Privacy Policy

Towbee UK Ltd ("we", "us", "our") is the data controller responsible for your personal data within the meaning of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this Privacy Policy or how we handle your data, please contact us via the platform's support channel.

Account data (all users): Full name, email address, phone number, and account type (customer or vendor).

Customer job data: Vehicle registration, make, model, condition, pickup and delivery addresses and postcodes, job notes, vehicle photos, and any messages sent through the platform.

Vendor data: Business name, contact name, phone, operating areas, vehicle types handled, equipment, and verification documents — Motor Trade / Haulage Insurance, Goods in Transit (GIT) Insurance, Operator's Licence (O-Licence), and Public Liability Insurance.

Payment data: We use Stripe to process payments. We do not store your full card details — Stripe handles all payment information securely. We store transaction references and payout status.

Usage data: We track anonymised analytics events (e.g. job postings, bids placed) to improve the platform.

We process your personal data under the following legal bases:

Contract (Art. 6(1)(b)): To facilitate jobs between customers and vendors, process payments, and provide the marketplace service you registered for.

Legal obligation (Art. 6(1)(c)): To retain verification documents (insurance, operator's licence) as required by UK transport and insurance regulations.

Legitimate interests (Art. 6(1)(f)): To verify vendor credentials, prevent fraud, maintain platform safety, and resolve disputes.

Current documents: Your active verification documents (insurance, GIT, operator's licence, public liability) are stored for as long as your account is active and are checked monthly for validity.

Superseded documents: When you upload a replacement document, the previous version is archived and retained for 6 years from the date it was replaced, in line with UK insurance and financial record-keeping requirements. After the 6-year retention period expires, the archived document record is permanently and automatically deleted.

Expired or invalid documents: Documents flagged as expired or invalid by our automated monthly check remain on file so that you can upload a replacement and we can verify the update. They follow the same 6-year retention schedule from the date they were superseded.

We share only the minimum information necessary to facilitate job completion:

Before a bid is accepted: customers and vendors see only postcode areas and job details (no full contact information).

After a bid is accepted: the customer's pickup/delivery address and contact name, and the vendor's contact details, are shared between the two parties to complete the job.

We share data with Stripe for payment processing and payout management. We do not sell your data to third parties.

You have the following rights regarding your personal data:

Right of access (Art. 15): You can request a copy of the personal data we hold about you.

Right to rectification (Art. 16): You can correct inaccurate or incomplete data by editing your profile or contacting us.

Right to erasure (Art. 17): You can delete your account at any time via your account settings. This permanently removes your profile, documents, job history, bids, ratings, and messages. Verification documents already superseded will be retained for the remainder of their 6-year retention period as required by law.

Right to restriction (Art. 18): You can request that we limit processing of your data in certain circumstances.

Right to data portability (Art. 20): You can request your data in a structured, machine-readable format.

Right to object (Art. 21): You can object to processing based on legitimate interests.

To exercise any of these rights, use the "Delete Account" option in your settings or contact us via the platform's support channel.

You can permanently delete your account at any time:

Vendors: Go to your Vendor Profile page and use "Delete Account". This permanently deletes your business profile, all uploaded documents, job history, bids, ratings, fleet records (trucks, assignments, external runs), team members, and messages.

Customers: Go to Account Settings and use "Delete Account". This cancels any open jobs and removes your account.

Account deletion is irreversible. Once initiated, your data cannot be recovered.

We take appropriate technical and organisational measures to protect your personal data, including encrypted data transmission, secure file storage, and restricted access controls. Payment data is handled exclusively by Stripe, which is PCI DSS compliant.

Your personal data is stored and processed within the United Kingdom and European Union. We do not transfer your personal data outside the UK/EU.

We use essential cookies to maintain your login session and remember your preferences. We do not use advertising cookies. Analytics data is collected in an anonymised or pseudonymised form to help us understand how the platform is used.

We may update this Privacy Policy from time to time. We will notify registered users of any material changes via email. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.

If you believe we have not handled your personal data in accordance with this policy, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.