ABOUT THIS NOTICE

Delivery Associates Limited is committed to protecting the privacy and security of your
personal information. This privacy notice describes how we may collect and use personal
information about you in accordance with applicable data protection law, including the UK
General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and, where
applicable, the EU General Data Protection Regulation (EU GDPR) and other local data
protection legislation in the countries where we operate. Please read it carefully.

Data protection law requires that the personal information we hold about you must be:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to you and not
  used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told you about.
• Kept securely

If you have any questions about this notice or how we collect and use personal information
about you, please contact our Data Protection team using the details at section 1.3.

‍

1.1 We are Delivery Associates Limited. Our registered office is at 727-729 High Road,
London, England, N12 0BP, and our registered company number is 08333641.
‍
1.2 For general enquiries, our contact details are: Delivery Associates, 727-729 High Rd,
London, England N12 0BP; +44 7703 886 218; info@deliveryassociates.com.
‍
1.3 Data Protection Contact. For all data protection and privacy-related enquiries, to
exercise your rights under this notice, or to submit a Subject Access Request, please contact our Data Protection team at:

• Email: privacy@deliveryassociates.com
• Post: Data Protection, Delivery Associates Limited, 727-729 High Road, London,
  England, N12 0BP
  ‍

‍2. WHAT PERSONAL INFORMATION DO WE COLLECT &
HOW DO WE COLLECT IT?

In this policy, "personal data" includes any data which relates to a living individual who
can be identified from that data or from that data and other information which is in the
possession of, or is likely to come into the possession of, Delivery Associates or its
representatives or service providers. In addition to factual information, it includes any
expression of opinion about an individual and any indication of the intentions of Delivery
Associates or any other person in respect of an individual. References to a "data subject"
are to the individual whose data is being used. It does not include data where an individual
cannot be identified (anonymous data).
‍
We collect personal information from you in the following ways:
‍
2.1 Personnel information. If you work for one of our customers, suppliers or business
partners, the information we collect about you may include your contact information,
details of your employment and our relationship with you. It may also include information
about you that you give us when filling in forms whether on our website or offline. This
could include forms which you complete to register for a service, place an order, or sign up
for a newsletter, information from business cards, and references which we have provided
or sought.
‍
2.2 Assessment and training information. This is information you provide or we collect
about you when we provide a training session to you, or otherwise carry out an assessment
of you. This can include attendance records, training and assessment notes, scores,
certifications, and material you create or submit as part of your training or assessment.
‍
2.3 Programme participant and beneficiary data. As part of delivering programmes and
advisory services to government and institutional clients, we may process limited personal
data relating to programme participants or beneficiaries on behalf of our clients. In these
cases, we act as a data processor on the instructions of our clients, who are the data
controllers. We process such data strictly for programme delivery purposes and under
contractual data processing agreements that define the permissible scope of processing.
‍
2.4 Content. This is information about you which you provide when you post content on
our website. This may include status updates, photographs, videos, blog posts, discussion
board posts, survey responses, reports and other content which you post on our website.
‍
2.5 Emails and records of other contact. This is information you provide when you
contact us (for example by email, post or SMS) or when you respond to correspondence
from us. This may include enquiries about our services or products, reviews, follow-up
comments or complaints lodged by or against you and disputes with you or your
organisation.
‍
2.6 Technical information. This is information about you which is collected via technical
means such as cookies, webpage counters and other analytics tools.
‍
2.7 Caller information. We may collect details of phone numbers used to call our
organisation and the date, time and duration of any calls. If we record your calls to or from
us, we will inform you of this.
‍
2.8 Job applicants. Please refer to our Recruitment Privacy Policy
‍
2.9 Information we receive from third parties. As well as the information listed above,
we may also receive personal information about you from the following sources:
‍

• Our other channels. This is information we receive about you if you use any of the
  other websites we operate or the other services or products we provide. In this case
  we will have informed you when we collected that data if we intend to share it
  internally and combine it with data collected on this website.
• Our service providers. We work closely with third parties (including business
  partners, sub-contractors, analytics providers, and search information providers)
  who may provide us with information about you.
• Businesses we have bought. If we have acquired another business, or substantiallyall of its assets, which originally held your information, we will hold and use theinformation you provided to them in accordance with this privacy notice.

