Privacy Policy
Last updated: 2026
Draft for review. Items in [square brackets] must be completed, and the controller/processor position confirmed, before launch. This draft describes RouteCheck’s actual data practices but must be reviewed by a qualified solicitor to ensure it meets your UK GDPR obligations.
1. Who we are
RouteCheck Ltd (“RouteCheck”, “we”, “us”, “our”) provides LiDAR delivery-clearance surveys and the software that supports them. RouteCheck Ltd is a company registered in England and Wales (company number 17236415), with its registered office at 152 Rutland Avenue, High Wycombe, HP12 3JG. We are registered with the Information Commissioner’s Office (registration number [ICO REGISTRATION NUMBER]).
This policy explains what personal data we handle, why, and the rights you have. Questions can be sent to [privacy@routecheck.uk].
2. Our role — controller and processor
RouteCheck acts in two different capacities depending on the data:
• As a data PROCESSOR: when we carry out a delivery-clearance survey for a retailer, delivery firm or other business, that business decides why the survey happens and is the data controller. We process the customer and survey data on that business’s documented instructions, under a data-processing agreement with them.
• As a data CONTROLLER: for the personal data we determine the use of ourselves — for example the accounts of the office and crew users of our software, and our own business records.
If you are a delivery customer and want to exercise your rights, you can contact the business that arranged your delivery, or contact us and we will assist and pass the request on where needed.
3. Personal data we collect
Customer & delivery details (provided by our client): name, delivery address, contact details such as email, the item being delivered and its dimensions.
Survey data captured on site: LiDAR measurements and clearance readings; 3D mesh reconstructions of the access route and snapshot images of them; photographs of access points and “pinch points” along the route, with any crew notes; and a coverage overview image of the scanned route.
Consent records: confirmation that the survey was authorised, the date and time, and — where given — the customer’s captured signature.
Account & usage data: for office and crew users of our software — names, email addresses, phone numbers, device information, and (for crew) a securely hashed PIN. We never store or display crew PINs in readable form.
4. How we use personal data
To carry out delivery-clearance surveys and deliver the resulting reports to the instructing business.
To capture and record customer consent for a survey.
To operate, secure, maintain and improve the RouteCheck service.
To provide customer support and to meet our legal, regulatory and contractual obligations.
5. Legal bases
Where we act as processor, our client (the controller) is responsible for the legal basis of the underlying processing; we act on their instructions.
Where we act as controller, we rely on: performance of a contract (to provide the service and manage accounts); our legitimate interests (to run, secure and improve the service, balanced against your rights); consent (for the customer survey, obtained as described below); and compliance with legal obligations.
6. Customer consent for a survey
Before a survey, the customer is sent a consent link to their own email address (so that opening and confirming it demonstrates control of that inbox). The customer reviews what will be collected and confirms, optionally providing a signature. Consent can be declined. The consent record is retained as evidence that the survey was authorised.
7. Sharing and sub-processors
Survey results are shared with the instructing retailer or delivery firm for delivery planning. We do not sell personal data or use it for advertising.
We use a small number of trusted sub-processors under appropriate data-processing terms:
• Supabase — cloud database, file storage and authentication (hosting and infrastructure for the service).
• Resend — sending transactional emails (for example the customer consent link and account emails).
We may also disclose data where required by law or to establish, exercise or defend legal claims.
8. Where your data is stored and international transfers
Personal data (our database and stored survey media) is held on cloud infrastructure located in the United Kingdom (London region). Some sub-processors may process limited data outside the UK — for example email delivery — and where they do, we ensure an appropriate transfer mechanism is in place (such as the UK International Data Transfer Agreement or an adequacy decision).
9. Security
We protect personal data with technical and organisational measures, including: encryption of data in transit and at rest; row-level access controls in the database so users only see the data they are entitled to; a private media store with short-lived, signed access links rather than public URLs; and hashed (never plaintext) crew PINs. Access to production data is limited to authorised personnel.
10. Retention
We keep personal data only as long as needed. Survey media (photographs and 3D-scan images) are automatically deleted after 90 days. A job’s remaining records are deleted after 12 months, unless we are required to keep them longer for legal reasons. Where we act as processor, retention also follows our client’s instructions.
11. Your rights
Under UK data protection law you have rights to access your personal data; to have it corrected; to have it erased; to restrict or object to its use; and to data portability.
For survey/customer data where we act as processor, please direct requests to the business that arranged your delivery; we support them in responding. For data where we are the controller, contact us at [privacy@routecheck.uk] and we will respond within one month. Our software supports exporting and permanently erasing an individual job’s data to help meet these requests.
12. Cookies
Our software uses only essential cookies needed to keep you signed in and to operate securely. We do not use advertising or third-party tracking cookies. [Confirm before launch if any analytics are added.]
13. Children
The RouteCheck service is intended for use by businesses and their adult customers and is not directed at children.
14. Changes to this policy
We may update this policy from time to time. The “last updated” date below shows when it last changed, and material changes will be notified where appropriate.
15. Complaints and contact
Data-protection questions or requests can be sent to [privacy@routecheck.uk]. If you are unhappy with how we have handled your data, you can complain to the UK Information Commissioner’s Office (ico.org.uk), though we would appreciate the chance to help first.