Privacy Policy

Last updated: 21 October 2026

1. Who we are

NordPath Ltd operates this website and provides services through NordPath Logistics and NordPath Critical. Both divisions form part of the same company.

Company number: 16607833, registered in England and Wales.

Registered office: Grafton House, 81 Chorley Old Road, Bolton, BL1 3AJ.

Email: info@nordpath.co.uk

Website: https://www.nordpath.co.uk

This policy explains how we handle personal information relating to website visitors, people making enquiries, customers, collection and delivery contacts, applicants, drivers, subcontractors and business partners.

NordPath Ltd is the controller where we decide why and how personal information is used. For some work carried out on behalf of a carrier or another customer, we handle delivery information under that organisation’s instructions. Its privacy information may also apply. If a request concerns information controlled by another organisation, we will explain this and help direct the request appropriately.

2. Information we collect and where it comes from

We receive information directly from you through forms, email, telephone calls and other business communications. We may also receive information from customers, carrier partners, senders, recipients, referees and service providers where needed for the relevant work.

Depending on your relationship with us, the information may include:

• Contact and business details: your name, company, role, email address, telephone number and business address.

• Enquiry and quotation details: collection and delivery locations, preferred dates and times, descriptions of goods, dimensions, weight, access requirements and the support you are seeking.

• Transport records: booking references, instructions, collection and delivery contacts, service updates, incident records and digital proof-of-delivery information.

• Vehicle information, where camera or location systems are used for our work: relevant vehicle positions or footage needed for safety, security, incident investigation or service coordination. Additional information about monitoring arrangements is provided to affected drivers and other people where required.

• Applicant and driver information: contact details, work history, references, driving entitlement, vehicle information, insurance evidence and identity or eligibility information relevant to the proposed role or engagement.

• Financial and supplier information: invoices, payment records, bank details and information needed to administer a customer or supplier relationship.

• Correspondence: questions, complaints, feedback and records of our communications with you.

• Technical information: IP address, browser and device information, pages requested, security logs and cookie or preference information, subject to the choices described in our Cookie Policy.

Only provide information about another person where you are entitled to do so. Please give collection and delivery contacts access to this policy where appropriate. Do not include payment card details, identity documents, medical information or criminal-record information in a general website enquiry.

3. How we use information and our lawful bases

We use personal information for the following purposes:

Enquiries and quotations

We use contact and job details to understand requirements, prepare a response and discuss potential work. Our basis is taking steps at your request before entering a contract where you would be the contracting party. Where you represent a company, our basis is our legitimate interest in responding to business enquiries and arranging services.

Providing and coordinating transport

We use the information needed to plan collections, communicate with relevant contacts, complete deliveries, record handovers and deal with changes or problems. Our basis is performance of a contract with you, or our legitimate interest in delivering services to a business customer and coordinating with its contacts. Where we act as a processor, we follow the relevant controller’s lawful instructions.

Driver, subcontractor and supplier engagement

We assess suitability, verify relevant credentials, communicate about opportunities and administer working relationships. Our bases are steps towards or performance of a contract with the individual, legitimate interests in selecting and managing suitable providers, and legal obligations where a particular check or record is legally required. A contractual customer requirement is not automatically a legal obligation.

Accounts, insurance and legal requirements

We maintain accounting records, administer payments, handle insurance matters and meet applicable legal duties. Our bases are legal obligations, contract performance where relevant, and legitimate interests in managing accounts and establishing, exercising or defending claims.

Safety, security and complaints

We use relevant records to investigate incidents, protect people and property, maintain secure systems and respond to complaints. Our bases are legal obligations where applicable and legitimate interests in safe operations, prevention of misuse and fair resolution of issues.

Website measurement and optional communications

We use optional analytics cookies in accordance with the consent choices described in our Cookie Policy. If we ask to send optional marketing communications on a consent basis, we will explain that choice separately. You can withdraw consent or ask us to stop direct marketing at any time. An operational reply to an enquiry is not a marketing subscription.

Where we rely on legitimate interests, we consider whether the use is necessary and proportionate and how it affects your rights and expectations.

4. DBS checks and sensitive information

Driver vetting can involve DBS check information. Criminal-record information receives additional protection under data protection law. A DBS check is not security clearance or a guarantee of future conduct.

We limit checks and the information recorded to what is relevant and lawful for the engagement. Information explaining the check, the applicable lawful basis, any additional condition required under the Data Protection Act 2018 and the retention arrangements will be provided during the relevant onboarding process before that information is collected. Access is restricted to those who need it for their work.

If health or other particularly sensitive information is needed for a specific safety, accessibility or legal purpose, we will explain the purpose and the additional legal condition that applies. Please contact us before sending such information through a general form.

