Privacy Policy

1. Introduction

Avalon Prime (“we”, “us”, “our”) provides mobile and web applications designed for Delivery Service Providers (DSPs) to manage rota schedules, driver performance, offers, and operational documents. This Privacy Policy explains how we collect, use, store, and protect personal information when you use our mobile app or related services.

By using the Avalon Prime app or platform, you agree to the practices described in this Privacy Policy.

2. Information We Collect

2.1 Personal Information

We may collect and process the following personal information:

• Name
• Email address
• Phone number
• Driver ID or employee identifier
• Role (e.g., driver, admin, manager)

2.2 Usage & Operational Data

We collect data related to your use of the app and DSP operations, including:

• Rota schedules and shift assignments
• Availability submissions and preferences
• Performance metrics and operational statistics
• Offer responses and internal communications
• App interaction logs (e.g., navigation, feature usage)

2.3 Authentication Data

To secure access to the app, we process:

• Login credentials (e.g., email and password)
• Secure authentication tokens
• Session identifiers

2.4 Uploaded Files

DSPs and administrators may upload documents such as PDFs and other operational files. These may include:

• Performance reports
• Compliance and audit documents
• Rota summaries and operational records

These files are stored securely in cloud storage and retained according to DSP requirements and legal obligations.

2.5 Device & Technical Information

We may collect technical data such as:

• Device model and operating system
• IP address and general location (country/region)
• App version and configuration
• Crash logs and diagnostic information

3. How We Use Your Information

We use the information we collect to:

• Provide access to rota schedules and operational tools
• Manage driver availability and shift assignments
• Display performance metrics and operational insights
• Deliver offers, notifications, and internal communications
• Authenticate users and secure access to the app
• Improve reliability, performance, and user experience
• Maintain compliance with DSP and legal requirements

We do not sell or share your personal information with third parties for marketing purposes.

4. Legal Basis for Processing (GDPR)

As a UK‑based service, we process personal data under the following legal bases:

• Contractual necessity — to provide the core features of the app and fulfil our obligations to DSPs and users.
• Legitimate interests — to improve the app, ensure security, and support DSP operations.
• Consent — where required (for example, certain types of notifications or optional features).

5. Data Storage & Security

We use secure cloud services to store and process data, including encryption in transit (HTTPS) and at rest where supported. We implement:

• Access controls and role‑based permissions
• Regular backups and redundancy
• Monitoring and logging for security and reliability

Uploaded PDFs and operational documents are stored in secure cloud storage and are typically retained for up to five (5) years, unless your DSP or applicable law requires a different retention period.

6. Data Sharing

We may share data only in the following circumstances:

• With your DSP (employer or contracting organisation) to support rota, performance, and operational management.
• With trusted cloud service providers (e.g., hosting, storage, database) who process data on our behalf under appropriate agreements.
• With legal authorities when required by law, regulation, or court order.

We do not share personal data with advertisers or unrelated third parties.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy or as required by law:

• Driver and user account data is retained while your DSP account remains active and for a reasonable period thereafter.
• PDFs and operational documents are generally retained for up to five (5) years, unless deleted earlier at the request of the DSP or required by law.
• Authentication tokens and session data are deleted when you log out or when a session expires.

8. Your Rights (GDPR)

Subject to applicable law, you have the following rights regarding your personal data:

• Right to access your data
• Right to rectify inaccurate or incomplete data
• Right to request deletion (“right to be forgotten”)
• Right to restrict processing in certain circumstances
• Right to object to certain types of processing
• Right to data portability

In many cases, your DSP (employer) is the data controller. You may need to contact your DSP to exercise these rights. You can also contact us using the details below, and we will assist where appropriate.

9. Children’s Privacy

The Avalon Prime app and services are not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe that a child has provided us with personal information, please contact us so we can take appropriate action.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data processing practices. The latest version will always be available on this page and may also be accessible from within the app.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

11. Contact Us

If you have any questions about this Privacy Policy or how your data is handled, please contact:

Avalon Prime
Merthyr Tydfil, Wales, United Kingdom
Email: support@avalonprime.co.uk