Privacy policy

Esa Couriers, Chicksand Avenue, Milton Keynes, Buckinghamshire, is responsible for deciding how personal information is used in running this website and our transport business. For those activities we are the data controller.

Please contact info@esacouriers.co.uk, call 01908 822 779, or write to the address above about privacy, a correction or a rights request. You do not need to use a particular form or legal wording.

• Enquiries and correspondence: your name, contact details, company, message and any information you choose to include when speaking or writing to us.
• Quotations and bookings: collection and delivery addresses and postcodes, intermediate stops in the requested order, contact names and telephone numbers, goods descriptions, weight, pallet count, vehicle choice, dates, times, access instructions and other job notes.
• Accounts and applications: account contact details, a password stored as a hash, registered and trading company details, registration and VAT numbers, addresses, finance contacts, anticipated spending, trade references and your application declarations.
• Payments and account administration: quote and invoice references, prices, discounts, payment status, transaction references, correspondence about balances, and the evidence needed to resolve a payment query.
• Your choices: booking notification preferences and the cookie-notice acknowledgement on this device.

Please provide accurate, relevant information and tell us when it changes. Free-text fields and messages are not public posts. Do not send passwords, full card details or unnecessary sensitive information about yourself or another person through them.

Visiting the website makes technical information available to our server and hosting services, such as your IP address, browser and operating-system information, requested pages, request times and error details. Sign-in records include an IP address and browser description. These records help operate the website, investigate problems and protect accounts against misuse.

We derive location coordinates from the postcodes supplied for your journey to estimate mileage and display a route. The website does not request your device's GPS position or continuously track your location. It does not currently use advertising pixels, behavioural analytics or device fingerprinting.

A person arranging transport may give us the details of a sender, recipient or colleague. A business applicant may nominate a finance contact or trade reference. We may receive a response from those references, operational updates from a carrier, and payment or fraud information from a payment provider. When checking a company we may also consult public business information, such as Companies House.

If you give us another person's details, make sure you have a proper reason to do so and direct them to this policy. We use their details for the relevant delivery, enquiry or business assessment, rather than treating them as a marketing contact. You can ask us which source supplied information about you.

We use information to answer enquiries, calculate prices, arrange transport, communicate about a booking, take or reconcile payment, administer accounts and resolve complaints. Where you are personally entering a contract with us, this processing is needed to take the steps you request before that contract or to perform it.

For company representatives, delivery contacts and trade references, our usual basis is our legitimate interest in managing a business relationship and completing the requested service. We also rely on legitimate interests for proportionate security checks, prevention of fraud, credit-risk assessment, service troubleshooting, debt recovery and handling legal claims. We consider the effect on your rights when using this basis.

Legal obligations apply to records or disclosures required for tax, accounting and other applicable laws. If we ask for consent for a particular optional activity, we identify that activity separately. A privacy acknowledgement or account application does not replace the lawful grounds needed for processing.

We need suitable contact, journey and consignment details to price and perform a delivery. We need the company and finance information requested in the business application to assess an account with payment terms. If necessary information is missing, we may be unable to provide the quotation, accept the booking or approve credit. Optional notes and optional cookie choices are separate from those requirements. Guest checkout remains available where offered.

Authorised staff review business applications, company information and trade references. They decide whether to approve an account and what discount or payment terms to offer, and may keep review notes and decision records. Confirming an email address does not automatically approve credit. The website does not currently connect to an automated credit-scoring service.

Online quotations use the journey, vehicle, load, dates and applicable pricing rules, including agreed account discounts. Those calculations produce the displayed price; they do not build an advertising profile of you. Contact us if information or a price appears wrong or you want a member of staff to review the circumstances. Credit approval and account terms are subject to human review.

Access is limited to what is appropriate for the purpose. Recipients may include:

• Our authorised staff, drivers and subcontracted carriers, who need contact, address, consignment and access details to organise and complete a job.
• Hosting, email and technical support providers that operate or support our systems and service messages.
• Payment services, banks, accountants, legal advisers, insurers and claims handlers where needed for a transaction, record, dispute or claim.
• A nominated trade reference or accounts contact, to check an application or manage the company's account.
• Regulators, courts, law-enforcement bodies or other parties when a lawful obligation or justified legal process requires disclosure.

We do not sell personal information or provide customer lists to third parties for their own direct marketing. Service providers may act on our instructions, while banks, carriers or professional advisers may have separate legal responsibilities for their own processing. Their role depends on the activity, not simply their description as a supplier.

Our server sends entered postcodes to postcodes.io to look up their coordinates. Routing requests send journey coordinates to an OSRM routing service to calculate road distances and route lines. We do not include your name, email, telephone number or goods description in those lookup requests.

When a map is displayed, your browser requests map tiles from OpenStreetMap. That provider receives the technical information needed to deliver them, including your IP address, browser information, the requested map area and our website's origin. The tile request does not include your private booking-page link or access token. These services have their own privacy information governing their handling of requests.

Where online card payment is available, checkout takes place on Stripe's hosted payment page. We provide the email address, booking identifiers, collection and delivery postcodes, vehicle description and payment amounts needed to create and reconcile the transaction. Stripe receives the information you enter on its payment page and may process it for payment security and its own legal duties.

We receive payment status and transaction references. Our website does not receive or store the full card number or card security code. Stripe's privacy and cookie information applies on its checkout page; our website's cookie controls do not manage that separate service.