‍
2.10 Special category data. We do not routinely process special category personal data
(such as information about race or ethnicity, religious or philosophical beliefs, health,
biometric data, trade union membership, or sexual orientation) about website visitors or
third-party personnel. In the limited circumstances where such data is processed for
example, in employment matters, accessibility arrangements, or programme delivery
under client instruction, we will ensure an appropriate legal basis exists under applicable
data protection law, and will inform you separately.

3. HOW AND WHY DO WE USE YOUR INFORMATION?

3.1 Common uses of your information

We will only use your personal information when the law allows us to do so. Most
commonly, we will use your personal information in the following circumstances:

1. Where we need to perform a contract we have entered into with you.
2. Where we need to comply with a legal obligation.
3. Where it is necessary for our legitimate interests (or those of a third party) and your
   interests and rights do not override those interests.
4. Where we need to protect your interests or those of someone else, or where it is
   needed in the public interest (likely to be rare).

3.2 Specific examples of how we may use your information
‍
i. Website administration. We may use technical information, information about your
visit to our website, cookie data, and content gathered from your participation in
discussion boards or other functions on our website. We use this for our legitimate
interests in administering our website and to ensure it operates effectively and securely.
See our cookie notice at https://www.deliveryassociates.com/cookies.
‍
ii. Customer administration. We may use information about you as necessary to carry out
our contracts with you or your organisation, and for our legitimate interests in
administering your account, reviewing and improving our offerings, troubleshooting, data
analysis, testing, research, and statistical purposes.
‍
iii. Direct marketing. We may send direct postal or electronic marketing to you using your
contact details. We use this as necessary for our legitimate interests in marketing our
services. If you are not acting as a business and have not provided your contact details
directly to us, we will only send electronic marketing if you have consented. We will always
provide an "opt-out" on marketing messages.
‍
iv. Third party personnel administration. If you work for one of our customers, suppliers
or business partners, we may hold information about you to manage our relationship with
your employer.
‍
v. CCTV and visitor information. We use CCTV information and visitor information as
necessary for our legitimate interests in site security, visitor safety, and parking
administration.
‍
vi. Job applications. Please refer to our Recruitment Privacy Policy
‍
vii. Former employees. If you used to work for us, your information will be used in
accordance with our employee privacy notice. To request a copy, please contact
privacy@deliveryassociates.com.
‍
viii. AI-assisted processing. We use approved AI productivity tools to support internal
operations, knowledge management, drafting, and service delivery. Where personal data is
processed through these tools, we rely on legitimate interests or contractual necessity as
the lawful basis. All AI-generated outputs involving personal data are subject to human
review before being acted upon or communicated externally. See Section 12 for full details

3.3 If you fail to provide personal information
‍
If we have (or are entering into) a contract with you or your organisation, and you fail to
provide certain information when requested, we may not be able to perform (or enter into)
that contract, or we may be prevented from complying with our legal obligations. The
minimum information required for our contractual relationship is your name and contact
details.
‍
3.4 Change of purpose
‍
We will only use your personal information for the purposes for which we collected it,
unless we reasonably consider that we need to use it for another reason that is compatible
with the original purpose. If we need to use your personal information for an unrelated
purpose, we will notify you and explain the legal basis which allows us to do so. We may
process your personal information without your knowledge or consent where required or
permitted by law.

‍
4. SHARING YOUR INFORMATION

As well as any sharing described in section 3 (How and why do we use your information),
we may also share your information with third parties, including third-party service
providers and other entities in our group. We require third parties to respect the security
of your personal information and to treat it in accordance with the law. We never sell your
data to third parties.
‍
4.1 Why might we share your personal information with third parties? We may share
your personal information with third parties if we are under a duty to disclose or share
your personal information in order to comply with any legal obligation, in order to enforce
or apply our agreements with you, or to protect the rights, property, or safety of us, our
customers, or others, or where we have another legitimate interest in doing so.
‍
4.2 Which third-party service providers process your personal information? "Third
parties" includes third-party service providers (including contractors and designated
agents) and other organisations within our group. Key categories of third-party processors
include:

1. T and cloud infrastructure providers (including Microsoft 365) for business
   operations, document management, and communication.
2. AI productivity tool providers (including Anthropic (Claude) and OpenAI
   (ChatGPT)), used under enterprise agreements with appropriate data processing
   terms. Personal data processed through these tools is not used by providers to train
   AI models.
3. Video conferencing and collaboration providers (including Zoom), including AI-
   assisted transcription and summarisation features, governed by enterprise data
   processing agreements.
4. Recruitment and HR platforms for managing job applications and employment
   records.
5. Whistleblowing platform providers (WhistleB Whistleblowing Centre AB) for
   confidential reporting.
6. Analytics and website service providers for website performance monitoring.

4.3 How secure is your information with third-party service providers? All our third-
party service providers are required to take appropriate security measures to protect your
personal information in line with our policies. We do not allow third-party service
providers to use your personal information for their own purposes. We only permit them
to process your personal information for specified purposes and in accordance with our
instructions.
‍
4.4 When might we share your personal information with other entities in the group?
We will share your personal information with other entities in our group as part of our
regular reporting activities on company performance, in the context of a business
reorganisation or group restructuring, for system maintenance support, and as may be
required to provide our services to you or your organisation.
‍
4.5 Other third parties. We may share your personal information with other third parties
in the context of the possible sale or restructuring of the business, or as required by a
regulator or applicable law.

5. WHERE WE STORE YOUR INFORMATION

5.1 Our headquarters are based in London and our main data centre is located in the UK.
However, where required to perform our contract with you or for our wider business
purposes, the information we hold about you may be transferred to, and stored at, a
destination outside the UK and the EU. It may also be processed by staff operating outside
the UK and EU who work for us or for one of our service providers. We will take all steps
reasonably necessary to ensure that your personal information is treated securely and in
accordance with this privacy notice.
‍
5.2 Adequate countries. We may transfer data to countries outside of the UK and the EU
that have been assessed as providing an adequate level of data protection. In particular, we
operate in Argentina, which has received adequacy decisions from both the UK and EU.
‍
5.3 Other international transfers. We may transfer data to countries that are not
considered to provide an equivalent level of data protection. We operate in, among others:
Albania, Australia, Brazil, Brunei, Canada, Colombia, Ethiopia, India, Jordan, Mexico, Peru,
Pakistan, Saudi Arabia, South Africa, Uganda, and the USA. Where we transfer data to such
countries, we put in place appropriate safeguards, which may include:

1. International Data Transfer Agreements (IDTAs) or the UK Addendum to EUStandard Contractual Clauses, for transfers subject to UK GDPR; and/or
2. Standard Contractual Clauses (SCCs) approved by the European Commission, fortransfers subject to EU GDPR.
   ‍
   We conduct transfer risk assessments as appropriate to confirm that these safeguards
   remain effective. To obtain further details of the safeguards in place for any specific
   transfer, please contact us at privacy@deliveryassociates.com.

6. DATA SECURITY

6.1 ISO 27001 Certification. Delivery Associates is certified to ISO/IEC 27001:2022, the
international standard for information security management. We maintain an Information
Security Management System (ISMS) and undergo regular independent audits to verify
compliance.
‍
6.2 We have put in place appropriate technical and organisational security measures to
prevent your personal information from being accidentally lost, used, accessed in an
unauthorised way, altered or disclosed. These measures include, but are not limited to,
access controls, encryption, network monitoring, endpoint security, staff training, and
incident response procedures.
‍
6.3 Access to your personal information is limited to those employees, agents, contractors
and other third parties who have a business need to know. They will only process your
personal information on our instructions and are subject to a duty of confidentiality.
‍
6.4 Third parties will only process your personal information on our instructions and
where they have agreed to treat the information confidentially and to keep it secure.
‍
6.5 Breach notification We have put in place procedures to deal with any suspected
personal data breach. Where we are legally required to do so, we will notify any applicable
supervisory authority of a suspected breach. Under UK GDPR, reportable breaches are
notified to the ICO within 72 hours of becoming aware of them. Where a breach is likely to
result in a high risk to your rights and freedoms, we will also notify you without undue
delay.
‍
6.6 Further details of our security measures are available upon request by contacting
privacy@deliveryassociates.com.

