ONWAYY · LEGAL
Onwayy Privacy Policy
Effective date:
Onwayy Delivery LTDCompany No. 17248637 · Registered in England and Wales
Registered office: 1 Earl Street, West Bromwich, Birmingham, B70 9HR
support@onwayy.uk
This policy covers the public Onwayy website and the Onwayy app and service. They have different functions: the website provides information, legal documents and rider application and onboarding services; customer orders, payments, tracking and order management take place through the app and enabled service infrastructure. It describes processing where the relevant feature is in use, rather than suggesting that every visitor uses every feature.
Delete or deactivate account · Cookie Policy · Privacy contact · Restricted-product verification
1. Who is responsible and how to contact us
1. Controller
Onwayy Delivery LTD, Company No. 17248637, registered in England and Wales, is the controller for personal information it processes for its platform and website. Its registered office is 1 Earl Street, West Bromwich, Birmingham, B70 9HR. Independent retailers, payment services or other organisations may have separate responsibilities for their own processing; their privacy notices apply to that activity.
2. Privacy contact
Email support@onwayy.uk for questions, a rights request or a complaint, or write to the registered office. Identify the relevant account or order where helpful, but do not send passwords, delivery PINs, full payment credentials or identity documents in an ordinary enquiry. We may request proportionate identity confirmation through a suitable secure process before disclosing or changing information.
2. Information we may process
3. Website information
Website operation may involve page requests, browser and device information, security and error logs, essential technologies and cookie preference records. Where enabled with the required choice, optional analytics or advertising tools may process usage or campaign information. Contact enquiries, rider applications and uploaded eligibility documents, and support communications are processed when submitted through an available channel. Browsing the website does not create a customer order or process a customer payment.
4. Customer app and account
The service may process name, date of birth, email, mobile number, account identifiers, account status, delivery address, order history, product and substitution choices, instructions, ratings and support correspondence. Information is used only for relevant disclosed purposes and with an appropriate lawful basis. Do not add unnecessary sensitive information to free-text fields.
5. Orders and payments
App order administration may involve agreed prices, fees, payment and transaction identifiers, payment status, refunds, promotional credits, retailer purchase records and dispute evidence. Enabled payment providers process payment credentials under their own roles and notices. Onwayy receives information needed to administer the transaction; customer checkout and payment are not performed on the public website.
6. Delivery information
The service may process delivery PIN activity, order status, relevant rider and customer location, arrival and completion records, delivery photographs, communications and incident reports. These help fulfil and verify a request and investigate problems. Evidence is considered in context and does not automatically override a customer or rider’s explanation.
7. Rider information
Onboarding and rider operations may involve identity and contact details, proof of address, right-to-work evidence, relevant licence, driving, vehicle and insurance documents, verification results, profile photograph, bank and payout identifiers, retailer receipts, earnings, reimbursements, ratings, account decisions and incident reports. The website application requests evidence for the checks shown in the form and offers optional UK bank account holder name, sort code and account number for payout preparation. It does not request payment card numbers, PINs, security codes or online banking login details.
8. Fraud and security information
We may process account activity, transaction anomalies, duplicate-account signals, device and technical information, relevant evidence and investigation records to protect people and the service. Information from complaints, payment providers and verification services may be relevant. Checks must be proportionate and subject to applicable restrictions on sensitive or criminal-offence information.
9. Sources
Information comes from you, your use of the relevant service, the customer or rider involved in an order, and service providers such as payment, verification, communications and hosting providers where used. Retailer receipts and product records may be supplied by riders. We do not treat publicly available information as unrestricted permission to process it for any purpose.
3. Rider applications
10. Application information
When you apply through our website, we use your name, date of birth, contact and address details, delivery area and method, right-to-work route and any share code or explanatory notes, required identity and address evidence, relevant driving licence front and back images and insurance evidence, and your declarations to assess your application. We also record application references, submission and acknowledgement timestamps and review outcomes. Provide only the documents requested for your circumstances and keep right-to-work notes relevant to the evidence you can provide or the assistance you need. For proof of address, you may hide unrelated transactions and balances while leaving your name, current address, document issuer and date visible.
11. Optional UK bank details
You can choose to provide your UK account holder name, sort code and account number so the team can prepare payout arrangements if you are approved. You can leave this section blank and provide the details later through the onboarding process. These details are saved with your application and included in its restricted application summary for authorised staff. Submission does not verify account ownership, set up a payment or authorise a debit. Never provide your card security code, PIN, password or one-time banking code.
