Privacy Policy
June 28th, 2026
1. Introduction
This Privacy Policy is provided by Malooba Ltd, a company incorporated and registered in England and Wales with company number 05867652 and registered office at 4 Scarne Court, Hurdon Road, Launceston, Cornwall, PL15 9LR (“Malooba”, “we”, “our” or “us”). It explains how we collect and use personal data in connection with the public website at malooba.com (Website), enquiries and business communications, recruitment, contractor onboarding or engagement enquiries, service and administrative communications, and our operational activities as a delivery service partner / logistics business.
For the website, business, recruitment, contractor administration and Malooba-controlled operational data described in this Privacy Policy, Malooba acts as the controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where personal data is held solely by another principal platform, a third-party logistics platform, recruitment platform, background-check provider, payroll/accounting provider or other third party, that third party may act as an independent controller or otherwise process data under its own terms and privacy notice. This Privacy Policy does not replace those third-party notices.
We take your privacy very seriously. Please read this privacy policy carefully as it contains important information on how and why we collect, store, use and share any information relating to you (your personal data).
It also explains your rights in relation to your personal data and how to contact us or the relevant regulator in the event you have a complaint. Our collection, storage, use and sharing of your personal data is regulated by law, including under the UK GDPR and the Data Protection Act 2018.
2. What this policy applies to
This privacy policy relates to (a) your use of our Website and online contact forms, (b) enquiries, recruitment, contractor onboarding or engagement enquiries, account and business administration, service communications and other business communications, and (c) personal data processed by Malooba for its own operational, administrative and compliance purposes in a delivery service partner/logistics environment.
The Website and our business operations may link or redirect to, or rely on, websites, apps, portals, recruitment and onboarding platforms, other principal-platform systems, logistics and route-management systems, background-check providers, accounting, payment, analytics, communications and other services owned and operated by third parties. Those third parties may gather and use information about you in accordance with their own terms and privacy policies. Please consult their privacy information as appropriate. For more information see the section ‘Who we share your personal data with’ below.
3. Personal data we collect about you
The personal data we collect about you depends on how you interact with us and the services you request, provide or receive. We may collect personal data directly from you, from your business, from website contact forms, recruitment or onboarding channels, other principal-platform systems, third-party logistics or communications platforms, background-check providers, payment/accounting providers and other third parties where relevant and lawful. This includes:
3.1 Identity, contact and business relationship data
Name, business name, job title, role, email address, mobile/telephone number, postal address, company or trading details, account identifiers, usernames, authentication information and other identifiers needed to administer enquiries, recruitment or contractor engagement, business relationships, service communications and operations.
If you use another principal-platform system, a logistics, recruitment, onboarding, communications or other service platform, your account access details, authentication information, platform identifiers, service settings and related activity information may be processed by us where we control that processing, and by the relevant platform or service provider in accordance with its own terms and privacy information.
Your preferences, feedback, survey responses and communications preferences, where you choose to provide them.
3.2 Website, enquiry, recruitment, contractor and service data
Information you submit via our Website contact forms or other enquiry channels, such as name, business name, email address, telephone number, message content and enquiry requirements. We may also process recruitment or contractor engagement enquiries, onboarding administration data, eligibility-to-work and identity-check information where relevant, vehicle or insurance information where relevant to an engagement, billing and payment administration data, service or admin communications, correspondence and records of requests you make to us.
3.3 Technical and usage data collected automatically
Your activities on, and use of, the Website and related online services, including pages viewed and times of access.
Tracking information such as IP address, cookie identifiers, browser type and version (user agent), device information, session identifiers, referral URLs and basic analytics information. Where enabled, we may also collect approximate location derived from IP address. Operational systems used in a delivery service partner / logistics environment may also generate route, delivery status, incident, performance, safety, communications, device and app-usage data, but data held solely by another third-party platform is subject to that platform’s own terms and privacy notice.
