Privacy Policy

Draft – being checked by a UK solicitor. Last updated Fr 13.11.26. Questions: veniway.bg@gmail.com

1. Who we are

VeniWay is software for parcel delivery companies ("service partners") and their drivers. It is run by (to be completed), registered in (to be completed), company number (to be completed), address (to be completed) ("we"). ICO registration number: (to be completed). Contact for privacy questions: privacy@veniway.com (to be completed).

2. Two roles – who decides about your data

If you are a driver, your service partner is responsible for your work data; ask it first. We help it answer.

3. What we collect

• Account: name, e-mail, phone, password (stored only as a hash), role, company, language and display settings (your column and filter choices are saved with your account).
• Driver documents (uploaded by the driver or the service partner): passport/ID, driving licence, National Insurance number, right-to-work evidence, bank details, application form, insurance. Only the driver's service partner and a small number of named VeniWay administrators (for support and security) can see them. An administrator who also runs a service partner may not use this access for it.
• Work data from the parcel carrier (InPost/Yodel) that reaches VeniWay through forwarded e-mails, uploaded files or Connect Gmail: driver route numbers ("S number"), names as written by the depot ("DDR names"), daily performance, delivery events, customer feedback, invoices and adjustments. From customer feedback files VeniWay keeps only the postcode sector (for example "EN8 7") and the link between the depot's driver name and the service partner – not the customer's name, house number or full address. Where the files are read outside the platform to find these links, only the links are brought into VeniWay.
• Results we calculate: score, division, Fairplay points, charges and rewards, tournament and Rank List positions; the depot map (which drivers and companies worked in each postcode sector or route, with division and rate, and feedback by area).
• Money and points: wallet number, balances, transfers, purchases (through PayPal – we do not see your card), Direct Debit ("auto-pay") consents.
• E-mails from your depot that you choose to forward to reports@veniway.com or let the bot read (only the carrier's report, invoice and forecasted-payment e-mails; see §6).
• Technical: IP address, browser, log-in times, error logs; on the public site – nothing that tracks you (§11).
• Push notifications (only if you turn them on): the subscription address and keys your browser gives us for each phone or computer; the short message passes through your browser maker's push service (Google, Apple, Mozilla or Microsoft). Turn it off in Settings → Notifications or in the browser.

4. Why we use it and our legal basis

Special category data (health, ethnicity): we do not ask for it. Do not write it in free-text fields. Right-to-work documents may show nationality – used only for the legal check.

5. Decisions made by software

VeniWay calculates divisions, Fairplay points and some charges automatically from the carrier's data. A charge can reduce what a driver is paid, so it is a significant decision. Your safeguards (UK GDPR Art. 22A–22D, from 5 February 2026): we tell you when a result is automatic; you can see the data behind every line; you can dispute it and ask for a person at your service partner to review it, give your view and contest it. (to be completed)

6. Connect Gmail and the report mailbox

• If you choose Connect Gmail, you give VeniWay read-only access (Google scope gmail.readonly). The bot searches only for e-mails from the carrier's domains with the report/invoice subjects, for up to the last 3 years. It reads and imports those e-mails, and only counts (does not open) the others. The access key is stored encrypted while the import runs, then returned to Google and deleted. You can also remove access any time at myaccount.google.com/permissions.
• What we ask Google for, and why (only when you press Connect Gmail or turn on a feature that needs it):
  • gmail.readonly – to find and read the carrier's report, invoice and statement e-mails in your mailbox and import them, and so that your AI Office Pack colleagues can read the letters you ask them about;
  • gmail.compose – to put a draft reply in your own Gmail Drafts; nothing is sent until you press Send yourself;
  • gmail.settings.basic – only if you ask for it: to create one filter that forwards the carrier's report e-mails to VeniWay;
  • drive.file – to save copies of your letters and statements in a "VeniWay AI Office Pack" folder in your Google Drive; VeniWay sees only the files it created there, nothing else in your Drive.
• We ask only for what the feature you switched on needs. You can take the access back at any time at myaccount.google.com/permissions. How long imported e-mails and files are kept: see §10 (to be completed for AI Office Pack).
• Google API Services User Data Policy: VeniWay's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Gmail data for advertising, do not sell it, and do not let people read it, except with your consent for a specific message, for security, or where the law requires.
• Forwarded e-mails to reports@veniway.com are read automatically; only e-mails from your confirmed addresses and the carrier's signed domains are imported. Others are discarded.