12. Tax and business information
We ask whether you are applying as an individual or through a UK limited company. For individuals, we collect your National Insurance number, or a record that you do not yet have one, and use the name, date of birth and home address already supplied. Company applicants provide the legal company name, company registration number and main business address. If you are VAT registered, we also collect your VAT registration number. We use the relevant information to prepare onboarding and meet applicable tax and platform-reporting obligations, including disclosure to HMRC where required by law. These details are included in the restricted application summary and are subject to the same access and retention arrangements as other application information. Entering a number does not verify it or submit a tax return; our team may need further information or checks.
13. Purpose and manual review
We use necessary application information to take steps at your request before a rider contract, carry out applicable legal checks, and protect the integrity of onboarding under the lawful bases described below. Our team reviews applications, requests further information and sends training invitations and outcomes by email. This website onboarding flow does not include criminal-record or background checks. Submission or document upload does not mean that checks are complete or that you are approved to deliver. Final approval follows the required checks and training.
14. Saving, storage and access
The website keeps records needed to save and process your application. An essential browser cookie lets you return to a saved draft on the same browser; this does not create a website account. Uploaded documents and submitted application summaries are stored in Onwayy’s restricted Google Workspace Shared Drive for authorised onboarding staff. Google and our hosting providers process information for these services. The provider and international-transfer information below applies. Application documents are not published or made available to other applicants.
15. Keeping and removing application information
Ordinary website drafts expire seven days after starting. Their uploaded files are then queued for removal from active storage. If a submission could not be confirmed, we may keep the information needed to resolve it for up to 30 days. Submitted applications and verification records are kept for the time needed to assess the application, complete onboarding and handle relevant legal, security or dispute requirements. Removed files may remain temporarily in the storage provider’s trash or recovery systems before permanent deletion. Withdrawn and unsuccessful applications are assessed separately from approved rider records; information no longer needed is deleted or anonymised. Contact support@onwayy.uk to withdraw an application or request access, correction or deletion. Include your application reference if you have one; do not attach identity documents to an ordinary email enquiry.
4. Purposes and lawful bases
16. Contract
Where necessary to enter or perform a contract with you, we use relevant information to create and administer accounts, distribute accepted-service opportunities, fulfil app requests, communicate progress, process payments and refunds, and administer rider reimbursement and earnings. Not every useful activity is automatically necessary for a contract; optional marketing is treated separately.
17. Legal obligation
We use information where necessary to meet applicable legal duties, such as relevant age or identity requirements, accounting, lawful authority requests and rights handling. We identify the relevant duty rather than using legal obligation as a general basis for unrelated collection. Information requested for a legal requirement must be proportionate to that requirement.
18. Legitimate interests
Where permitted and after considering the effect on individuals, legitimate interests may support security, fraud prevention, proportionate service improvement, complaint and dispute handling, protecting legal rights and maintaining reliable operations. We consider necessity and safeguards and balance these purposes against your interests and rights. You may object to processing based on this ground.
19. Consent
We obtain consent where required, including for optional tracking and certain marketing or sensitive-information uses. Consent should be specific, informed and freely given, and can be withdrawn through the relevant setting or by contacting us. Withdrawal does not make earlier lawful processing unlawful. Declining optional consent does not itself prevent use of unrelated core information pages.
20. Health and allergy information
Allergy or dietary notes may reveal health, religious or other sensitive information. Provide only what is necessary for your request. Where processing involves special-category information, Onwayy must have both a lawful basis and a relevant additional condition, such as explicit consent where appropriate, before relying on it. A general acceptance of terms is not blanket explicit consent. Necessary instructions may be shared with the rider; this does not guarantee medical suitability or replace professional advice.
5. Verification and information shared during service
21. Identity and liveness verification
Where identity or age checks use a specialist provider, the relevant flow explains the required documents, images, checks and provider. Liveness or facial-comparison information can involve biometric or other sensitive data and requires the applicable safeguards and legal conditions. Only information necessary for the stated verification should be collected. A provider name or specific biometric process is not implied to be active merely by this policy.
22. Payment providers
Payment providers, which may include Stripe if enabled for the relevant service, process payments, refunds and fraud checks using necessary transaction information. Their own notices explain processing they control. We do not list a provider as definitely active without its implementation. Never send payment credentials to a rider or through the website’s ordinary contact channels.
23. Customer information shared with riders
Before acceptance, offer information includes the delivery postcode, approximate distance, order size or item count and relevant restricted-product information. The accepting rider receives necessary shopping and order-contact information at the appropriate stage. The full delivery address is released after required retailer receipt or purchase evidence is uploaded. Riders must use customer information only for the request or a related support matter.
