Privacy policy

COMDRO is run by Elite 247 TechHub Ltd (company number 17080195, registered office 2b Thoresby Street, Mansfield, England, NG18 1QF) (“COMDRO”, “we”, “us”). We run the COMDRO website and apps, which connect you with local stores and the riders who deliver for them. We decide how your personal data is used for COMDRO, which makes us its controller under UK data protection law.

For anything about your personal data, email [email protected].

Everyone who uses COMDRO: customers who shop with us, stores that sell through us (including the owners, managers and staff of each business and its branches), riders who deliver for us, and anyone who visits our website or joins a waiting list for their area. Where something applies to only one of these groups, we say so.

• Your account: your name, email address, phone number and password (stored scrambled, never readable). If you sign in with Apple, Google or Facebook, we receive the name and email they share (with Apple, that can be a private relay address Apple forwards to you).
• Your addresses: the addresses you save, the map pin you confirm and any note you leave for your rider.
• Your orders: what you order, from which store, delivery or collection, your notes, your tips, and the reviews and favourites you add.
• Problems you report: what you tell us when something goes wrong with an order, and any photos you add.
• Payments: card payments are handled by Stripe (and by Paystack for deliveries in Nigeria). We never see or store your full card number. We keep the amount, the payment status and any refunds. If you choose to save a card, Stripe keeps it for you.
• Location: when you search for an address or choose “Use my current location”, we look up the address. Your browser or phone asks your permission before sharing your location.
• Messages: the emails, texts, WhatsApp messages and notifications we send you, and the choices you make about them. To send notifications to your phone, we keep a code that identifies the app on your device.
• Technical details: basic information about your device and browser in our server logs, and the security check Google reCAPTCHA runs on sign in and sign up forms.
• Waiting lists: if we don’t deliver to you yet and you ask us to tell you when we do, your email address and postcode.

Stores

• The business name, the owner’s name, contact phone and email, and the address and location of each of its stores (a business can have one store or several branches).
• The people a business invites to its team: their name, email address, role (owner, business manager, branch manager or branch staff) and which branches they can open. A business can have several logins, one for each person.
• The documents we check before a store can sell: photo ID, business registration and, where it applies, an import licence.
• Bank details for payouts. A business can be paid into one account for all its branches, or each branch can be paid into its own account. We store bank details encrypted, and once they are saved the business only ever sees the last 4 digits of the account number. When someone adds or changes a payout account, we record who did it, the device and the IP address they used, and tell the owner. Payouts are made through Stripe, which carries out its own identity checks and may ask for details such as date of birth.

Riders

• Your name and contact details, your vehicle type, number plate and driving licence number.
• The documents we check before you can deliver: your driving licence and proof of address.
• Bank details for payouts, handled through Stripe as above.
• Your location, only while you are online or on a delivery, including when the app is in the background. We keep only your latest position, not a history of where you have been, and sharing stops when you go offline. Customers waiting for an order can see where their rider is.
• The photo you take at the door when you deliver an order, as proof of delivery.

• To provide COMDRO (because it is needed for our agreement with you): to take your order, send it to the store, get it to you, take payment for what the store confirms, refund you when needed, pay stores and riders, and keep you updated about orders and payments.
• To keep COMDRO safe and working (our legitimate interest in running a secure service): to check stores and riders before they join, to stop fraud and abuse, and to deal with problems and complaints.
• To find and fix faults: when something goes wrong we record technical details (the error, the page, your device and browser, and your account ID) on our own servers. We don’t record what you type, unless you choose to send us a note about the problem.
• To meet our legal duties, such as keeping tax and accounting records and answering lawful requests from the authorities.
• To send you offers, only if you have said yes (your consent, which you can take back at any time).

We don’t use your data to make decisions about you that are made entirely by a computer.

• The store you order from: your name, your order and, for delivery, the address and note. If the store is a branch of a larger business, the people that business has given access to that branch (its owner, managers and the branch’s staff) can see these details for orders placed with that branch. Staff who work only at other branches can’t see them.
• The rider who delivers it: the details they need to reach you.
• Companies that run parts of the service for us: Stripe and Paystack (payments and payouts), Microsoft 365 (email), Twilio (texts and WhatsApp), Expo, Google and Apple (notifications to your phone), postcodes.io (postcode lookups; street and address lookups run on our own server), MapTiler and Google Maps (maps), Google (reCAPTCHA, and sign in if you choose it), Apple and Facebook (sign in if you choose it), and Contabo, which hosts our servers and stores photos and documents. They may only use your data to provide their service to us.
• The authorities, such as the police or HMRC, when the law requires it.
• A buyer of our business, if COMDRO or part of it is ever sold, under the same protections as this policy.

We don’t sell your personal data.

Some of the companies above, such as Stripe, Twilio, Microsoft, Google, Apple and Meta, may handle your data outside the UK, including in the United States. When they do, the transfer is protected by the safeguards UK law requires, such as the UK’s data bridge with the US or the standard contract terms approved by the Information Commissioner. Email [email protected] if you would like more detail.

We only send offers by email or WhatsApp if you opt in. You can change this at any time in Account › Notifications. Every offers email has an unsubscribe link, and you can reply STOP to any WhatsApp message. Messages about your orders and payments are always sent.

We don’t use advertising or analytics cookies, and our own site sets no cookies at all. The site stores your sign in session, your light or dark mode choice, your delivery location and its settings for reporting faults in your browser so it works the next time you visit. Stripe and Google reCAPTCHA may set their own cookies to help prevent fraud.

We keep your data only as long as we need it. Your account details stay while your account is open. Order and payment records stay for six years, as UK tax law requires, without your name or contact details once you delete your account. Our data retention page lists each kind of data and how long we keep it.

Everything you send us travels encrypted. Passwords are stored scrambled so no one can read them. The documents stores and riders send us are kept in private storage that only our checking team can open, through links that stop working after ten minutes. Bank details for store payouts are stored encrypted, and the store’s own screens only ever show the last 4 digits of the account number. Only the people who need your data to do their job can see it.

Under UK data protection law you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong;
• delete your data (you can do this yourself: Account, then Delete account, in the app or on the website);
• limit how we use it, or stop using it where we rely on our legitimate interests;
• send it to you, or to another company, in a format a computer can read.

You can withdraw your consent to offers at any time. To use any of these rights, email [email protected]. We will reply within one month. If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk.

COMDRO is for people aged 18 and over. We don’t knowingly collect data from children. If you think a child has given us their details, email [email protected] and we will delete them.

If we change how we use your data, we will update this page and the date at the top. If the change is important, we will also tell you by email or in the app before it takes effect.