HK Logistics Driver App — Privacy Policy

HK Logistics Group Ltd (data controller) · app developed and operated for them by Book On Solutions Ltd (processor) · Last updated 8 October 2026

Who this app is for. The HK Logistics app is a work tool for drivers engaged by HK Logistics Group Ltd. It is not a consumer service. A driver either applies through the app or is set up by the company, and an account only becomes usable once the company has approved it.

What we collect, and why

When you apply for an account

• Your name, date of birth, email address, mobile number and home postcode — to identify you, contact you, and run the employment or contractor relationship.
• Your driving licence number and National Insurance number — to check you are entitled to drive and to work, and to pay you correctly. These are collected because we are legally required to verify them.
• The location of your device at the moment you submit the application, and the place name that location corresponds to — so the office can see roughly where an applicant is based and spot applications that are not genuine. This is a single point in time, not tracking, and your device will ask your permission first. You can refuse and still apply. If you send your vehicle's details with the application, the vehicle request records the same point.
• If you apply on the web page a QR code opens (one of our posters or cards — a web page, not the app) and tap *Use my location to fill my postcode*, your browser asks your permission, looks up your postcode with postcodes.io itself, and the page sends us that position. We keep it, rounded to about 10 metres, with its place name, against that scan of the QR code, so the office can see where applications from that code come from. Not tapping the button sends nothing.
• A password, which we store only as a cryptographic hash. Nobody at either company can read it.
• If you apply as a self-employed driver, the vehicle you will use — its registration, make, model, type, year, body type, load dimensions, weights, colour and fuel type; photographs of it (front, rear, both sides, the load area and the number plate, and if you choose the interior and any existing damage); and its paperwork (V5C logbook, hire-and-reward insurance certificate and MOT certificate). These let the office check the vehicle is yours, roadworthy and insured to carry other people's goods before it is approved. They are kept with your compliance documents, for the same period. A vehicle request records the network (IP) address and device it was sent from, so the office can tell a genuine request from a misuse of your account.

While you are working

• Your location while you are on duty, and only while you are on duty. You start a working session yourself by tapping Go on duty, and you end it by tapping Go off duty; the office can also end it for you (for example if you forget). While the session is open — including where you are at the moment you go on and off duty — your position is used to allocate and dispatch work, to run collections and deliveries, to show the office your progress on a live job, and to detect that you have arrived. Each point is stored with its time and the speed, heading and accuracy your device reports. While you are on duty this continues when the app is in the background or your screen is locked, so a job does not stop being tracked because you put the phone in your pocket. Your phone shows you this is happening — a notification on Android, a blue indicator on iPhone. **On Android, closing the app or swiping it away does not stop it**: the notification stays, and your position goes on being recorded until you go off duty or the office ends your shift (the phone then stops at its next report). It also stops if you sign out, if your account is signed in on another phone or signed out by the office, if you take away the app's location permission, or if you use Force stop in Android's settings. On iPhone, swiping the app away stops it, and it resumes when you open the app again. The moment you go off duty, or the office ends your shift, recording stops altogether: our server discards any position sent by an off-duty driver rather than storing it — whether it comes with a job update, a photograph, an incident report or a vehicle request, or is the position the app reads when you scan a parcel label off duty. The record itself is kept; only the position is thrown away. Signing out of your account is a separate action and does not by itself end a working session. Apart from the point when you apply (above), we never collect your location when you are off duty, and there is no way for the company to turn your location on remotely. We do not work out where you are from your network (IP) address.
• Positions on job records, while you are on duty. A job status update, a job photograph, a proof of delivery and an incident report carry the last position your phone reported while you were on duty. Arriving at a route stop, recording deliveries at a route stop and scanning a parcel label take a fresh reading at that moment. Each is kept with that job or route as evidence of the work. Off duty, none of them keeps a position.
• Photographs you take: goods at collection and delivery, damage, your vehicle (for a vehicle request), receipts and documents.
• No location from inside your photographs. A phone camera can write where a photograph was taken into the photo file. Our server removes that from every JPEG, PNG or WebP photograph it receives from the app — receipts, documents, job and vehicle photographs, documents you send back and photos in messages — and never reads it from any file.
• A profile photograph, if you add one — shown in the app and beside your name in the office system.
• Signatures captured on the device as proof of delivery.
• Documents you upload: driving licence, insurance, right-to-work and similar compliance paperwork, including their expiry dates; and any document the office sends you that asks for a copy back.
• Vehicle information you provide, including registration, make, model and insurance details, and your daily vehicle checks: the checklist, any defects you describe and the mileage reading.
• Job activity: statuses, timestamps, mileage, delivery outcomes and any reasons you record for a delay or a failed delivery.
• Messages you send to the office through the app, and anything you attach.
• Your pay, expenses, deductions and any query you raise about them: when you claim an expense, its amount, date, supplier, any fuel litres and mileage reading, and a photograph of the receipt; when you confirm or question a payment, what you said about it.
• Sickness and absence reports you send — the dates, the kind of absence (sick, holiday, unavailable or other) and anything you write about it — so the office can plan work and pay you correctly. A sickness report is health information, and we treat it as such.
• Your emergency contact, if you give one — their name, relationship to you, phone numbers and email address — so the office can reach someone if something happens to you at work.
• Policies you acknowledge and documents you sign — which policy or document and which version, and when; for a document, an appraisal or training you sign in the app, your signature or typed name (and, for an appraisal, your comments), and the network (IP) address and device it was signed from, so a signature can be shown to be yours.

