DRAFT TEMPLATE. Fill in the [bracketed] details and have it reviewed by a solicitor before launch. It is not legal advice.
Privacy Policy
Last updated: [DATE]
Who we are
SwiftDrop is operated by [COMPANY LEGAL NAME], [REGISTERED ADDRESS], Ireland (CRO no. [NUMBER]). We are the data controller for the personal data described here. Contact: [PRIVACY EMAIL].
What we collect
- Account: name, mobile number, and email if you sign in with Google.
- Orders: items, delivery address/Eircode, delivery notes, order history, payment method (pay on delivery).
- Prescriptions (pharmacy orders): the photo you upload. This is health data, a special category under GDPR. We process it only to let the pharmacy check and fulfil your order, on the basis of your explicit consent when you upload it.
- Couriers: name, phone, vehicle, base area, the documents checked during onboarding, and live location while online.
- Technical: IP address and device information in server logs, kept for security.
Why we use it (and the legal basis)
- To take, prepare and deliver your order (contract).
- To verify your phone number and keep accounts secure (contract, legitimate interests).
- To show the customer where their courier is, only during their delivery (contract).
- To meet legal and accounting obligations (legal obligation).
Who we share it with
- The store preparing your order, and the courier delivering it (name, address, notes, and phone while the order is active).
- Service providers acting for us: Twilio (SMS codes), Auth0 by Okta (Google sign-in), Google Maps Platform (addresses and routes), [HOSTING PROVIDER, REGION] (hosting and database).
- Some providers process data outside the EEA, under the EU–US Data Privacy Framework or Standard Contractual Clauses.
How long we keep it
Account data: until you delete your account. Order records: [6 years] for tax and accounting, with personal details removed when you delete your account. Prescription images: [30 days] after the order is completed. Courier location history: [30 days].
Your rights
You can access, correct, export or delete your data, object to processing, or withdraw consent. Delete your account here, or email [PRIVACY EMAIL]. You can complain to the Data Protection Commission (dataprotection.ie).