Welcome to the Evri Privacy Notice. This privacy notice will inform you as to how we look after your personal data and tell you about your privacy rights and how the law protects you.
At Evri, we are 100% committed to protecting the personal data we process as a business.
For all our services, the data controller — the company that’s responsible for your privacy— is Evri.
Evri is a trading name of Evri Limited, Registered office: Capitol House, 1 Capitol Close, Morley, Leeds, LS27 0WH. Registered in England and Wales No. 03900782
Further information on how you can contact us with any questions on how we protect your privacy can be found at the end of this notice.
Our data protection officer (DPO), Ryan MacInnis, is responsible for overseeing questions in relation to this privacy notice.
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
We may collect, use, store and transfer different kinds of personal data about you which we have grouped together follows:
In order to carry out any processing of your Personal Data, we need to ensure that we have a particular reason to do so.
We have set out the reasons we have for processing your Personal Data in this Privacy Notice. These reasons can be grouped into one or more general grounds for processing, which directly relate to the legal grounds for processing set out in the UK GDPR and the DPA 2018.
We have identified these general grounds within this Privacy Notice and are described further below:
| Grounds | Description |
|---|---|
| Grounds The processing is needed for a contract with you. | Description We can process your Personal Data where the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into such a contract. This means that we can carry out the actions needed to conclude or execute our contract with you. For example, we need some information from you to be able to pay you and provide you with benefits. |
| Grounds The processing is needed so that we can comply with our legal obligations. | Description We can process your Personal Data where this processing is necessary for compliance with a legal obligation to which we are subject. Therefore, we can carry out any actions we need to take in order to comply with laws. This could include complying with employment law, tax requirements or immigration rules. |
| Grounds The processing is needed for our legitimate interests | Description We can process your Personal Data where the processing is necessary for our legitimate interests, provided that those interests are not overridden by your interests or your rights in your own Personal Data. Where we are relying on this ground as the basis for our processing, we will tell you what our legitimate interests are (whether in this Privacy Notice or in another fair processing notice). We can carry out any actions we consider are needed for these interests, as long as we consider that the processing in question does not negatively infringe on your privacy rights and interests. |
Certain categories of personal data may be considered sensitive and may receive special protection including:
Special Category Data – Means any personal data relating to your health, genetic or biometric data, sex life, sexual orientation, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, medical and diversity information.
In order to carry out any processing of your special category personal data, we need to have a particular reason to do so, in addition to the grounds for personal data set out above.
The same grounds can also be relied upon for processing criminal conviction data.
The grounds and what they mean are set out below:
| Grounds | Description |
|---|---|
| Grounds The processing is needed for carrying out our employment law obligations | Description The processing is necessary for the purposes of carrying out our obligations to you in the field of employment law, social security and social protection law (such as health and safety) |
| Grounds The processing is necessary for substantial public interest | Description The processing is necessary for reasons of substantial public interest as set out in UK GDPR. This includes for preventing and detecting unlawful acts and equality of opportunity. |
| Grounds The processing is needed to protect your life, or the life of another | Description The processing is necessary to protect your vital interests, or that of another person where you are physically of legally incapable of giving consent. This means we can process your personal data in situations such as medical emergency. |
| Grounds The processing is needed for legal claims | Description The processing is necessary for the establishment, exercise or defence of legal claims |
Evri may collect and process the following categories of sensitive personal data:
We may seek your consent to certain processing. If consent is required for the processing in question, it will be sought from you (whether within a fair processing notice or otherwise) directly by us or a third party appointed to do so on our behalf and will set out explicitly what we are seeking your consent for.
You should be aware that it is not a condition or requirement of your relationship with us that you agree to any request for consent from us.
We use your information in a number of different ways — what we do depends on the information. The tables below set this out in detail, showing what we do, and why we do it.
| How we use your name and contact details | Why | Lawful Basis for Processing |
|---|---|---|
| How we use your name and contact details To register you as a new candidate for the purpose of receiving Job Alerts and/or using the website | Why We have to use your name and address to add you to our systems | Lawful Basis for Processing Processing is necessary for the purposes of Evri’s legitimate interests |
| How we use your name and contact details To send you messages about suitable opportunities and/or your application by text and e-mail | Why To keep you up to date with our latest jobs and/or your application | Lawful Basis for Processing Processing is necessary for the purposes of Evri’s legitimate interests |
| How we use your name and contact details To register you as a courier | Why We have to use your name and address to add you to our systems | Lawful Basis for Processing Processing is necessary for the performance of a contract |
| How we use your name and contact details Deliver any letter correspondence | Why We have to use your name and address to deliver any letter correspondence | Lawful Basis for Processing Processing is necessary for the performance of a contract |
| How we use your name and contact details Send you service messages by text and e-mail to continually manage our relationship with you | Why We use your phone number and email contact details to send service messages | Lawful Basis for Processing Processing is necessary for the performance of a contract |
| How we use your name and contact details Provision and/or confirmation of appropriate insurance | Why Offer you access to and confirm you have adequate insurance in accordance with your contract | Lawful Basis for Processing Processing is necessary for the purposes of Evri’s legitimate interests |
| How we use your name and contact details To issue surveys, allowing us to better understand your experience with Evri, to continually improve our services | Why We use your phone number and email contact details to issue surveys | Lawful Basis for Processing Processing is necessary for the purposes of Evri’s legitimate interests |
| How we use your name and contact details To enable the ongoing assessment for automation for the pension scheme as well as calculating our contribution payable to the pension provider | Why We use your date of birth, national insurance number and gender for the provision of our courier pension (SE+ Only) | Lawful Basis for Processing Processing is necessary for Evri to comply with it’s legal obligations |