3.4 Data collected when you contact us or communicate with us
Your name, business name, job title, email address, mobile/telephone number, the contents of your communications with us, enquiries, recruitment or contractor engagement communications, account or payment queries, service and administrative communications, incident or operational communications, and any documents or information you or your business send to us by email, messaging, platform, telephone or other agreed channel.
3.5 Marketing and communications data
Your preferences in receiving marketing or updates from us and your communication preferences.
We may also collect, use and share aggregated and anonymised data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity. For example, we may aggregate Website usage data to analyse trends and improve the Website and our services.
We collect and use this personal data for the purposes described in the section ‘How and why we use your personal data’ below.
4. Sensitive data
Sensitive personal data (also known as special category data) means information related to personal data revealing racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic data; biometric data (where used for identification purposes); data concerning health; and data concerning a person’s sex life; and data concerning a person’s sexual orientation. Malooba’s Website and ordinary business communications are not designed to collect special category data from website users. However, we may incidentally receive such data if you choose to include it in a message, recruitment or contractor engagement enquiry, incident report or other communication, or where health, safety, right-to-work, accessibility or similar information is relevant and lawful for recruitment, contractor administration or operational purposes.
We do not request special category data for ordinary website enquiries, marketing or business administration purposes. If we process special category data as controller, we will do so only where we have a lawful basis under Article 6 UK GDPR and a special category condition under Article 9 UK GDPR, and with appropriate technical and organisational safeguards. Where special category data is held solely by another third-party platform, the relevant third party is responsible for explaining its own processing in its privacy information.
Please do not provide special category data through the Website contact forms or general enquiry channels unless it is necessary for your enquiry or request. If you voluntarily provide health or other special category data to us, including by email or as part of a recruitment, contractor engagement, incident, safety or accessibility-related communication, we will handle it in accordance with this Privacy Policy and applicable law where we act as controller, and will direct you to relevant third-party privacy information where another platform controls the processing.
5. How your personal data is collected
We use different methods to collect data from and about you including through:
Your interaction with us: We collect personal data from you directly when you contact us, submit enquiries, use our Website, apply for or enquire about roles or contractor opportunities, provide onboarding or engagement information, subscribe to communications, send or receive service or administrative communications, pay or receive payments, or otherwise correspond with us (including by email, telephone, messaging, platform channel or online meeting). We may also collect personal data from your business or another principal platform, recruitment and onboarding providers, background-check providers, payment/accounting providers, logistics, communications and route-management platforms, insurers and other third parties where necessary and lawful for our business and operations.
Automated technologies or interactions: As you interact with the Website, we will automatically collect technical data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs, analytics tools and other similar technologies. Where required, we will ask for your consent to non-essential cookies or similar technologies. Further details should be provided through our cookie notice or cookie management tool.
6. How and why we use your personal data
Under data protection law, personal data may only be processed where there is a lawful basis. For Malooba’s own website, enquiry, business communication, recruitment, contractor administration, service administration, marketing and Malooba-controlled operational data, we usually act as controller and rely on one or more of the following lawful bases:
where you have given consent, including consent to particular communications or optional processing
to comply with our legal, tax, accounting, company, regulatory, health and safety, employment-status, right-to-work, insurance and record-keeping obligations
for the performance of a contract with you or your business or to take steps at your request before entering into a contract or engagement, including responding to enquiries, assessing recruitment or contractor engagement opportunities, administering onboarding, providing services, service communications, support, payments and billing, or
for our legitimate interests or those of a third party
A legitimate interest is when we have a business, service administration, security or operational reason to use your information, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own. You can obtain details of this assessment by contacting us (see ‘How to contact us’ below). Where we process special category data as controller, we will also identify an Article 9 UK GDPR condition where required, such as explicit consent, compliance with employment, health and safety or legal obligations, reasons of substantial public interest, or the establishment, exercise or defence of legal claims. Where personal data is controlled by another third-party platform, the relevant third party is responsible for identifying its own lawful basis and providing privacy information for its processing.
The sections below explain what we use your personal data for and why.
6.1 To handle website enquiries, business communications, recruitment or contractor engagement enquiries, account access and service administration
To perform our contract with you or your business or to take steps at your request before entering into a contract; to comply with legal obligations; and, where appropriate, for our legitimate interests in administering services securely and efficiently.