24. Rider information shown to customers
Relevant rider information may include name, profile photograph, delivery method, order progress and enabled tracking while travelling to the customer. This helps identify the person providing the service. It does not authorise customers to use rider information for unrelated contact, publication or harassment.
25. Delivery photographs and PIN activity
Photographs and PIN records help verify delivery, investigate discrepancies and protect against fraud. Riders should avoid unnecessary images of faces, identity documents, the PIN or home interiors. Access is limited to relevant operational and support needs. Records are assessed alongside other evidence rather than treated as infallible proof.
26. Age-verification information
Restricted orders may require account checks, verification outcomes and relevant doorstep evidence. Collection should be limited to what the applicable rule requires. An ordinary doorstep ID inspection should not become unnecessary copying of a full document. Stronger legally required product-specific processes are explained through the relevant app flow.
27. Customer location
An address is needed to assess and fulfil an app request. Precise device location, where a feature requests it, depends on relevant permissions and the stated purpose; you can manage device permissions. Do not assume the public website tracks a customer’s live location or that enabling location replaces checking the delivery address.
28. Rider location
Rider location may be used for availability, relevant offer distribution, delivery progress, safety, verification and support while the applicable rider features are in use. Customer-visible live tracking, where enabled, begins after shopping is complete and the rider is travelling to the customer. Platform operational processing may differ from what a customer can see and must be explained in the relevant permission and app information.
6. Communications, marketing and providers
29. Service communications
We use relevant contact details for order, rider, support, safety and account communications. Email, SMS, app messaging or other enabled providers may deliver these messages. Customer and rider communications may be retained as necessary to resolve issues and protect the service. A service notice is distinct from optional promotional marketing.
30. Marketing
We send marketing only with an appropriate lawful basis and in compliance with applicable electronic-marketing rules. Use an unsubscribe option or contact support to stop marketing. A rider waitlist contact consent covers the described onboarding and opportunity communications, not unrestricted sale of contact information or unrelated advertising.
31. Service providers and other recipients
Necessary information may be shared with contracted hosting, security, support, communications, identity, payment and operational providers, professional advisers and authorities where legally justified. Providers acting on our instructions must handle information under appropriate contractual and security requirements. We may disclose necessary information for a lawful business transfer while protecting existing rights and explaining material changes.
32. International transfers
A provider may process information outside the UK. Where a restricted international transfer occurs, the appropriate mechanism must be in place, such as applicable adequacy arrangements or approved contractual safeguards with any required assessment and supplementary measures. Contact support for information about safeguards relevant to your data; using a provider does not remove Onwayy’s transfer responsibilities.
7. Retention, automated systems and security
33. Retention criteria
We retain information only as long as necessary for its purpose and applicable obligations. Order and financial records are assessed against accounting, tax, dispute and limitation requirements; verification documents against the check and applicable legal duties; delivery evidence against support, dispute and fraud needs; and waitlist details against the ongoing interest and contact purpose. Data may be deleted or anonymised when no longer needed. A legal hold or genuine ongoing dispute may require specific records to be retained longer.
34. Account closure
Closure ends normal account use but does not automatically erase records needed for outstanding orders, payments, legal obligations, recalls, disputes or proportionate fraud prevention, where continued processing is lawful and an applicable erasure exception or other lawful ground permits it. Request deletion through the customer or rider app, the options on our Delete or deactivate account page, or support@onwayy.uk. We will explain applicable exceptions and avoid retaining an entire account indefinitely merely because a small part is needed.
35. Product recalls
Relevant product, order and contact records may be used to communicate a safety recall, identify affected supplies and cooperate with a responsible retailer, manufacturer or authority. Only information needed for the safety purpose should be shared. A marketing opt-out does not necessarily prevent an essential product-safety notice.
36. Automated systems
Tools may assist matching, fraud detection, verification, status processing and account administration. Where law gives safeguards for a solely automated decision with legal or similarly significant effects, we will provide the required information and means to seek human intervention, express your view and challenge the decision. Contact support about a material automated outcome you believe is wrong.
37. Security and breach response
We use appropriate organisational and technical measures for the information and risks involved, including restricted access and secure service channels. No system is risk-free. Suspected breaches are assessed, contained and investigated, with notification to affected people or the regulator where legally required. Report a suspected data exposure promptly to support@onwayy.uk without distributing the exposed information more widely.
