Ullr System

Who this notice is for

This notice applies to anyone who uses the Ullr System proof of delivery application as a driver or delivery operative. It explains what personal data the app collects about you, why, and what happens to it.

Who controls your data

The Ullr System is operated by the company or individual who has deployed this application to you (your "operator"). Your operator is the data controller responsible for your personal data. If you have questions about your data, contact your operator directly.

What data we collect about you

• Your name and email address — used to verify your access and identify deliveries you have made
• GPS location — recorded at the time each photo is taken, to confirm where a delivery was made
• Photos — images of delivery documentation captured through the app
• Date and time — the timestamp of each delivery you record

Why we collect it

This data is collected to provide proof of delivery records on behalf of your operator. The lawful basis is legitimate interests — specifically, the legitimate interest of your operator and their customers in having accurate delivery records.

If you are engaged as a contractor or self-employed driver, this notice forms part of your understanding of how your data will be used in connection with that work.

Where your data is stored

Data is stored in two places:

• On your device — temporarily in the app's local storage until you upload
• Google Drive — once uploaded, delivery records and photos are stored in a Google Drive folder controlled by your operator

Google's infrastructure may process data outside the UK or EEA. This is covered by Google's standard data processing terms and transfer mechanisms.

How long we keep it

Your delivery records are kept for 12 months from the date they are created, after which they will be deleted. Data stored locally on your device is automatically purged after 30 days.

Who can see your data

• Your operator and any staff they authorise
• No data is sold or shared with third parties for marketing purposes

Your rights

Under UK GDPR you have the right to access, correct, or request deletion of your personal data, and to object to processing in certain circumstances. To exercise any of these rights, contact your operator. If you are unsatisfied with their response, you can contact the Information Commissioner's Office at ico.org.uk.