Automatically, when you use the app

• Your IP address and the device/browser identification string, recorded against each sign-in session so we can detect unauthorised access to your account.
• An app installation identifier. The first time the app runs on a phone it generates a random value and keeps it in the app's own storage on that phone. It is not a hardware or device identifier, not an advertising identifier, and it is not made from anything about you or your phone. The app sends it with each request to our server (in a request header named X-HK-Install), and we store it only in the record of each sign-in made from the app, together with the phone's platform (Android, iOS, or the web version of the app) and the app version. It is used only to keep a driver account signed in on one phone at a time — so signing in again on your own phone is recognised as the same phone, while signing in on a different phone signs the other one out — and to show the office which phones your account has been signed in on so that the account can be signed out. It is never used for advertising, analytics or tracking, and it is not shared with anyone. It stays on the phone until the app is deleted or its data is cleared (signing out does not reset it). On our side it is not kept for as long as your account exists: each sign-in record, with its identifier, is deleted 12 months after that sign-in ended; it is removed at once if your account is anonymised, and deleted with everything else if the account is permanently deleted.
• A push token, on iPhone, if you allow notifications. Apple's push service issues the app a token for your phone, which the app sends to our server; we store it with your account and the sign-in it came from, so that job offers and messages from the office can make your phone ring when the app is closed. It stops being used when you sign out, or when your account signs in on another phone. The Android app does not use push notifications at present: it contains Google's Firebase push library, because the notification component needs it, but it is not switched on — there is no Firebase configuration in the app, so no Firebase identifier or push token is created and nothing is sent to Google. Alerts on Android come from the app itself while it is running.
• A record of what was sent to you — each push notification (its title and whether it was sent), and each email or text message (the address or number, its subject or wording, and whether it was sent) — so a message that did not arrive can be traced. Kept 12 months. Where an email is kept on our server as a file instead of being handed to the email provider, that copy is deleted with its record.
• Sign-in and verification codes. When a one-time code is sent to you (to sign in, reset your password, or confirm a new email address or mobile number), we keep a one-way scrambled form of it — enough to check the code you type, never to read it back — with where it was sent and when it expires. Deleted 30 days after the code expired.
• App diagnostics. When the app cannot reach our server or a piece of work it saved is refused, when work it saved while you had no signal has been sent, or when it is too old to carry on, it reports this to our server ("sync failed", "queued work sent", "version blocked"), with the request's reference number, the part of our system it was calling, the error code, the attempt number, the app version, the platform and a short description, linked to your account. It never contains the contents of your work, a photograph, a document or a password. It lets the office see a sync problem before you have to phone in about it. There is no crash reporting.
• An audit trail. Changes made in the system — such as your sign-ins, your application, documents, jobs, pay and what you send from the app — are recorded with the account that made them, when, the network (IP) address they came from and what changed. The audit trail of changes is kept for its retention period and can contain details as they were at the time, such as the contact details and the location recorded when you applied.

What we do not do

No advertising. No sale or renting of personal data. No third-party analytics, advertising or tracking software of any kind is built into this app. We do not access your contacts, your call history, your files, or any photograph you do not choose to attach. We do not track you across other companies' apps or websites.