8. Account deactivation and deletion requests
38. Deactivation and reactivation
Customer and rider accounts can be deactivated through the relevant app or by requesting help from our team. Deactivation hides your profile, signs you out and retains your account information. Contact support@onwayy.uk to request reactivation. Deactivation is a temporary account measure and does not itself erase personal information or replace a request to exercise your right to erasure.
39. Permanent deletion
You can request permanent deletion of your customer account, rider account or both. Once deleted, the account cannot be restored, and you lose access to its profile and account history. Creating a new account does not restore the old account or its deleted information. We erase personal information where required and explain any specific records that must lawfully remain. An account request does not forfeit a valid customer refund, rider reimbursement or earning; any outstanding transaction is handled alongside the request without automatically delaying all erasure.
40. Making a request
Use the relevant app controls, visit our account-request page at /delete-account/, email support@onwayy.uk or write to our registered office. The website offers an additional route if you cannot access an app or need help. Rights requests are not restricted to a form or a particular channel, and you do not need to give a reason for leaving. If you cannot access your registered mobile number, tell our team so that suitable alternative verification can be arranged.
41. Request information and manual handling
For a website or support request, we use the account type, requested action, registered mobile number or other account identifier, contact email and any relevant correspondence to locate the account, verify the requester where necessary, carry out the request and record the outcome. Our team reviews and processes these requests manually and emails the outcome, including confirmation when the action is complete. An acknowledgement confirms receipt only; it does not mean the account has already been deactivated or deleted. We use necessary request information for account administration, compliance with data-protection duties and proportionate security and accountability purposes, under the lawful bases described above, rather than for marketing.
42. Website request form
Our website provides an account-request form in Onwayy’s design. When you submit it, the details are sent securely through our website to Google Forms, where they are stored for our team to review and handle your request as described above. You remain on the Onwayy website. The service-provider and international-transfer information in this policy also applies. You can email support@onwayy.uk instead of using the form.
43. Verification and response times
We respond to erasure requests without undue delay and normally within one calendar month of receipt. If we have reasonable doubts about your identity, we will promptly request only information necessary to confirm it; where such information is required, the response period starts when we receive it. Do not send passwords, app one-time codes, delivery PINs, bank details or identity documents in an ordinary request. If complexity or the number of your requests makes an extension necessary, the response period may be extended by up to two further months; we will notify you within the initial month and explain why. A refusal or partial refusal will explain the reasons and your right to complain to the ICO or seek a judicial remedy.
44. Records after a request
We explain which information is erased or retained and the retention period or criteria that apply. Necessary records may remain to meet legal obligations or establish, exercise or defend legal claims. Access to retained records is restricted to their justified purpose, and they are erased or anonymised when no longer needed. A limited request-handling record may be retained for accountability under the retention criteria above. Where erased information remains temporarily in backups, it is kept beyond ordinary use until replaced under the applicable backup schedule, and we explain the arrangement. We take applicable steps to notify relevant recipients or instruct service providers to act on erasure.
9. Your rights and complaints
45. Access and export
You may request confirmation of processing and access to your personal information, together with the information the law requires. We may need to verify identity and protect other people’s information. Requests are handled within applicable legal time limits, and we will explain any lawful extension or exception.
46. Correction and deletion
Ask us to correct inaccurate information or complete relevant incomplete records. You may request deletion where the legal conditions are met. Deletion is not absolute; certain legal, dispute, safety or other justified records may remain. We will explain a refusal or partial response and available complaint rights.
47. Objection and restriction
You may object to processing based on legitimate interests and ask for restriction in circumstances provided by law, including while certain accuracy or lawfulness issues are considered. You can object to direct marketing. We will assess the relevant grounds and stop or limit processing where required.
48. Portability
Where the legal conditions apply to automated processing based on consent or contract, you may obtain the personal information you provided in a structured, commonly used, machine-readable format and request transmission to another controller where technically feasible. This does not create a right to other people’s private information.
49. Withdrawing consent
Change website tracking preferences through Cookie Settings, use the relevant unsubscribe or app option, or email support. Withdrawing consent affects future processing based on that consent and does not automatically delete information retained on another valid basis. We will explain any feature that cannot operate without the information you choose not to provide.
50. Privacy complaints and the ICO
Contact support@onwayy.uk if you have a privacy concern; we aim to respond to formal complaints within 5 working days while complying with the separate legal deadlines for rights requests. You may complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint/ without first completing our internal process. Contacting us does not restrict any other legal remedy.
51. Policy changes
We may update this policy when processing or law changes. The effective date identifies this publication, and material changes will be communicated through appropriate channels where required. A revised notice does not itself supply consent or justify a new incompatible use; the relevant legal basis and safeguards must be established.