6.2 To provide and administer Malooba’s business and DSP/logistics operations, including contractor onboarding or engagement administration, route and delivery-related administration, incident and service communications, payments or billing administration, support and related operational communications where Malooba controls the processing
To perform our contract with you or your business or to take steps at your request before entering into a contract; to comply with legal, tax, accounting and regulatory obligations; and for our legitimate interests in providing, maintaining, improving and securing our services.
6.3 To enforce legal rights or defend or undertake legal proceedings
Depending on the circumstances:
to comply with our legal and regulatory obligations
in other cases, for our legitimate interests or those of a third party, i.e. to protect our business, interests and rights or those of others
6.4 Sending relevant marketing, recruitment, business development or update communications about Malooba and its services (where permitted)
Depending on the circumstances:
where required by law, consent;
otherwise, our legitimate interests to promote and grow our business (subject to your right to opt out and applicable marketing rules, including PECR).
6.5 To carry out service evaluation, feedback, contractor engagement review and quality improvement through your voluntary participation in surveys or feedback requests
Necessary for our legitimate interests to understand how website users, business contacts, applicants, contractors and service partners interact with Malooba, and to help us improve and develop our Website, communications, support, operations and engagement experience.
6.6 Communications with you not related to marketing, including recruitment, onboarding, contractor engagement, account, payment, operational, safety, security, policy, Website, platform and important service or administrative notices
Depending on the circumstances:
to comply with our legal and regulatory obligations;
to perform our contract with you (where applicable);
or for our legitimate interests in providing support and operating our business.
6.7 To protect the security of systems and data
To comply with our legal and regulatory obligations and, where appropriate, for our legitimate interests in protecting systems and data and preventing and detecting fraud and other criminal activity.
6.8 Operational reasons, such as account administration, secure record keeping, service delivery, staff or contractor support, training, quality control, supplier management, route or delivery administration, incident handling and responding to enquiries or support requests
For our legitimate interests in operating an efficient, reliable and secure DSP/logistics business; to perform our contract with you or your business where applicable; and to comply with legal, tax, accounting, health and safety, insurance and regulatory obligations.
6.9 Statistical analysis to help us manage our business, e.g., in relation to Website use, enquiry trends, recruitment or contractor engagement activity, platform use, operational performance, service development and efficiency measures
For our legitimate interests in understanding and improving our Website, business communications, recruitment or contractor engagement processes, services and operational efficiency, using anonymised or aggregated data where possible.
6.10 Updating and maintaining website enquiry, business contact, recruitment, contractor engagement, service, payment, accounting, operational, compliance and business administration records
Depending on the circumstances:
to perform our contract with you or your business;
to comply with legal, regulatory, accounting and tax obligations;
and for our legitimate interests in maintaining accurate records and delivering our services.
6.11 To comply with our legal, tax, accounting, company, regulatory and record-keeping obligations (including responding to lawful requests and maintaining appropriate business records)
To comply with our legal, tax, accounting, company, regulatory and record-keeping obligations.
To support corporate governance and, where necessary, to share information in connection with a significant corporate transaction or restructuring.
6.12 To share your personal data with members of our group and third parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale or in the event of our insolvency. In such cases, information will be shared only where necessary and, where possible, anonymised or aggregated.
Depending on the circumstances:
to comply with our legal and regulatory obligations
in other cases, for our legitimate interests or those of a third party, i.e., to protect, realise or grow the value in our business and assets
See ‘Who we share your personal data with’ for further information on the steps we will take to protect your personal data where we need to share it with others.
7. Marketing
We may send you communications about our services, service updates and insights, and (where permitted) promotional offers.
Where required by law (including under PECR), we will obtain your consent before sending you direct marketing. Where consent is not required, we may send marketing on the basis of our legitimate interests, and you can opt out at any time. We maintain records of your marketing preferences.