7. Who we share data with

• Your service partner (and the owner of its group of companies) – the work data of its drivers.
• Other VeniWay users at the same depot – name, division and results in the depot's Reports and Rank List, tournaments, the depot map and the driver passport. Verified reports that a service partner agrees to share (Terms 4.6) are seen by the other service partners of the same depot. The old depot-wide reports (up to 2023) are seen by every company connected to that depot, with the driver's name as the depot wrote it and the company it belongs to. The driver passport can be opened by any signed-in VeniWay user of any company: name, photo, division, years of work and report rows (results, parcels, days, ETA, feedback, depot, company) – never money, invoices, documents, e-mail or S number.
• People with a VIP invitation link – the invited person's first name is shown to whoever has the link (§12).
• Our suppliers (processors): hosting (Photonhost, servers of Host Europe Group in Germany); e-mail sending (SMTP2GO); pdftables.com (only for scanned carrier invoice PDFs without text – no driver names in them); Google (Connect Gmail; fonts and an offline-support library in the platform); PayPal (payments – PayPal is a separate controller for your card data); postcodes.io (postcode only); OpenStreetMap (map tiles – your browser asks them, so they see your IP address); jsDelivr / OpenCV (program libraries your browser downloads); the browser makers' push services (only if you turn on notifications). Documents are read inside your own browser (tesseract.js) – the image is not sent to any outside service.
• Our development and support tools: the people who build and run VeniWay use an AI assistant (Claude, by Anthropic, USA) and a private code and notes repository (GitHub, USA). When they test, fix or support the service, these tools may see personal data from VeniWay (for example drivers' names, route numbers, pay figures). (to be completed) No AI service makes decisions about you, and we use no analytics or advertising trackers.
• The carrier (InPost/Yodel) and its vetting provider (for example Zellis "People Checking") – drivers' identity and right-to-work checks the carrier requires from service partners (this is the service partner's sharing, as controller).
• Authorities – HMRC, the Home Office, police or courts when the law requires. We never sell personal data.

8. Where data is stored

The platform runs on servers in Germany (EEA). Our development and support tools (Anthropic, GitHub) and some suppliers are in the USA. If data leaves the UK, we use an adequacy decision (the UK recognises the EEA; the UK–US "data bridge" for US companies certified to it) or the UK international data transfer agreement/Addendum.

9. Your rights

Access, correction, deletion, restriction, objection (including to the Rank List / passport display), portability, and the Art. 22 rights in §5. Write to privacy@veniway.com. We answer within one month. Some data we must keep (invoices, right-to-work checks) – we tell you which. You can complain to the ICO (ico.org.uk, 0303 123 1113).

10. How long we keep data

11. Cookies and similar technologies

• Public site: no analytics, no advertising, no cookies. The browser's local storage keeps only your light/dark theme choice ("appearance" – no consent needed after the Data (Use and Access) Act 2025 changes to PECR). Fonts are served from our own server – the public site does not contact any other server. (Web Designer, 25.10.2026, site run 40213262860.)
• Platform: one own cookie (vw_fs_…, 400 days) and the browser's local/session storage for: sign-in, theme, side bar, hidden columns, chosen wallet, the guided tour, the Report e-mails steps, language, and unsaved form drafts (these may contain personal data – on a shared computer, sign out). All are needed for the platform to work as you set it; no trackers.

12. Invitation (VIP) links

A VIP link shows the invited person's first name to anyone who has the link. Share it only with that person. Links expire after (to be completed).

13. Children

VeniWay is for people aged 18 or over (drivers must hold a driving licence).

14. Changes

We publish the new version here with its date; for important changes we tell you in VeniWay at least 14 days before.

Version [0.1-draft] · [date]