Essential storage supports sign-in, carrying a quotation through the booking steps, and remembering that you have acknowledged the cookie notice. The sign-in cookie is normally a browser-session cookie with a server-side limit of 12 hours. Choosing Remember me allows a session lasting up to 14 days. Signing out ends the current session. The quote draft and booking handoff can retain the postcodes, stops, load details, requested times and optional email address in the current tab's session storage, so you can return to your quote without entering these details again.

We do not currently run optional analytics or advertising cookies. The short notice has an OK button that records acknowledgement for six months, without giving consent for optional tracking. You can reopen it using Cookie settings in the footer. Continuing to browse is not treated as consent. Essential storage remains necessary for the features you request. Our cookie policy explains the individual items, their duration and browser controls.

Some technology and payment providers operate internationally, so information may be handled outside the United Kingdom. The privacy information for each provider explains its locations and arrangements; your information is not necessarily processed only in the UK.

Where a transfer we arrange is restricted by UK data protection law, an appropriate legal transfer mechanism is required. This may be UK adequacy regulations or approved contractual safeguards together with the required assessment and protections. Contact us for information about the countries and safeguards relevant to your information, or to request a copy of applicable safeguards with confidential details removed where necessary.

We use HTTPS, hashed passwords, protected session tokens and access controls to help protect information. Administrative access is restricted, and account verification and password-reset links expire. No internet service or method of storage can be guaranteed completely secure. If a breach occurs, we will assess it and make notifications to the regulator or affected people when the law requires them.

Use a unique password, keep private booking links confidential and sign out on shared devices. Tell us promptly if you suspect that someone has accessed your account or booking without permission.

We decide how long to retain information by considering the service and account relationship, unpaid balances, tax and accounting duties, complaint and claim periods, security investigations and any legal requirement to preserve records. Information with no continuing retention reason is due for deletion or anonymisation.

• Our normal retention target for job, invoice and supporting transaction records is six years after the end of the relevant accounting period, subject to a longer legal requirement or an unresolved matter.
• Our target is to review general enquiries for deletion after two years without further contact. An enquiry forming part of a booking, complaint or claim follows the retention needs of that matter.
• Account and application information is needed while an application is being assessed or the business relationship continues. Afterwards we consider outstanding obligations and the evidence reasonably needed for questions or disputes; unsuccessful applications do not create a reason for indefinite retention.
• Security, session, verification and recovery records are retained according to their operational purpose and any investigation. Expiry of a sign-in session prevents its use; it does not mean every related security record is immediately erased.

Closing an account removes access but does not automatically erase booking contacts, invoices or other records that still have a valid retention reason. Open jobs, pending payments or unpaid business invoices can prevent self-service account closure; this does not prevent you from making a privacy request. Retention and erasure also need to account for protected backups and records held by recipients. Ask us about a particular record if you need its retention position.

Depending on the circumstances and applicable law, you can ask for access to your personal information, correction of inaccuracies, deletion where it is no longer justified, or restriction of its use. Where portability applies, you can request the information you supplied in a reusable electronic format and, where feasible, have it passed to another provider. These rights have conditions and do not automatically override legal record-keeping duties or the rights of other people.

You can make a request using the contact details above. We may need proportionate evidence of identity to avoid disclosing information to the wrong person. Requests are normally free and answered within one month; if the law allows extra time, we will explain why. If we cannot fulfil all or part of a request, we will explain the reason and the available complaint route.

You may object to processing based on legitimate interests for reasons connected with your circumstances. We will consider the objection and stop unless there is a lawful reason to continue. You can object to the use of your information for direct marketing at any time.

Where a particular activity relies on consent, you can withdraw it at any time by contacting us or using the relevant preference control. Withdrawal does not change the lawfulness of processing before that point. We will not penalise you for exercising a privacy right or declining optional cookies. If information is essential to a service, we will explain any practical effect of removing it.

Account verification, security, application decisions and necessary payment or service messages are different from promotional marketing. Booking update preferences are available in the booking process. The website does not currently operate a marketing mailing-list subscription or targeted advertising service. If we introduce optional marketing, we will explain the purpose, provide the choices required by law and give you an easy way to stop it. A cookie choice does not subscribe you to marketing emails.

Our booking and business account services are intended for adults, not directed at children. We do not knowingly seek information from children through account registration. If you believe a child has supplied personal information inappropriately, contact us so that we can investigate and take appropriate action.

The forms do not ask for health, biometric, political or other special category information. If an exceptional delivery requirement involves sensitive information, speak to us first so that only necessary details are shared with an appropriate legal basis and protection.

If the business is reorganised, transferred or sold, relevant records may need to be disclosed to advisers or a prospective or new operator. Any disclosure must have a lawful basis, be limited to what is needed and use suitable confidentiality protections. A transfer does not remove your information rights, and any material change in who is responsible will be explained as required.

External websites and services linked from our site have their own privacy practices. A link does not make us responsible for their independent processing. Review their notices before providing them with information. Where we process information solely on another organisation's documented instructions, the relevant processing arrangement and that organisation's notice also need to be considered; this policy does not replace such an arrangement.

Please tell us if you are concerned about our handling of information so we can investigate. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator. You do not have to give up that right by using our services.

We may update this policy when our services, data practices or legal requirements change. The date at the top identifies the current version. For a material new use of information we will provide appropriate notice and obtain fresh consent where required; publishing a change does not itself give us your consent.