When you tap "navigate", the app hands the destination address to your phone's own maps application. What that application then does is governed by its own provider's privacy policy, not ours.

Who your information is shared with

• The customer of a specific delivery, in their online account, sees for that job only your first name, the job's progress (including a reason you gave if it could not be completed) and the photographs taken on the job. The office may also send them the proof of delivery, which can include the signature.
• Book On Solutions Ltd operates the software on HK Logistics Group Ltd's behalf, as a processor, under contract.
• HMRC, insurers, auditors, and enforcement bodies where we are legally required to provide records.

Some services do one job for us, as our service providers, and are sent only what that job needs:

• A postcode lookup service (postcodes.io) is sent coordinates — where you applied from, where a proof of delivery was taken, your position on a live job when the office looks at it — to turn them into a place name, and postcodes (your home postcode, a job's or a route's addresses) to turn them into a position on the map. On the QR application page, your browser sends it your position directly when you tap the location button. It is never sent your name or anything about your account.
• A route-distance service (OSRM) is sent the positions of a job's collection and delivery postcodes, to estimate its road mileage. Nothing about you.
• An address search service (OpenStreetMap's Nominatim) is sent the text typed into an address box in the office's system — which can be your home address when the office types it in — to suggest matching addresses. Nothing else about you. The driver app's address boxes do not use it.
• Apple's push notification service, on iPhone, receives your phone's push token and the notification itself — its title, its text and which job or message it is about.
• Our email provider carries the emails we send you, such as sign-in and verification codes, password resets, account notices, security alerts and copies of some notifications, and so receives your email address and that message. It also carries emails to the company's own staff — alerts and a daily summary of office notices — which can name you and say what the notice was about.
• An SMS provider (Twilio), only if text messaging is switched on, receives each text and the number it goes to. To your mobile: verification, sign-in and password reset codes, a code to confirm a new mobile number, and — if you sign in with text-message codes — security alerts about your account. To the company's owner or compliance contact: texts that can name you — that a driver has been placed under investigation and why, and serious alerts such as an incident you reported or a failed vehicle check, with what was reported.
• An IP-address lookup service (ipapi.co) is used only for office staff signing in to the company's web system, so that their "Sessions & devices" screen can show the town a sign-in came from: it is sent the network address alone. It is never used for the driver app or for a driver's account: no address from your phone is ever sent to it.
• An AI service (Anthropic), only if the company switches on the optional AI assistant in its office system — it is off unless the company has connected an Anthropic account. When it is on, a question office staff ask it, or an email they ask it to help answer, and the records needed to answer it — which can include your name and details of your jobs and pay — are sent to Anthropic to produce the answer. The driver app never uses it. It is not shared with anyone else.

Where it is kept and how it is protected

Data is held on servers in the European Economic Area. It is encrypted in transit (HTTPS). Access inside the company is restricted by role. Changes to records are logged in the audit trail, and so is opening the most sensitive ones — HR records, location history, signatures, receipts and payment evidence. Passwords are hashed, never stored in readable form, and so are two-factor recovery codes — nobody, including an administrator, can read them back. Authenticator secrets are encrypted at rest with a key held outside the database.

Your account can be signed in on one phone at a time. The office can see which phones it has been signed in on — the phone's model, platform and app version, and when each was used, but not its network address or where it was — and can sign your account out everywhere or lock it if a phone is lost or misused. (The network address of each sign-in is in the audit trail, which only administrators, compliance staff and auditors can open.) You end a sign-in yourself by signing out, and signing in on another phone ends the previous one.

How long we keep it

Different kinds of record are kept for different lengths of time, because different laws apply to them. We do not keep everything for six years merely because some records must be.

Working sessions — when you went on and off duty — are kept alongside the working-time records they support.

Deleted automatically, by a daily job, once their period has passed: raw location points and the record of arriving at and leaving a stop (12 months); sign-in records and push tokens no longer in use (12 months after they ended); app diagnostics (12 months); the records of notifications, emails and texts sent, with any copy of an email kept on our server (12 months); sign-in and verification codes (30 days after they expired); office notices once they have been read, and alerts once resolved (6 years); parcel scan records (6 years); and the audit trail (6 years).