5. Who information may be shared with

Where necessary for the purpose concerned, recipients may include:

• Authorised staff and drivers who need the information to carry out their work.

• Customers, carrier partners and collection or delivery contacts involved in a movement.

• Relevant subcontractors and operational providers involved in an agreed service.

• Squarespace and providers of hosting, email, document storage, operational systems and technical support.

• Accountants, professional advisers, insurers and claims handlers.

• Vetting or verification providers where a relevant check is carried out lawfully.

• Regulators, courts, law enforcement or other public bodies where disclosure is required or justified by law.

We limit disclosures to the information needed for the purpose. Providers processing information on our behalf must be subject to appropriate contractual and security requirements. Other organisations, such as a carrier, insurer or regulator, may be controllers for their own activities.

We do not sell personal information.

6. Website services and international transfers

Our website is hosted by Squarespace. Pages also load images from Squarespace’s content network and fonts from Google Fonts. Loading these resources involves a connection from your browser to the provider and can disclose technical information such as your IP address and browser details. This is separate from whether an optional analytics cookie has been accepted.

Some providers may store or access information outside the UK. Where a restricted international transfer occurs, we use the arrangements required by UK data protection law. Depending on the provider and destination, these may include UK adequacy arrangements or approved contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum, with any necessary assessment and additional protections.

Contact info@nordpath.co.uk for further information about the providers, destinations and safeguards relevant to your information, including how to obtain a copy of applicable safeguards, subject to legitimate confidentiality restrictions.

7. How long we keep information

Retention depends on the purpose, the relationship, legal requirements and whether a complaint, incident or claim remains unresolved.

• Enquiries and unsuccessful quotations are kept only while needed for the enquiry, reasonable follow-up and any related issue. We review whether continued retention is justified once the enquiry is closed.

• Customer, booking and delivery records are kept for the relationship and any further period needed for contractual, insurance, accounting or legal purposes. A delivery contact’s details are not kept indefinitely merely because a job took place.

• Company accounting records are generally retained for at least six years from the end of the financial year to which they relate, and longer where a legal requirement or active matter requires it.

• Applicant records are kept while considering the application and for a proportionate period afterwards to handle related queries or claims. If we wish to keep details for future opportunities, we will explain the arrangement.

• Driver and subcontractor records are kept while needed to manage the engagement and meet relevant legal, insurance or contractual duties afterwards. Vetting records are subject to more restricted access and retention; certificate information is not kept simply because other engagement records remain necessary.

• Where camera or location records are used, retention is limited by the purpose, the system’s overwrite settings and any incident or claim requiring relevant evidence to be preserved. Access to retained evidence is restricted.

• Security and technical records are retained for the period needed to secure and troubleshoot the relevant service. Cookie durations are explained in our Cookie Policy.

Information needed for an active complaint, legal hold, investigation or claim may be retained until the matter and relevant obligations are resolved. We then delete it securely or anonymise it where appropriate. You can ask us about the retention criteria applicable to a particular record.

8. Security

We use proportionate technical and organisational measures to protect personal information, including restricting access to those who need it for their role and using suitable service providers and account protections. No website, transmission method or storage system can be guaranteed completely secure.

9. Your rights

Depending on the circumstances and any applicable exemptions, you may have rights to:

• Receive information about our use of your personal information and request access to it.

• Ask us to correct inaccurate or incomplete information.

• Request deletion or restriction of processing.

• Object to processing based on legitimate interests, and object to direct marketing at any time.

• Receive certain information in a portable format where the legal conditions are met.

• Withdraw consent where we rely on it, without affecting earlier lawful processing.

• Exercise applicable rights concerning significant decisions made solely by automated means.

Our website quotation enquiries are reviewed by our team; submitting a form does not create an automatically confirmed booking.

To exercise a right, email info@nordpath.co.uk or write to our registered office. We may request proportionate information to verify identity or authority. We normally respond within one month, subject to the extensions and timing rules permitted by law, and will explain any lawful extension or refusal. Requests are normally free of charge.

10. Questions and complaints

You can raise a privacy question or complaint by emailing info@nordpath.co.uk, using “Data protection complaint” as the subject if helpful, or by writing to our registered office. You do not have to use a particular form of words.

We will acknowledge a data protection complaint within 30 days, take appropriate steps to investigate without undue delay, keep you informed and explain the outcome. A request to exercise a data protection right has its own applicable time limit.

You can also complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/.

11. Related information and changes

Our Cookie Policy is available at https://www.nordpath.co.uk/cookies.

This policy may be supplemented by information given for a particular engagement or processing activity. We will update it when our activities or requirements change and provide any additional information required before using information for a new purpose. The latest revision date appears above.