Privacy Policy

FOOD TECHSOL LTD, registered at 109 Stewart Road, Falkirk, Scotland, FK2 7AQ under company number SC868501, operates the Scorto platform. This policy explains what personal data we handle, why, and what rights you have.

Our role differs by whose data it is. For retailer, courier, and franchise-operator account data we are the controller: we decide why and how it is processed. For end-customer data we are generally a processor: the retailer collects the customer's name, address, and phone number and passes it to us so a delivery can be completed, and the retailer remains the controller of it. If you are an end customer, the business you ordered from is your first point of contact.

Where a franchise operator handles your onboarding or a dispute in your territory, they process your data under our instruction and under a written agreement.

From retailers: business name and trading details, business registration or tax identifier, the business owner's identity documents, contact details, Stripe account identifiers, wallet and transaction history, orders dispatched, and disputes raised.

From couriers: name and contact details, a government-issued identity document, the outcome of an identity verification check, vehicle registration and insurance details where a vehicle is used, delivery history, ratings, earnings and deduction records, location data while a delivery is active, and proof-of-delivery photographs.

About end customers, received from the retailer: delivery address, contact telephone number, and order details necessary to complete the delivery. We do not collect customer data directly and customers do not hold accounts.

Technical data: authentication tokens and session records, device and log data, and records of access to the platform. Administrator sessions additionally record multi-factor authentication events.

We do not collect special category data. We do not use the platform to profile individuals for advertising, and we do not sell personal data.

To operate the service: creating accounts, matching deliveries to couriers, routing and tracking those deliveries, generating estimated arrival times, recording proof of delivery, and settling payments and payouts.

To verify identity and prevent fraud: confirming that a business exists and that a courier is who they say they are, detecting duplicate accounts, and identifying patterns such as repeated cancellation after acceptance or repeated deviation from an assigned route.

To resolve disputes fairly: a refund claim is assessed against delivery logs, location history, and the proof-of-delivery photograph, so that an outcome rests on record rather than on assertion.

To meet legal and accounting obligations, and to communicate operational information such as order status, payout notifications, and material changes to the service.

Where we are the controller, we rely on the following bases under UK GDPR and EU GDPR as applicable.

Performance of a contract: creating and maintaining your account, dispatching and tracking deliveries, and processing payments and payouts. Without this data the service cannot be provided.

Legitimate interests: fraud prevention, identity verification, platform security, route and performance monitoring, and dispute resolution. We have considered the impact on you and have limited monitoring to what an operating delivery platform requires: location is tracked during an active delivery, not throughout a courier's day.

Legal obligation: retaining transaction and tax records, and responding to lawful requests from authorities.

Consent: optional communications only. Where we rely on consent you may withdraw it at any time without affecting the lawfulness of earlier processing.

A courier's location is processed while a delivery is active, so that the retailer can see progress, an estimated arrival time can be calculated, and significant deviation from the assigned route can be flagged. Tracking is tied to an accepted delivery. It begins when a delivery is accepted and ends when it is completed or cancelled.

We do not track a courier's location when no delivery is active, and we do not use location data to monitor a courier outside working deliveries. Location history is retained against the delivery record so that it is available if that delivery is later disputed.

Location is transmitted over an encrypted connection and stored encrypted. Access is restricted by role: a retailer sees the location of couriers carrying their own deliveries, a franchise operator sees activity in their territory, and Scorto sees active deliveries platform-wide.

Routing and estimated arrival times are calculated using Google Maps. Location data shared with that service is subject to Google's own terms and privacy policy.

A courier photographs the order at the point of delivery. The photograph is the evidence a dispute is judged on, so it is retained against the consignment record rather than discarded on completion.

Couriers are instructed to photograph the goods at the delivery point and to avoid capturing people, vehicle registration plates, or the interior of a property. A photograph may nonetheless incidentally capture personal data such as a door number or a doorstep.

Access is limited to the retailer who dispatched the delivery, the courier who made it, the franchise operator for that territory, and Scorto when reviewing a dispute. Photographs are not published, are not used for marketing, and are not used to train any automated system.

