites to evaluate and understand how different people navigate our websites and how long they spend on particular pages.	Legitimate Interests – we sometimes need to process personal data to understand how you use our services so we can enhance and improve them.
Customer and market research and analysis, and the development of new services. For example, we use customer satisfaction surveys and reviews left with third parties like TrustPilot to evaluate and understand how our services are working, how they can be improved and for the purposes of developing new delivery services or new enhanced services (such as our furniture and flat-pack assembly service, TV wall mounting or collection and recycling services). We may contact you to discuss a survey or review.	Legitimate Interests – we sometimes need to process personal data to evaluate and improve our services and to develop new service offerings.
Entering customers into prize draws following completion of customer satisfaction surveys.	Legitimate interests – we may use prize draws as an incentive to customers to provide feedback by way of customer satisfaction surveys.
Security, preventing fraud and money laundering, and taking action against fraudsters or people who commit an offence.	Legitimate Interests and Legal Obligation – we sometimes need to process personal data to protect rights, property and peoples’ safety.
Tax.	Legal Obligation – we need to process personal data to comply with revenue and customs regulations.
Prevention and detection of crime – including the use of CCTV to protect our client, customers, employees, the public and property.	Legitimate Interests and Legal Obligation – we sometimes need to process personal data to protect the rights, property and the safety of people.
Complying with the law, including regulatory requirements.	Legal Obligation and Legitimate Interests – to comply with our legal obligations, including regulatory conditions relevant to our services, and health and safety legislation, we sometimes have to process personal data.

5. Who we share personal data with

ArrowXL employees, contractors or agents may access information:

to provide delivery of items to you, or management of a service;
to process, deal or respond to any enquiry, complaint or other contact you have made with us;
to contact you regarding customer satisfaction surveys and reviews left on third party websites;
to evaluate customer satisfaction surveys and reviews and improve service delivery; and
for troubleshooting and maintenance purposes.

Client:

We share personal data with our business clients for the purposes of providing services to them, for example the provision of proof of delivery of items delivered to you on their behalf and status of delivery information for items we are delivering to you on their behalf.

Other Third Parties:

We use data processors who are third parties providing elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.

Other third parties (including the police, law enforcement agencies, credit reference and fraud prevention agencies and other bodies) to protect our or another person’s rights, property, or safety, in connection with the prevention and detection of crime.

In some circumstances we are legally obliged to share information. For example, under a court order or where we cooperate with a regulator undertaking an investigation into complaints or criminal conduct. We might also share information with other regulatory bodies in order to further their, or our, objectives. In any scenario, we’ll satisfy ourselves that we have a lawful basis on which to share the information and document our decision making and satisfy ourselves we have a legal basis on which to share the information.

We may transfer your personal data to the other following third parties:

Technology service providers – our partners who provide IT, applications and website services;
Verification service providers – our partners who provide address verification and address location data to improve the speed and accuracy of our delivery service;
Customer service providers – our partners who work with us to administer your delivery and provide you with any help you may need;
Telephony providers – our partners who provide telephone services and functionality;
Third party delivery companies – our Third Party and/or Self-Employed couriers and parcel firms who may deliver your goods or services and manage any returns on our behalf;
Regulators, lawyers, courts and or other governmental agencies or law enforcement agencies. Arrow XL may be required to disclose certain personal information because it is required to by law or for the purposes of legal proceedings.

Transfer of Information Outside of the European Economic Area:

In operating our services, it may become necessary to transfer the data that we collect from you to third parties and business partners who are located outside of the European Economic Area (EEA), for support, processing or maintenance of the purposes. Any such transfer of information will only be in connection with the services that ArrowXL provides and for a purpose that is stated in the privacy notice. ArrowXL will ensure that the information is protected to a level which meets the requirements of UK law which may include, ensuring it has approved protections in place and/or having standard contractual clauses in place with the third party to ensure your rights are protected.

6. Will you be contacted for martketing purposes?

We send commercial e-mails to individuals at our business clients or other companies with whom we want to develop or maintain a business relationship in accordance with applicable laws. Individuals at our business clients can opt out of receiving marketing emails at any time by using the contact details in section 9 below.

ArrowXL currently does not conduct any form of direct marketing targeted at our customers though we may ask you for feedback on the performance of our services via customer satisfaction surveys.