7. HOW LONG WILL WE KEEP YOUR INFORMATION FOR?

7.1 We will only retain your personal information for as long as necessary to fulfil the
purposes we collected it for, including for the purposes of satisfying any legal, accounting,
or reporting requirements. To determine the appropriate retention period, we consider the
amount, nature, and sensitivity of the personal information; the potential risk of harm
from unauthorised use or disclosure; the purposes for which we process it; and the
applicable legal requirements.
‍
7.2 Our standard retention periods are as follows. If you would like details of retention
periods not listed below, please contact us at privacy@deliveryassociates.com:

1. Personnel information (contact details, correspondence, services provided) up to
   six years after the end of our relationship with your organisation, to enable us to
   deal with after-sale enquiries or claims.
2. Assessment and training information up to six years.
3. Contact information used for marketing until you unsubscribe, at which point we
   add you to our suppression list to prevent further marketing contact.
4. Content posted on our website - (reviews, photographs, videos, blog posts,
   discussion board posts, survey responses) for as long as you have an active account
   with us, and for up to three years following account closure or extended inactivity.
   You may remove or delete content at any time while your account is active.
5. Technical information - (cookies, analytics) either collected on an anonymous
   basis or kept until the relevant cookie expires.
6. Telephone recordings - up to six months.
7. Job application information (unsuccessful applicants) - Please refer to our Recruitment Privacy Policy
8. Former employee information in accordance with our employee privacy notice.
   Contact privacy@deliveryassociates.com to request a copy.

7.3 In some circumstances we may anonymise your personal information so that it can no
longer be associated with you, in which case we may use such information without further
notice to you.

8. YOUR RIGHTS

8.1 Data protection law gives you a number of rights when it comes to personal
information we hold about you. More information about your rights can be obtained from
the Information Commissioner's Office (ICO) at www.ico.org.uk (UK residents), or from
your national data protection supervisory authority if you are based outside the UK. Under
certain circumstances, by law you have the right to:

1. Be informed in a clear, transparent and easily understandable way about how we
   use your personal information and about your rights. This is why we provide you
   with the information in this notice.
2. Request access to your personal information (commonly known as a "subject
   access request"), enabling you to receive a copy of the personal information we hold
   about you and to check that we are lawfully processing it.
3. Request correction of the personal information that we hold about you, so that any
   incomplete or inaccurate information can be corrected.
4. Request erasure of your personal information where there is no good reason for
   us continuing to process it. You also have the right to ask us to delete or remove
   your personal information where you have exercised your right to object to
   processing (see below).
5. Object to processing of your personal information where we are relying on a
   legitimate interest (or those of a third party) and there is something about your
   particular situation which makes you want to object. You also have the right to
   object where we are processing your personal information for direct marketing
   purposes.
6. Request restriction of processing of your personal information, enabling you to
   ask us to suspend the processing of personal information about you, for example if
   you want us to establish its accuracy or the reason for processing it.
7. Request the transfer of your personal information to another party where you
   provided it to us, we are using it based on your consent or to carry out a contract
   with you, and we process it using automated means.
8. Withdraw consent in the limited circumstances where we rely on consent as the
   basis for processing your personal information for a specific purpose.
9. Rights in relation to automated decision-making and profiling. You have the
   right not to be subject to a decision based solely on automated processing, including
   profiling, which produces legal or similarly significant effects on you. Where we use
   automated processing that has such an effect, you may request human review of
   the decision, express your point of view, and contest the decision. Please see Section
   12 for further information on our use of AI tools.
10. Lodge a complaint. If you think that we are using your information in a way that
    breaches data protection law, you have the right to lodge a complaint with your
    national supervisory authority. In the UK, this is the ICO (www.ico.org.uk). If you
    are based in the EU or EEA, you may lodge a complaint with your local data
    protection authority.