Not deleted automatically: your driver record, jobs and proof of delivery, pay, expenses and settlements, documents, messages with the office, HR, sickness and working-time records, and working sessions. When their period has passed, the company reviews them and either anonymises or deletes them. The company reviews these periods and may change them; this page is updated when it does.

Deleting your account

You can ask for your account to be deleted from inside the app, under Profile → Delete my account, or by writing to the address at the bottom of this page. There is also a page explaining the process at https://app.hklogisticsgrouplimited.co.uk/account-deletion

Because the company must keep employment and delivery records for six years, we cannot always erase everything immediately, and we will not pretend otherwise. What happens is:

• Your personal details are removed — name, date of birth, contact details (email, phone numbers, address), nationality, National Insurance and licence numbers, and your emergency contact.
• Your uploaded documents and your photograph are removed, and their files deleted. So are copies of documents you sent back to the office.
• The photographs and paperwork sent with a vehicle request (V5C, insurance, MOT and vehicle photographs) are deleted, files included — except a document that became part of an approved vehicle's fleet record, which stays with that vehicle.
• The location recorded when you applied, and its place name, are removed, and your location history — the trail of on-duty position points — is deleted. Positions that are part of a job record (where you arrived, where a delivery was proved, where a parcel was scanned or a job photograph or incident report was made, where a working session began and ended) stay with that record.
• The network address, device details and app installation identifier in your sign-in records are removed, along with your phone's push token, your two-factor settings, the sign-in and verification codes sent to you and the app diagnostics your phone sent.
• The notices sent to you and the record of notifications pushed to your phone are deleted; the records of emails and texts sent to you no longer hold your address, number or a text's wording.
• The position, network address and device recorded with any vehicle request you sent are removed.
• What you wrote in sickness and absence reports is removed; the dates and type of absence stay with the working-time and pay records.
• Office notices that copied details you asked to change (such as a new address, National Insurance number, date of birth or nationality) or what you wrote in an absence request, and the new-application alert's note of where you applied from, are reduced to a neutral sentence.
• Office notices, alerts and activity entries that named you keep what happened, with your full name replaced.
• Your completed jobs, pay records, expenses (with their receipts), proof of delivery, incidents and signed documents are kept for their periods, attached to a record that no longer holds your personal details. Some of them contain your name or your own words as written at the time — a job's history shows who moved it on, messages and emails with the office and documents you signed are kept as they are — and those stay with the record until its own period ends.
• The audit trail of changes is kept for its retention period and can contain details as they were at the time, such as the contact details and the location recorded when you applied.
• What is kept is dealt with when its own period ends, as described under How long we keep it: the records listed there as deleted automatically are deleted then; the rest are reviewed by the company and then anonymised further or deleted.
• Your sign-in is disabled and you are signed out. We will confirm when this has been done.

Your rights

Under UK GDPR you have the right to be told what we hold about you, to have it corrected, to have it deleted where the law permits, to restrict or object to how it is used, and to receive a copy in a portable form. Ask through the app or in writing and we will respond within one month.

If you are not satisfied with how we have handled your information you can complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

Lawful bases

We rely on: performance of a contract (running your engagement and paying you); legal obligation (right-to-work, licensing, tax and record-keeping duties); and legitimate interests (operating the delivery service safely and securely, and preventing fraud). Where we rely on your permission — such as the device permissions below — you can withdraw it at any time in your phone's settings. Sickness information is used only to meet our obligations as an employer or engager, such as sick pay and safe working.

Device permissions

• Location — used while you are on duty, including when the app is in the background or the screen is locked (and on Android when the app has been closed), plus once at the moment you submit an application. Off duty the app does not follow your location. If you scan a parcel label, or try to record a route stop, while off duty, the app reads the phone's position once with it, and our server throws that reading away. On Android you may allow approximate location only, and on iPhone you can turn Precise Location off for the app; either way the app then works with approximate positions, less precisely.
• Camera — used to photograph goods, damage, vehicles, receipts and paperwork.
• Photo library — used only if you choose to attach a photograph you have already taken.
• Notifications — used to alert you to job offers and messages from the office. On iPhone, allowing them registers the phone with Apple's push service (see above). Refusing a permission stops the related feature working; it does not stop you using the rest of the app.

Contact

HK Logistics Group Ltd, Wood Street, London E17 3NU · +44 20 3983 5407