FURTHER INFORMATION
A direct contact
for privacy questions.
TSAG Couriers is based in Dundee, Scotland, and is responsible for the personal information it uses to manage its enquiries and courier bookings.
Our registered address is 5 South Charlotte Street, Edinburgh, EH2 4AN.
For further information about this notice, a privacy concern or a request concerning your personal information, email mail@tsag.uk.
Customer portal accounts
When you apply for a customer account, we store your sign-in identifier and email, business name, contact name, approval status and account history. Office staff review applications and can approve, decline or suspend access. Each sign-in needs its own approval. Approved customers can request collections and deliveries and view booking details and POD evidence linked by the office or created through their account. We do not automatically link older bookings by email address. Account records and access decisions are used to administer access and customer services. Suspension blocks further portal requests but does not delete booking or POD records.
Office sign-in is provided by ChatGPT. Where customer email sign-in is enabled, Supabase verifies your email address and sign-in session, and login emails are sent through our email provider. Your browser stores a customer session so you can stay signed in; signing out removes that session from the browser. Each email identity requires separate office approval. New delivery requests remain subject to office confirmation, agreed pricing and availability.
Driver accounts and dispatch
Office staff register a driver’s name and individual email address, account status and vehicle details for dispatch. Drivers can use an emailed code through the same Supabase email verification service as customers. A verified first email sign-in links the driver account to a stable identifier. Office can also issue a username and temporary password. The driver must replace the temporary password before opening jobs. We store a salted password hash and use a secure session cookie for password sign-in. Office can reset the password or suspend access. Drivers who enable Android job notifications register a device token with TSAG. We use Firebase Cloud Messaging to deliver the assigned job reference and identifiers to that phone. Tap the alert to open the job in the signed-in app. Delivery addresses and contact details are shown in the protected job screen. Drivers can access only jobs assigned to their active account; suspension blocks subsequent access and submissions. We record assignment changes, access decisions, collection confirmations and delivery issues for operational accountability. Reassigning a job revokes earlier single-job links. These records follow the business-record retention criteria in this notice.
Driver job screens can open Google Maps directions. If a driver chooses a directions link, the selected stop’s postcode is sent to Google, whose own privacy arrangements apply. When a driver completes a delivery, the app requests one location reading from the phone. If available, the coordinates, reported accuracy and reading time are stored with the proof of delivery and shown to authorised office staff. If location is unavailable, the app can still save the delivery proof and records why the reading was unavailable. Office staff can choose to open the coordinates in Google Maps. This feature takes a single reading at completion. The Android driver app also lets drivers start live tracking for an assigned delivery after collection. The app uses a persistent Android notification while it sends phone positions to TSAG. Office staff can see the latest position, reading time and accuracy during that job, and choose to open it in Google Maps. Tracking ends on delivery completion or when the driver stops it. The live view replaces previous readings with the latest reading and is separate from the delivery proof record. Drivers should use navigation only when safe to do so.
Only what the job needs
Information may include your name, email address and telephone number; collection and delivery addresses and postcodes; sender and recipient contact details; the description, size and weight of items; collection dates and delivery instructions; correspondence, quotes, invoices and payment references; driver names, recorded delivery times, recipient signatures and delivery evidence photographs where provided for a booking.
We receive information directly from you when you email us or arrange a delivery. For a delivery recipient or a business contact, it may be supplied by the person booking the courier service. Please only share details you are authorised to provide, and tell the recipient that their details will be used to arrange the delivery.
The website and its service providers may also process technical request information such as IP addresses, browser information and security logs to provide and protect their services. Do not include sensitive personal information or payment card details in the booking request or an ordinary enquiry.
What happens when you calculate
The postcode calculator is available only in the signed-in Office area. When office staff use “Calculate estimate” or “Use route distance and time”, the collection and delivery postcodes are sent to Postcodes.io to obtain approximate location coordinates. Those coordinates are then sent to the FOSSGIS OSRM routing service to calculate a driving route, distance and journey time. Your browser connects directly to those providers, which may process your IP address and log requests under their own policies.
The calculator uses postcode centres rather than a full street address. Item descriptions, preferred dates and service selections are not sent to the postcode or routing services. The office calculator does not send an email or create a booking automatically. The separate “Send enquiry” form sends and stores the details you enter for the office to review.
The mileage estimate and job-specific costing inputs remain in the open page and are not automatically stored with a customer or booking. Office staff can explicitly save a business cost profile in this browser’s local storage. This includes entered operating costs, income and capacity allowances, pricing settings, review status and the saved time. It stays on that browser and is not synced to other devices. Refreshing the page can reload this saved profile; clearing this website’s browser data removes it. Staff can copy an internal costing or download a file containing its inputs and breakdown. Clipboard copies and downloaded files are then controlled by the staff member and device. Browser features such as autofill, history or restoring tabs are controlled by browser settings.
Email links open your email application. Write and review your enquiry before sending. TSAG Couriers receives the information only if you send the message. Copying an office estimate or costing creates a copy on the staff member’s clipboard.
