Privacy Policy | CainDirect

LEGAL · DATA PROTECTION · UK GDPR

How CainDirect collects, uses, protects, and handles your personal data in accordance with UK GDPR and the Data Protection Act 2018.

VERSION 1.0

EFFECTIVE: JUNE 2025

LAST REVIEWED: JUNE 2025

CONTROLLER: ANDREW CAIN TRADING AS CAINDIRECT

ABOUT THIS POLICY

This Privacy Policy explains how CainDirect operated by Andrew Cain as a sole trader collects, uses, stores, and protects personal data when you use our services, visit our website, or contact us. We are committed to handling your data responsibly, transparently, and in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Please read this policy carefully.

1 Who We Are

CainDirect is a bespoke same-day courier and concierge service operated by Andrew Cain as a sole trader, based in Lincolnshire, England.

For the purposes of UK GDPR and the Data Protection Act 2018, Andrew Cain trading as CainDirect is the Data Controller meaning we are responsible for deciding how and why your personal data is used.

Trading name: CainDirect
Legal name: Andrew Cain (sole trader)
Registered address: Caythorpe, Lincolnshire, NG32
Email: andrew@caindirect.co.uk
Telephone: 07795 504 739
Website: www.caindirect.co.uk

ICO REGISTRATION

As a data controller processing personal data, CainDirect is registered with the Information Commissioner's Office (ICO) as required under the Data Protection Act 2018. ICO registration number: [Insert your ICO registration number here before publishing]. To verify registration, visit ico.org.uk.

2 What Personal Data We Collect

We collect only the personal data that is necessary for us to provide our courier, concierge, and health logistics services, and to operate our business lawfully and efficiently.

Contact and identity information

Full name of clients, contacts, and recipients
Job title and employer / business name
Business address and site addresses
Email address
Telephone number (including mobile / WhatsApp)

Service and operational data

Collection and delivery addresses for each job
Details of consignments handled (excluding contents of sealed items)
Collection times, preferences, and handover instructions
Proof of delivery records: recipient name, date, time, and location
Notes and preferences relating to your service arrangement
Communication records: messages, emails, WhatsApp messages

Financial and billing data

Invoice records: job details, amounts, dates
Payment records (we do not store payment card details, payments are processed via third-party services)
Business bank account details where provided for BACS payments

Health logistics - additional data

Where we provide Concierge Health Logistics services, we may collect additional data including:

Patient name and home address (provided by the referring healthcare provider or pharmacy)
Name of GP surgery or pharmacy involved in the prescription journey
Delivery confirmation and handover records specific to the prescription or medical item

IMPORTANT - HEALTH DATA

Where patient information is provided in connection with prescription or medical item delivery, CainDirect handles this data with the highest level of care and discretion. We do not retain patient health records or prescription details beyond what is strictly necessary for the delivery and proof of delivery record. We do not transport or process controlled drug prescriptions.

Website data

IP address and browser type (collected automatically by our website platform)
Pages visited and time spent on the site (via analytics - see Section 10)
Information submitted via any contact or enquiry form on the website

3 How We Collect Your Data

Directly from you - when you contact us by phone, email, WhatsApp, or via our website to enquire about or book our services
During the consultation process - when you provide us with details about your business requirements, preferred arrangements, and contact information
During service delivery - collection and delivery addresses, recipient names, and handover confirmation details
From third parties - where a business client provides us with the name and address of a recipient or where a healthcare provider provides patient delivery details
Automatically via our website - analytics data and cookies (see Section 10)
Via WhatsApp or SMS - when you contact us via these channels for job bookings or service queries

4 Why We Use Your Personal Data

We use the personal data we collect for the following purposes:

5 Our Legal Bases for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following bases:

Performance of a contract

The majority of our processing is necessary to fulfil the contract we have with you or to take steps at your request before entering into a contract. This includes all aspects of service delivery, job management, and invoicing.

Legitimate interests

We process some data where it is in our legitimate interests to do so and where those interests are not overridden by your rights. This includes maintaining client records, managing ongoing service arrangements, and improving our service. We have assessed that these interests are proportionate and do not place an undue burden on individuals' rights.

Legal obligation

We are required to retain certain records including financial records to comply with UK tax law and other legal obligations. Retention periods for legally required records are set by the relevant legislation (typically 6 years for financial records under HMRC requirements).

Consent

Where we rely on consent for example, for non-essential cookies on our website you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Vital interests

In the limited circumstances where health logistics services involve the welfare of a patient or individual, we may process data on the basis of vital interests where no other lawful basis applies.