Privacy notice

Bundle Drop is run by [Company name], a company registered in the UK (company number [Company number]), whose registered address is [Registered address]. We are the controller of the personal data described here and are registered with the Information Commissioner's Office (registration [ICO registration number]).

For anything about your data, email [email protected]. For anything else, [email protected].

We only ask for what we need to get the right things to the right place at the right time.

When you plan and place an order

• Contact details: your name, email address and mobile number.
• Where and when: the address you're staying at, the name of the hotel, building or host, any access notes you give us (for example who to leave it with), your arrival date and time, and how many nights you're away.
• About your baby: nappy size and whether you're bottle-feeding, so we can work out quantities. We don't ask for your baby's name, age or date of birth.
• Order details: what's in your bundle, prices, any promo or partner code, delivery option, payment status, refunds and changes you make.
• Where you came from: if you arrived through a partner link or a campaign, the partner code and campaign tags (for example "utm_source"), and the website that sent you, without any query string.
• Feedback: if you answer our short questionnaire after delivery, what was missing, what you didn't need, a score and any comments.

When we deliver

• Delivery updates: status updates from us or the courier, and an estimated arrival time.
• The driver's location while your bundle is on its way. This is the driver's location, not yours: we never ask for or collect your location.
• A photo of the delivery where we leave it, so you can see it arrived. We strip location and camera information from the photo before storing it.

If you create an account

• Your name, email address and a password, which we store only as a secure one-way hash.
• Whether your email is verified, and your saved preferences (nappy size, feeding and usual delivery option) so you can plan again quickly.

In our apps

• If you turn on notifications, a push token from Apple or Google and the order references it should update. We use it only for delivery updates.

If we don't deliver to you yet

• If you ask us to tell you when we start delivering to an address, the postcode and your email. We only email you after you confirm, and only about that.

If you apply to be a partner

• Your business name and type, your name, email, and optionally phone number, number of rooms or properties, postcode, website and message.

Usage counts

• We count how visits move through our site and apps (for example "checked a postcode", "saw a quote", "paid") against a random visit number that is forgotten when you close the tab. We record only the first half of a postcode (such as "AB1"), round prices into £10 bands, and never store your IP address or browser details with these counts. You can switch this off on our cookies page.

Card details

Payments are handled by Stripe. We never see or store your card number.

We don't make decisions about you based only on automated processing that have legal or similarly significant effects. We do calculate bundle quantities automatically from your trip; you can always change your order or ask us.

We don't sell your data or share it for advertising. We use trusted providers who act on our instructions:

Stripe is also responsible for the card data it collects; see Stripe's privacy policy. We may also share information if the law requires it, or to protect people's safety.

Partners who referred you see only how many orders came through their link and the fees they've earned. They never see your name, contact details or address.

Our main systems are in the EU, which the UK recognises as providing adequate protection. Where a provider handles data in the US or elsewhere, we rely on the UK-US data bridge where the provider is certified, or on the UK International Data Transfer Agreement or Addendum to the EU standard contractual clauses.

You have the right to:

• get a copy of your data. Signed in, you can download it straight away from your account;
• have it corrected if it's wrong;
• have it deleted. You can delete your account yourself from your account; we keep order records we need for tax, without your contact details;
• object to, or ask us to restrict, how we use it;
• take it with you in a machine-readable format;
• withdraw consent, for example by unsubscribing from news emails.

Email [email protected] for anything you can't do in your account. We'll reply within one month.

If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Everything is encrypted in transit. Passwords are stored as one-way hashes, staff accounts need two-step sign-in, and access to customer details is limited to the people who fulfil your order. Delivery photos and driver locations are only shown to someone with your order link or your account.

We use a small number of first-party cookies and browser storage items to keep you signed in, remember a partner referral and count visits. We don't use advertising or third-party tracking cookies. The full list is on our cookies page.

If we change how we use your data, we'll update this page and the date at the top. If the change is significant and we have your email, we'll tell you before it takes effect.