If you believe a photograph of your property contains personal data that should not have been captured, contact [email protected] and we will review and, where appropriate, delete or redact it.

We share data with service providers who process it on our behalf under contract. These are: Supabase, which provides the database, authentication and file storage underlying the platform, and which therefore holds delivery records and proof-of-delivery photographs; Stripe, which processes payments, subscriptions, and payouts and which handles card data entirely within its own PCI-DSS environment so that we never receive full card numbers; Google Maps, which provides routing, geocoding, and estimated arrival times; and our SMS and email providers, which deliver operational notifications.

We share operational data between platform users where the service requires it: a courier receives the customer's address and contact number on accepting a delivery; a retailer sees the location and performance of couriers carrying their deliveries; a franchise operator sees activity within their territory. Customer contact details are released for the duration of a delivery and must not be retained by the courier afterwards.

We may disclose data where required by law, to establish or defend a legal claim, or to prevent fraud or harm. We do not sell personal data and do not share it with advertisers.

The current list of sub-processors is published on our trust page rather than provided on request, together with a downloadable data processing agreement. Questions about either go to [email protected].

This website sets no cookies of its own, and we run no advertising, profiling, or cross-site tracking anywhere on it. There is no consent banner because there is nothing to consent to.

We do not currently use analytics. If we add it, it will be a privacy-preserving tool that reports aggregate statistics and cannot identify you individually, we will describe it in this section before it goes live, and we will offer a simple and free way to object.

One exception, on one page. The booking calendar on our contact page is provided by Cal.com and loads only when you open that page. It is a third party and may set its own storage in your browser to make the calendar work. Every other page on this site is free of third-party code. If you would rather not load it, email us instead. The address is on the same page and reaches the same people.

Your browser can block or delete storage from any site, including this one. Nothing on this website depends on storage to work, apart from the booking calendar described above.

We keep personal data only as long as it is needed for the purpose it was collected for, or as long as the law requires.

A courier's access to a customer's name, address and telephone number ends with the delivery. The consignment record itself, including the delivery address, is retained by us and is covered by the periods below.

Where data is retained to meet a legal obligation, it is kept for that purpose alone and access is restricted accordingly.

Automated enforcement of these periods is currently partial. Orders older than three years are withdrawn from ordinary use, and we are extending automatic enforcement to the remaining categories. We would rather state that plainly than describe a process we have not finished building. It does not affect your right to ask us to erase data we no longer need, which is set out under Your rights below and which we action on request.

Subject to the conditions in applicable data protection law, you have the right to access the personal data we hold about you, to have inaccurate data corrected, to have data erased in certain circumstances, to restrict or object to processing, and to receive data you provided in a portable format.

Where processing is based on legitimate interests you may object, and we will stop unless we have compelling grounds that override your interests. Where processing is based on consent you may withdraw it at any time.

To exercise a right, contact [email protected]. We will respond within one month, extendable by two further months for complex requests, and we will tell you if an extension applies. We may need to verify your identity first. There is no charge unless a request is manifestly unfounded or excessive.

If you are an end customer, ask the retailer you ordered from in the first instance, as they are the controller of your order data. If you approach us directly we will pass the request to them and help them respond.

You may complain to a supervisory authority. In our case that is the Information Commissioner's Office (ICO). You may also complain to the authority where you live or work.

We aim to process and store personal data within the United Kingdom and the European Economic Area. Some of our service providers process data outside those areas.

Where data is transferred outside the UK or EEA, we rely on an adequacy decision covering the destination country, or on Standard Contractual Clauses together with the UK International Data Transfer Addendum where required, supported by an assessment of the safeguards in place.

Details of the transfer mechanism relied on for a particular provider are available on request from [email protected].

Questions about this policy, or a request to exercise a right, should be sent to [email protected], or by post to FOOD TECHSOL LTD, 109 Stewart Road, Falkirk, Scotland, FK2 7AQ.

For general enquiries that do not concern personal data, contact [email protected].

We review this policy periodically and when the platform changes materially. Where a change affects how we use your data we will give notice through the platform or by email.