8.2 Response timescale.To exercise any of the above rights, please contact
privacy@deliveryassociates.com. We will respond within one month of receipt of your
request. Where a request is complex or we receive a high volume of requests, we may
extend this period by a further two months (up to three months in total). We will notify you
if we need to extend the response period and explain the reason for the delay.
‍
8.3 Marketing purposes. You have the right to ask us not to process your personal
information for marketing purposes. You can exercise this right at any time by contacting
us at privacy@deliveryassociates.com or by using the unsubscribe option in our marketing
emails.
‍
8.4 No fee usually required. You will not have to pay a fee to access your personal
information or to exercise any of your other rights. However, we may charge a reasonable
fee if your request is clearly unfounded or excessive. Alternatively, we may refuse to
comply with the request in such circumstances.
‍
8.5 Identity verification. We may need to request specific information from you to
confirm your identity before fulfilling any request. This is a security measure to ensure that
personal information is not disclosed to any person who has no right to receive it.

9. COOKIES

Our website uses cookies. For detailed information on the cookies we use and the purposes
for which we use them, including which cookies require your consent, please see our
cookie notice at: https://www.deliveryassociates.com/cookies.

10. THIRD PARTY WEBSITES‍

Our website may, from time to time, contain links to and from the websites of our partner
networks, advertisers and affiliates. If you follow a link to any of these websites, please
note that these websites have their own privacy policies and that we do not accept any
responsibility or liability for these policies. Please check these policies before you submit
any personal information to these websites.

11. WHISTLEBLOWING PROCESS

When making a whistleblowing report, we hold the information you provide to us
confidentially and securely and use it to help us handle and process your disclosure.
‍
11.1 If you are worried about being identified as a whistleblower, you can make a
disclosure anonymously. We treat anonymous disclosures just as seriously as those made
openly. However, anonymous disclosures may limit our ability to investigate your concerns
as effectively.
‍
11.2 Our external whistleblowing reporting platform is provided by WhistleB
Whistleblowing Centre AB. For more information, please see WhistleB's privacy policy at:
https://whistleb.com/privacy-policy/. We may ask for further information to enable us to
investigate your concern, along with any supporting documents or evidence.
‍
11.3 Lawful bases and legal compliance. The lawful bases we rely on to process your
personal data are compliance with our legal obligation to implement a whistleblowing
procedure and/or our legitimate interests related to processing your submission. Where
applicable, we comply with the EU Whistleblowing Directive (2019/1937) and its national
implementing legislation in the EU member states in which we operate.
‍
11.4 We will keep any personal data for as long as is necessary to fulfil our legal
obligations and for audit, regulatory and appropriate record-keeping purposes in relation
to any whistleblowing report.

12. AI AND AUTOMATED PROCESSING

12.1 Use of AI tools. We use enterprise-grade AI productivity tools to support internal
business operations, knowledge management, drafting, and service delivery. These tools
are operated under enterprise agreements that include appropriate data processing,
security, and confidentiality protections.
‍
12.2 Our approved AI tools include tools provided by Anthropic (Claude) and OpenAI
(ChatGPT), as well as AI features embedded within Microsoft 365 and Zoom. These
providers act as data processors on our behalf. Under our enterprise agreements, data
processed through these tools is not used by providers to train their AI models.
12.3 Safeguards. We maintain an AI Use Policy governing how staff may use AI tools. Key
safeguards include:

1. Staff training on appropriate use, including restrictions on inputting personal data,
   confidential information, or special category data into AI systems without
   authorisation.
2. AI-generated outputs are subject to human review by an appropriately qualified
   member of staff before being acted upon or communicated externally.
3. An AI Permitted Tool Register documenting approved tools and their permitted use
   cases.
4. A staff-built tool approval process to ensure any internally developed AI-assisted
   tools receive governance sign-off before deployment.

12.4 Automated decision-making. We do not make decisions about you that produce legal
or similarly significant effects based solely on automated means, without human
involvement. Where AI tools contribute to analytical or advisory outputs, a qualified
member of staff reviews the output before any decision is finalised.
‍
12.5 Your rights in relation to AI processing. If you have concerns about how AI tools
process your personal data or wish to exercise your rights in relation to automated
processing, please contact us at privacy@deliveryassociates.com.

13.Changes to this privacy notice

Any changes we make to our privacy notice will be posted on this page and, where
appropriate, notified to you by email or otherwise. Please check back frequently to see any
updates or changes.