You will have the right to opt out of receiving marketing communications at any time by:
contacting us at privacy@malooba.com or any updated contact address published on our Website
using the ‘unsubscribe’ link included in all marketing emails you may receive from us
We will not sell your personal data to third parties for their own direct marketing purposes.
For more information on your right to object at any time to your personal data being used for marketing purposes, see ‘Your rights’ below.
8. Who we share your personal data with
We share personal data only where necessary for the purposes set out in this Privacy Policy. This may include sharing information with website hosting, cloud infrastructure, email, communications, analytics, payment, accounting and invoicing providers; recruitment, onboarding, background-check, insurance, fleet, logistics, route-management, incident-management and operational platforms; or another principal platform where required by the applicable DSP or service framework; IT security and backup providers; subcontractors, suppliers and professional advisers needed to operate and protect our Website, business and operations.
We only allow service providers to handle your personal data if we are satisfied, they take appropriate measures to protect your personal data. We also impose contractual obligations on service providers to ensure they can only use your personal data to provide services to us and to you.
We or the third parties mentioned above may occasionally also need to share your personal data with:
external auditors, e.g. in relation to the audit of our accounts and our company — the recipient of the information will be bound by confidentiality obligations
professional advisors (such as lawyers and other advisors) — the recipient of the information will be bound by confidentiality obligations
law enforcement agencies, courts or tribunals and regulatory bodies to comply with legal and regulatory obligations
other parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency-information will be shared only where necessary and, where possible, anonymised or aggregated; the recipient of the information will be bound by confidentiality obligations
If you would like more information about who we share our data with and why, please contact us (see ‘How to contact us’ below).
We do not share your personal data with third parties except as described in this Privacy Policy or where required or permitted by law.
9. How long your personal data will be kept
We will keep personal data for as long as necessary for the purposes set out in this Privacy Policy, including to respond to enquiries, administer recruitment or contractor engagement, provide and administer services, manage our relationship with you and your business, maintain accurate operational and business records, comply with legal, regulatory, accounting, tax, health and safety, insurance and record-keeping obligations, and establish, exercise or defend legal claims. Retention periods may differ depending on the type of record and whether a record relates to website enquiries, recruitment, contractor onboarding or engagement, right-to-work or identity checks, service or administrative communications, payment or accounting records, Website administration, marketing preferences, security logs, operational incidents, delivery-related administration or legal claims. Unless a longer or shorter period is required by law or needed for a particular purpose, we expect to retain core contract, engagement, payment, accounting and business correspondence records for six years after the end of the relevant relationship, and enquiry, recruitment or contractor engagement prospect records for approximately two years. Data held solely by another third-party platform may be retained under that third party’s own terms and privacy notice, and Malooba may not be able to delete or provide access to data controlled solely by that third party.
Following the end of the applicable retention period, we will delete or anonymise personal data in accordance with applicable data protection requirements, unless we are required to retain it (for example, due to legal obligations or a legal hold).
10. Transferring your personal data out of the UK
We aim to use service providers that process personal data in the UK or other jurisdictions with appropriate protections. We may transfer your personal data outside the UK where our service providers, platforms, email, cloud, recruitment, onboarding, logistics, support or communications providers process data in other countries, or where another principal or third-party platform processes data internationally under its own arrangements. Where Malooba controls the transfer, we will ensure appropriate safeguards are in place to protect your personal data, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, a transfer risk assessment (TRA), an adequacy regulation, or another lawful transfer mechanism under UK data protection law.
Furthermore, under UK data protection laws, we can only transfer your personal data to a country outside the UK where: the UK government has decided the particular country ensures an adequate level of protection of personal data (known as an ‘adequacy regulation’) further to Article 45 of the UK GDPR; there are appropriate safeguards in place (such as the IDTA and, where relevant, the UK Addendum to the EU Standard Contractual Clauses), together with enforceable rights and effective legal remedies for you; or a specific exception applies under relevant data protection law.
The EEA: we may rely on the UK adequacy regulations in respect of EEA countries (where applicable).
Other countries: we will put in place appropriate safeguards (such as the IDTA and, where required, a TRA) and other measures required by UK data protection law.
