Privacy Policy

Who we are

Ding Dings is a grocery and essentials delivery service operating in the United Kingdom. We are the data controller for the personal data described in this policy. For any question about your data, contact [email protected].

What we collect

We only collect what we need to deliver your order and, where you are a courier, to pay you and meet our legal duties.

For customers

• Identity and contact — name, delivery address and postcode, phone number, email address.
• Your order — the items you bought, the shop we collected them from, the price paid, and delivery instructions.
• Payment confirmation — the result of the transaction. We never see or store your card number; card details are handled entirely by Stripe.
• Delivery and location data — where the courier is while your order is in transit, and the delivery PIN that confirms handover.
• Communications — order update messages and any support correspondence.

For couriers

• Identity and right-to-work evidence — photo ID, driving licence, vehicle insurance and a face photo. We are required by law to complete a right-to-work check before a courier can deliver, and to complete age-restricted (Challenge 25) checks on delivery.
• Vehicle details — make, model and registration plate.
• Contact and payment details — phone number, email, and bank details used to pay you.
• Location — your position while you are online and taking jobs, so we can match you to nearby work and show customers where their order is.
• Device binding — a random identifier generated by the app on your device, used to prevent an approved account being used by someone else. It is not a hardware identifier and cannot be traced to you outside our service.

How we use your data

• To process orders, coordinate your courier, and deliver to you.
• To match couriers to nearby jobs, calculate distance-based delivery fees, and pay couriers fairly.
• To send you order updates, job alerts, and (where you have opted in) marketing or weekly reports.
• To complete right-to-work and age-restricted delivery checks, as UK law requires.
• To prevent fraud, including detecting an account being shared or misused.
• To improve the service, and to meet our tax, insurance and regulatory obligations.

Who we share it with

Recipient	Why
Stripe	Taking payment and paying couriers. Card details never reach us.
Twilio	Sending SMS order updates and courier job alerts.
Brevo	Sending email order receipts and courier onboarding updates.
Cloudflare	Hosting the website, the API and the database (D1), and the object store for product images.
Retail partners	Only where a partner shop must fulfil part of your basket, and only the minimum needed to pick the items.
HMRC, and regulators or law enforcement	Where we are legally required to disclose it.

How long we keep it

• Order records — kept for as long as required for tax and accounting purposes, then deleted.
• Right-to-work and identity evidence — kept for the duration of the courier relationship and the statutory retention period afterwards.
• Location history — kept only while it is needed to deliver an order; older pins are deleted automatically.
• Expired one-time codes and password resets — deleted as soon as they expire or are used.

Your rights (UK GDPR)

You have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is wrong;
• ask us to delete your data where we have no overriding legal reason to keep it;
• restrict or object to how we use it;
• port your data to another provider.

To exercise any of these, email [email protected]. We aim to respond within 30 days. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Security

• Passwords are stored as salted hashes — never as plain text.
• Session tokens and reset codes are stored as SHA-256 hashes, so a database leak cannot be replayed against a live account.
• All traffic is encrypted in transit (HTTPS).
• Access to operational data is limited to staff and couriers who need it, and every operator action is recorded.

Cookies

We use a small number of cookies and local storage to keep you signed in, remember your basket, and remember your delivery address. They are not used for advertising. You can clear them in your browser settings; clearing them signs you out and empties your saved basket.

Age-restricted goods and Challenge 25

Where an order includes alcohol, the courier will ask the recipient to confirm they are 18 or over. We record the outcome of that check. We will never deliver age-restricted goods to anyone who cannot confirm their age, and a courier is not permitted to accept an order they are not eligible to deliver.

Children

Our service is not directed at children and we do not knowingly collect data from anyone under 18.