Privacy Notice
This Notice explains how Laydn collects and processes personal data in connection with the Laydn platform, and sets out your rights under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.
1. Controller
1.1 The data controller is Laydn, of C/O Mako Digital, 6 Seven Stars Road, Wigan, WN3 5AT, United Kingdom.
1.2 Enquiries concerning this Notice, and requests to exercise the rights described at clause 6, should be addressed to martin@laydn.co.uk.
2. Personal data we process, and our lawful bases
2.1 We process the following categories of personal data for the purposes and on the lawful bases set out below.
| Category | Purpose | Lawful basis |
|---|---|---|
| Identity and contact data — name, business email address, telephone number, employer | Account creation, authentication, and communications concerning your use of the platform | Article 6(1)(b) — performance of a contract |
| Transactional data — consignment details, collection and delivery locations, dates, vehicle requirements and rates | Provision of the marketplace; disclosure to other members so that quotations may be made | Article 6(1)(b) — performance of a contract |
| Compliance documentation — operator's licences, certificates of insurance | Enabling counterparties to assess a member before contracting | Article 6(1)(b); Article 6(1)(f) — our legitimate interest in a trustworthy marketplace |
| Financial data — bank account name, sort code and account number, where provided | Establishing a future direct debit mandate. No payment is taken during the launch period | Article 6(1)(b) — performance of a contract |
| Driver data — name and a system-generated reference | Enabling a driver to confirm collection and delivery. Drivers are not shown rates or other members' data | Article 6(1)(f) — legitimate interests of the member employing them |
| Usage data — pages viewed, approximate location derived from a truncated IP address | Measuring how the site is used so that it can be improved | Article 6(1)(a) — consent (see the Cookie Notice) |
| Enquiry data — your name and email address, any telephone number or company name you give, and your message, when you use the contact form | Replying to your enquiry | Article 6(1)(f) — our legitimate interest in answering the people who contact us; Article 6(1)(b) where the enquiry concerns an account or a contract |
| Business contact data — published contact details of UK haulage and logistics businesses | Direct marketing of a relevant business service to a business audience | Article 6(1)(f) — legitimate interests, balanced against the recipient's interests |
2.2 We do not process special category data within the meaning of Article 9, and we do not carry out automated decision-making producing legal or similarly significant effects.
3. Disclosure to other members
3.1 The platform is a marketplace, and certain data is disclosed to other members by design: your business name, the consignments you list, and your ratings are visible to members generally. Compliance documentation is disclosed to a counterparty for so long as an active interest subsists in respect of one of their consignments.
3.2 We do not sell personal data, and we do not disclose it to advertisers or data brokers.
4. Processors and recipients
4.1 We engage the following processors, each under a written agreement satisfying Article 28.
| Processor | Function | Location |
|---|---|---|
| Hostinger International Ltd | Hosting of the application and database | European Union |
| Postmark (Wildbit LLC) | Transactional email — registration, bids, awards, job status | United States |
| Google LLC | Analytics, where consent has been given | United States |
| Cloudflare, Inc. | Bot mitigation on the registration and contact forms | Global |
| Microsoft Corporation | Conferencing, where a walkthrough session is booked | United States |
4.2 Transfers to processors outside the United Kingdom are made in reliance on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on adequacy regulations where applicable.
4.3 We may additionally disclose personal data where required by law, by a court of competent jurisdiction, or by a regulatory authority.
5. Retention
5.1 Account and transactional data is retained for the duration of the account and for six years thereafter, that period reflecting the limitation period under the Limitation Act 1980 and ordinary accounting and insurance requirements.
5.2 Compliance documentation, including documentation that has expired or been replaced, is retained until the account is closed or the member asks us to delete it. 5.3 Marketing data is deleted upon objection. 5.4 On a valid erasure request we will delete personal data save to the extent that we are required to retain it by law. 5.5 Messages sent through the contact form are deleted from the platform twelve months after receipt; copies in our mailbox are kept only for as long as we need them to deal with the enquiry.
6. Your rights
6.1 Subject to the conditions in the UK GDPR, you have the right to be informed; of access (Article 15); to rectification (Article 16); to erasure (Article 17); to restriction of processing (Article 18); to data portability (Article 20); to object to processing carried out on the basis of legitimate interests, including direct marketing (Article 21); and to withdraw consent at any time where processing is based upon it.
6.2 Requests should be addressed to martin@laydn.co.uk. We will respond within one month of receipt, extendable by two further months where a request is complex. No fee is payable unless a request is manifestly unfounded or excessive.
7. Direct marketing
7.1 We contact UK haulage and logistics businesses at published business addresses to introduce the platform, in reliance on legitimate interests and in accordance with the Privacy and Electronic Communications Regulations 2003 as they apply to corporate subscribers.
7.2 Every such communication carries an unambiguous means of objection. An objection is actioned automatically and suppresses all further contact; no further action is required of the recipient. You may alternatively request erasure of all data held in respect of your business.
8. Security
8.1 We implement appropriate technical and organisational measures under Article 32, including transport encryption throughout, one-way hashing of authentication credentials, storage of uploaded documentation outside the public web root, role-based access control, and rate limiting of authentication endpoints.
8.2 No system is impregnable. Where a personal data breach is likely to result in a risk to the rights and freedoms of data subjects, we will notify the Information Commissioner within 72 hours in accordance with Article 33, and affected individuals where Article 34 requires it.
9. Complaints
9.1 If you consider that our processing does not comply with data protection law, we ask that you raise it with us first so that it may be resolved. 9.2 You have the right in any event to lodge a complaint with the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk.
10. Amendment
10.1 This Notice may be amended from time to time. Where an amendment materially affects the processing of your personal data, we will notify you directly. The version and effective date are stated at the head of this Notice.