We will not share your information with any third parties for the purposes of direct marketing.

7. How we keep your data safe

ArrowXL is committed to keeping customers’ personal information secure to protect it from being inappropriately or accidentally accessed, used, shared, disclosed, lost or destroyed. We will take appropriate technical and organisational precautions to prevent the loss, misuse or alteration of any personal information. ArrowXL is committed to ensuring that:

The confidentiality of information is protected to prevent unauthorised disclosure.
The integrity of information is maintained to ensure its accuracy and completeness.
The availability of information is maintained to meet business needs.

Our client and customer data is held within a dedicated and secure Customer Relationship Management system hosted on a secure network with access controlled on a need to know basis. A range of administrative, technical, physical security controls are used to ensure a robust approach to protecting data held on ArrowXL systems, and when approved transfers with third parties are undertaken.

8. How long is your information kept?

We will hold your personal information within a secure dedicated database for as long as is necessary to provide our delivery and other services to you. Once services are completed, we will determine how long to retain the different types of information about you based on our Records Management / Data Retention Policy and the following requirements:

How long the information is needed for the specific purpose or purposes it is used for;
Legal and regulatory requirements – For example, if Arrow XL is required to retain client and or customer records for an additional period of time in order to comply with a legal (including regulatory) requirement; and
To maintain records in the event of any potential or actual claims.

9. How we keep your information up to date and communication preferences

ArrowXL wants to ensure that we keep the details we hold about you up to date and communicate with you fully in accordance with your wishes. You should also get in touch with us if any of your personal details change. Clients can update details at any time using the Customer Relationship Management system. Customers can contact us using the contact details at https://www.arrowxl.co.uk/help:

Email: [email protected]

Webchat

Give us a call: 01942 943700

10. Your rights

Under the Data Protection Laws, you have the rights to:

Request access to your information (commonly known as a “subject access request"). This enables you to receive a copy of your data and to check that we are lawfully processing it.

Request correction of your information. This enables you to ask us to correct any incomplete or inaccurate information we hold about you. ArrowXL will ensure that personal data is kept accurate and up to date as far as is reasonably possible. However, ArrowXL relies on clients and customers to ensure that some information it holds about them is accurate and up-to-date. We encourage clients and customers to inform ArrowXL of any changes to their information or delivery requirements (e.g. by updating account details or contacting us).

Request erasure of your information. This enables you to ask us to delete or remove your information in certain circumstances; for example, if you consider that there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your information if you have exercised your right to object to processing (see below). Where personal data is still needed for a lawful purpose, it may not be possible to delete that data and some requests may therefore be declined.

Object to processing of your information where we are relying on our legitimate interests (or those of a third party) and there is something about your particular situation which makes you want to object to processing for this reason. You would also have the right to object if we used your data for direct marketing purposes.

Request the restriction of processing of your information. This enables you to ask us to suspend the processing of your information; for example, if you want us to establish its accuracy or the reason for processing it.

Request the transfer of your information to another party (data portability). This right only applies to information which you have provided to us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated.

Please note that the above rights are not absolute, and we may be entitled to refuse requests where exceptions apply. Before we respond to or process a request proof of identification may also be required in order to protect your information and to ensure it is not disclosed to unauthorised parties.

You are not required to pay any charge for exercising your rights. We have one month to respond to you.

11. How to exercise your data rights

If you wish to exercise any of your rights, please contact ArrowXL using the following contact details:

By email to: [email protected]

By telephone on: 01942 943700

By post to:

Information Security
Martland Mill Lane
Wigan
WN5 0LZ

12. How to ask questions or raise concerns?

If you have any questions, comments or concerns about how we use or handle your personal data please contact us using the contact details in section 11 above.

If you are not content with how we handle your information we would ask you to contact us to help you.

You also have the right to complain directly to the Information Commissioner at: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Information about the Information Commissioner is available at: www.ico.org.uk.

13. Changes to this privacy notice

This privacy notice may be updated from time to time so you may wish to check it each time you submit personal information to Arrow XL. The date of the most recent versions will appear on this page (see version control). We encourage you to check our privacy notice from time to time to ensure you understand how your data will be used and to see any minor updates. If material changes are made to the privacy notice we will provide a more prominent notice.

14. Version control

This privacy notice was last updated on: May 2021