| How we use your name and contact details Creation of courier personalisation profile | Why We use your name and photo which is shared with customers, notifying them of who will be delivering their parcel | Lawful Basis for Processing Processing is necessary for the purposes of Evri’s legitimate interests |
| How we use your payment details | Why | Lawful Basis for Processing |
|---|---|---|
| How we use your payment details To issue payments | Why Necessary to pay you | Lawful Basis for Processing Processing is necessary for the performance of a contract |
| How we use your payment details Fraud prevention and detection | Why To prevent and detect fraud against either you or Evri | Lawful Basis for Processing Processing is necessary for the purposes of Evri’s legitimate interests |
| How we use your contact history | Why | Lawful Basis for Processing |
|---|---|---|
| How we use your contact history Provide customer service and support | Why To ensure you receive appropriate support in relation to any service enquiries you make | Lawful Basis for Processing Processing is necessary for the performance of a contract |
| How we use your contact history Train our staff | Why To ensure we can provide you the best possible service when you contact us | Lawful Basis for Processing Processing is necessary for the purposes of Evri’s legitimate interests |
| How we use information about performance data | Why | Lawful Basis for Processing |
|---|---|---|
| How we use information about performance data Improve quality of service | Why To continually improve our service to clients and customers | Lawful Basis for Processing Processing is necessary for the purposes of Evri’s legitimate interests |
| How we use information about how you use our website | Why | Lawful Basis for Processing |
|---|---|---|
| How we use information about how you use our website To use data analytics to improve our website, products/services, marketing, customer relationships and experiences | Why To define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy | Lawful Basis for Processing Processing is necessary for the purposes of Evri’s legitimate interests |
| How we use information about how you use our website To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) | Why For running our business, provision of administration and IT services, network security and to prevent fraud | Lawful Basis for Processing Processing is necessary for the purposes of Evri’s legitimate interests |
| How we use information about how you use our website Information relating to the type of mobile device being used when installing the BYOD application | Why To manage the ongoing provision of the BYOD application | Lawful Basis for Processing Processing is necessary for the purposes of Evri’s legitimate interests |
| How we use Criminal Conviction Data | Why | Lawful Basis for Processing |
|---|---|---|
| How we use Criminal Conviction Data Requested in the event of an incident involving theft or fraud against our business | Why To support any investigation relating to internal incidents or tip offs from members of the public to protect you or Evri | Lawful Basis for Processing Processing is necessary for the performance of a contract |
| How we use telematics information collected from you | Why | Lawful Basis for Processing |
|---|---|---|
| How we use telematics information collected from you Used internally to inform strategic decisions on our sustainability agenda. Shared with the provider of our courier insurance product. | Why Anonymised data used internally to monitor driving statistics in line with our ESG Strategy. Anonymised data shared with the insurance provider for them to monitor their risk associated with provision of their policy. | Lawful Basis for Processing Processing is necessary for the purposes of Evri’s legitimate interests. |
We also anonymise and aggregate personal information (so that it does not identify you) and use it for purposes including testing our IT systems, research, data analysis, improving our site and app, and developing new products and services.
You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see our cookie policy.
The app, like all apps, has a reserved area of the device (sandboxed) and cannot access anywhere else on the device due to the security/privacy restrictions imposed by Android/iOS. The only limited access outside of this is controlled through permissions which notify you of what access the app requires to function correctly, namely:
GPS - To allow location tracking for functionality such as ensuring parcels are delivered to the correct location, only when the user is logged on
Camera - Allows taking photos for use when delivering to a safe place and camerabased barcode scanner when scanning parcels
Audio - Required by Cordova application framework, however the application does not use this functionality.
Phone - Allows retrieval of signal strength and network status information, however the app will never attempt to make, answer or monitor phone calls
We do not, and will not, sell any of your personal data to any third party – including your name, address, email address or phone number. We want to earn and maintain your trust, and we believe this is essential in order do that.
However, we do share your data with the following categories of companies as an essential part of being able to provide our services to you, as set out in this notice:
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
Where permitted by applicable law, Evri may transfer the personal data collected about you to countries outside the European Economic Area (EEA) that may not be deemed to provide the same level of data protection as the UK, as necessary to perform the contract with you and for the purposes set out in this policy.
Evri has implemented either standard contractual clauses set out in the UK International Data Transfer Agreement (IDTA) or supplementary measures to secure the transfer of your personal data to these third countries.
We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Data Retention - How Long Will You Use My Personal Data For?
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
By law we have to keep basic information about our couriers (including Contact, Identity, Financial and Transaction Data) for six years after they cease providing services for us for tax purposes.
In some circumstances, we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.
We’ll hold on to your information for as long as you have your account, or as long as is needed to be able to provide the services to you, or (in the case of any contact you may have with our Customer Care team) for as long as is necessary to provide support-related reporting and trend analysis only.
If reasonably necessary or required to meet legal or regulatory requirements, resolve disputes, prevent fraud and abuse, or enforce our terms and conditions, we may also keep hold of some of your information as required, even after you have closed your account or it is no longer needed to provide the services to you.
You have a lot of rights relating to your personal information. You have the right to:
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.
If you have any questions about this privacy notice, including any requests to exercise your legal rights, you can do so either by:
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
If you wish to make a complaint about our collection or use of your personal data, please contact us in the first instance so that we may seek to resolve your complaint.
If you wish to raise a complaint, or just have questions, please contact - data.protection@Evri.com or at Data Protection Team, Evri, Capitol House, 1 Capitol Close, Morley, Leeds LS27 0WH.
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).