In the event we could not or choose not to continue to rely on either of those mechanisms at any time we would not transfer your personal data outside the UK unless we could do so on the basis of an alternative mechanism or exception provided by UK data protection law.
11. Your rights
You generally have the following rights, which you can usually exercise free of charge. These rights may be limited in some circumstances, including where we must keep information for legal, regulatory, accounting, tax, health and safety, insurance, security or contractual reasons, where the request relates to data controlled solely by another third-party platform, or where the rights of another person are affected. For more information regarding these rights, please visit the ICO website here.
11.1 Access to a copy of your personal data
The right to be provided with a copy of your personal data.
11.2 Correction (also known as rectification)
The right to require us to correct any mistakes in your personal data.
11.3 Erasure (also known as the right to be forgotten)
The right to require us to delete your personal data in certain situations.
11.4 Restriction of use
The right to require us to restrict use of your personal data in certain circumstances, e.g. if you contest the accuracy of the data.
11.5 Data portability
The right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party in certain situations.
11.6 To object to use
The right to object:
at any time to your personal data being used for direct marketing (including profiling)
in certain other situations to our continued use of your personal data, e.g. where we use your personal data for our legitimate interests.
11.7 Not to be subject to decisions without human involvement
The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you
For further information on each of those rights, including the circumstances in which they do and do not apply, please contact us (see ‘How to contact us’ below). You may also find it helpful to refer to the guidance from the UK’s Information Commissioner on your rights under the UK GDPR.
If you would like to exercise any of those rights, please email or write to us, see below: ‘How to contact us’. We will handle subject access requests and other rights requests in accordance with UK data protection law. We may need to verify your identity and, where relevant, consider the rights and confidentiality of applicants, contractors, staff, customers, business contacts, service partners, suppliers and other individuals before responding. If your request relates to personal data controlled solely by another third-party platform, we may direct you to that third party’s rights-request process or privacy notice. When contacting us please:
provide enough information to identify yourself (e.g., your full name, contact details and any relevant platform, applicant, contractor or engagement identifiers) and any additional identity information we may reasonably request from you, and
let us know which right(s) you want to exercise and the information to which your request relates
12. Keeping your personal data secure
We have implemented appropriate technical and organisational security measures designed to protect your personal data. Access to personal data is restricted to authorised staff, contractors and service providers on a need-to-know basis, and we maintain policies and controls designed to protect against unauthorised access, alteration, disclosure or loss of personal data. Personal data may be held in our Website, email, recruitment, onboarding, accounting, communications, logistics, operational, backup and business administration systems, and by relevant service providers that support those systems. Where staff or contractors use personal devices for business communications or operational purposes, they are expected to use those devices responsibly, follow Malooba’s reasonable instructions, keep devices and access credentials secure, use available security features such as passcodes and updates, and promptly report loss, theft or suspected unauthorised access. Third-party platforms may also apply their own device, app and security requirements.
We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
If you want detailed information from Get Safe Online on how to protect your information and your computers and devices against fraud, identity theft, viruses and many other online problems, please visit www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.
13. How to complain
Please contact us if you have any queries or concerns about our use of your information (see below ‘How to contact us’). We hope we will be able to resolve any issues you may have.
You also have the right to lodge a complaint with the Information Commissioner.
The Information Commissioner can be contacted at https://ico.org.uk/make-a-complaint or telephone: 0303 123 1113.
14. Changes to this privacy policy
We may change this privacy policy from time to time to reflect updates in our Website, services, operations, third-party platform arrangements, processing activities, or regulatory requirements. Where appropriate, we will take steps to bring any significant changes to your attention, for example by posting an updated version on the Website and/or contacting you
15. How to contact us
You can contact us by post or email if you have any questions about this privacy policy, the information we hold about you, to exercise your rights under data protection law, or to make a complaint.
Our contact details are shown below:
Malooba Ltd., company number 05867652 and having its registered office at 4 Scarne Court, Hurdon Road, Launceston, Cornwall, PL15 9LR
privacy@malooba.com