Further provider information: Postcodes.io and FOSSGIS routing and privacy information. Office sign-in is handled by ChatGPT under OpenAI’s privacy policy.
Online bookings and proof of delivery
The short website enquiry collects your name, reply email, route postcodes, service and load description, plus a preferred date if you supply one. Full addresses and any further delivery contact details are collected when arranging a booking. Online enquiries are stored for the office to review. They do not automatically confirm a booking. A driver’s job link gives access only to that job and expires seven days after its planned collection date (or seven days from issue if later). Replacing a driver link revokes the earlier link.
When a driver confirms delivery, the system saves a server timestamp, recipient or safe-place description, driver name, delivery notes and any supplied signature or photo. Evidence is stored privately with integrity hashes and a booking history. These are delivery records, not biometric identity-verification checks.
A customer POD link expires after 30 days and shows only that delivery’s record and evidence. Anyone holding a valid link can view the proof, so links should not be forwarded unnecessarily. Proof records are retained separately according to the business-record criteria in this notice; link expiry is not record deletion.
When office booking alerts are enabled, the booking reference, collection and delivery postcodes, requested collection date/time and service are sent through Resend to our business mailbox. The alert links to the protected Office dashboard; full customer details remain in the booking record.
When automatic email is enabled, the customer email address, message and private POD link are sent to our transactional email provider, Resend, to send the delivery confirmation. Email status records distinguish a message accepted by the provider from confirmed inbox delivery. Automatic sending is disabled until the sending service and customer access are configured. Drivers are asked to avoid people and private interiors in delivery photos.
Why information is used
- Preparing your requested quote or arranging your booking
- To answer your request, agree the job and provide the courier service. Where you are the contracting individual, the basis is taking steps at your request before a contract, or performing that contract.
- Business contacts and delivery recipients
- To communicate with the relevant people, collect and deliver goods and resolve delivery questions. Where these individuals are not the contracting customer, the basis is our legitimate interest in operating the requested courier service, balanced against their rights.
- Invoices and required business records
- To administer payment and keep records required by tax, accounting or other applicable law. The basis is legal obligation where a record is required, and otherwise our legitimate interest in proper business administration.
- Security, service issues and complaints
- To protect the website and business, investigate problems and establish or defend relevant claims. The basis is our legitimate interest in secure, accountable operations, or a legal obligation where applicable.
If essential contact, address or item details are not supplied, we may be unable to quote accurately or perform the delivery. We do not add you to a marketing list merely because you request a quote.
The calculator produces an illustrative estimate only. It does not automatically accept bookings, grant credit or make a decision with legal or similarly significant effects.
How long information is kept
Quote enquiries are kept while they are being handled and for any further period needed to resolve related questions or disputes. Booking, invoice and payment records are retained for the periods required by applicable accounting, tax and other legal duties, and for any relevant claims or investigation.
Where there is no fixed legal period, the retention decision takes account of the purpose, whether the booking or query remains active, any unresolved complaint, the applicable legal time limits and whether a less detailed record would suffice. Information should not be kept longer than necessary for those purposes.
Temporary pricing inputs and explicitly saved browser cost profiles are separate from stored booking and business email records. Saved profiles remain in that browser until replaced or removed by clearing this website’s browser data; staff should remove local copies and downloads when no longer needed. Technical logs held by hosting, postcode and routing providers follow those providers’ retention arrangements. For the retention criteria or period applying to a specific record, email mail@tsag.uk.
Ask about your information
Depending on the circumstances and lawful basis, you may ask for access to your information, correction of inaccurate details, deletion, restriction of use or a portable copy. Rights are subject to the legal conditions and exceptions that apply; for example, records required by law may need to be retained.
Your right to object
You may object to processing based on legitimate interests because of your particular situation. You have an absolute right to object to use of your information for direct marketing. Contact mail@tsag.uk to make an objection.
If processing ever relies on your consent, you can withdraw that consent without affecting the lawfulness of earlier use. For a rights request, describe what you need and give enough information for us to locate the relevant records. We may need proportionate identity checks, and will respond within the applicable legal time limits.
Let us know your concern
For further information or to raise a privacy complaint, email mail@tsag.uk. Tell us what happened, which information is involved and how you would like the issue addressed. You do not have to make an ordinary service complaint before exercising a data protection right.
You can also raise a concern with the UK’s data protection regulator through the Information Commissioner’s Office complaints service. Further information about your rights is available from the ICO.
This is version 1.12 of the notice, updated 5 November 2026. We will update it when the website or our relevant information-handling arrangements change.
Shipment value and contents declarations
We collect the declared monetary value of each shipment in pounds sterling and the customer’s confirmation about contents, prohibited items and restricted-item approval. We store the value, applicable goods-policy version and declaration timestamp with the booking. Office-recorded updates are logged for accountability. We use this information to assess whether we can accept the goods, plan safe handling, administer the delivery and deal with queries or claims. Declaring a value does not itself arrange insurance. The booking-record retention and rights described above apply to these declarations. Contact mail@tsag.uk for further information.