Send 247 UK Logistics LTD (company number 16098292), trading as Send247 ("Send247", "we", "our" or "us"), is the controller of the personal information described in this policy. Our registered business address is 320 City Road, London EC1V 2NZ, United Kingdom.
This policy explains how we collect, use, share and retain personal information when people use the Send247 website, mobile applications, chatbots, delivery services, customer support channels, or an AI assistant connected to the Send247 Model Context Protocol (MCP) server (together, the Services).
For privacy enquiries or to exercise your rights, contact [email protected].
1. Information we collect
Delivery and contact information
Depending on the requested service, we may collect:
- Collection and delivery addresses, postcodes, towns and counties or regions.
- Sender and recipient names and telephone numbers.
- Package size, package category, service selection and delivery instructions.
- Information supplied to coordinate collection, delivery, returns, claims or customer support.
Delivery instructions should contain only information needed to complete the delivery. Do not include payment-card details, passwords, authentication codes, government identifiers, medical information or unrelated sensitive information.
Quote, booking, tracking and payment information
We may process:
- Available delivery services, prices and currency.
- Quote references, short-lived quote-selection tokens and their expiry information.
- Delivery references, booking status, tracking events and delivery status.
- Payment links, payment status, payment references and payment expiry information.
Payment processing is provided by Stripe. Send247 does not ask users to enter complete card numbers, card security codes or bank credentials into MCP tool inputs or delivery instructions. Stripe processes payment credentials under its own privacy policy. Send247 receives payment status, references and accounting information needed to reconcile the booking.
Account and support information
Where an account is offered outside the MCP integration, we may collect the name, email address, telephone number and account-security information required to operate it. MCP delivery tools do not request account passwords, API keys or authentication codes.
If you contact us, we collect the correspondence and any information you provide to investigate and answer the enquiry.
Technical and usage information
Our systems may collect limited technical information needed to operate and protect the Services, including IP address, browser or device type, operating system, request timestamps, request or error logs, security events, and pages or functions used.
We do not use MCP interaction metadata to build advertising profiles or to monitor users across unrelated services.
Location information
With permission, our mobile applications may process precise location information where it is required to coordinate an active delivery. The Send247 MCP delivery tools request delivery addresses but do not request the user's device GPS location.
Information received from other people
A sender, business customer or person arranging a delivery may provide a recipient's name, telephone number and delivery address. An AI-assistant provider may transmit the information a user has asked it to send to Send247.
2. AI assistants and MCP integrations
When a user asks an AI assistant to use Send247, the assistant sends only the fields required by the selected MCP tool. These may include:
- Collection and delivery addresses and related postcode fields.
- Sender and recipient names and telephone numbers.
- Package size, package category and delivery instructions.
- A short-lived quote-selection token or a delivery reference.
Send247 returns the result of the requested operation to the connected assistant. Depending on the tool, the response may include:
- Available services, prices and currency.
- Quote references and short-lived quote-selection tokens.
- A delivery reference and current delivery status.
- A payment link and its expiry time.
The MCP tools do not require or request a user's complete conversation history. Text entered into a delivery-instruction field is nevertheless transmitted to Send247, so users should avoid entering unrelated personal or sensitive information.
The AI-assistant provider separately processes conversations and tool interactions under its own terms and privacy policy. Disconnecting Send247 from an assistant does not cancel a delivery or automatically erase records already created in Send247 systems.
3. Why we use information and our lawful bases
| Purpose | Information involved | Lawful basis |
|---|---|---|
| Calculate and present delivery quotes | Route, package and service information | Taking steps at the user's request before entering a contract; legitimate interests in providing accurate pricing |
| Create, manage and complete delivery requests | Addresses, contact details, package details, instructions and booking references | Performance of a contract; taking requested pre-contract steps |
| Coordinate recipients, couriers, returns and service messages | Contact, address and operational delivery information | Performance of a contract; legitimate interests in completing and supporting the delivery |
| Process and reconcile payments | Booking, payment-status and accounting references | Performance of a contract; legal obligations relating to accounting and taxation |
| Provide tracking and delivery status | Delivery reference, status and tracking events | Performance of a contract; legitimate interests in providing operational visibility |
| Prevent fraud, secure systems and diagnose failures | Technical logs, IP address, request metadata and security events | Legitimate interests in protecting users, Send247 and the Services; legal obligations where applicable |
| Answer enquiries and manage claims or disputes | Correspondence and relevant delivery or payment records | Performance of a contract; legitimate interests in customer support and establishing, exercising or defending legal claims |
| Meet legal, regulatory and accounting requirements | Transaction, delivery and payment records | Legal obligation |
| Send marketing communications where permitted | Contact information and communication preferences | Consent, or legitimate interests where permitted by law; users may opt out at any time |
| Process precise app location during an active delivery | Device location and delivery information | Consent where required; performance of the requested delivery service |
Where we rely on legitimate interests, we consider whether the processing is necessary and whether those interests are overridden by an individual's rights.
4. Who receives information
We may disclose only the information necessary for the relevant purpose to:
- Send247 personnel: authorised operations, support, finance, engineering and compliance personnel.
- Couriers and delivery partners: the contact, address, package and instruction information required to arrange or complete the delivery.
- Payment providers: Stripe receives the information required to process or reconcile payments.
- Technology providers: hosting, database, communications, monitoring, security, analytics and support providers that process information on our instructions.
- AI-assistant providers: the connected assistant receives the MCP tool result so that it can respond to the user.
- Professional advisers and authorities: accountants, insurers, legal advisers, regulators, courts or law-enforcement authorities where necessary or legally required.
- A successor organisation: if Send247 is involved in a merger, financing, acquisition, reorganisation or sale of assets, subject to appropriate confidentiality and data-protection requirements.
We do not sell personal information. We do not share delivery information with third parties for their independent advertising purposes.
5. International transfers
Some technology or AI-assistant providers may process information outside the United Kingdom. Where UK data-protection law requires safeguards, we use an applicable adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism.
Users should review the privacy policy of their chosen AI-assistant provider for information about where that provider processes conversations and tool interactions.
6. How long we keep information
We retain personal information only for as long as it is needed for the purposes described above, including legal, accounting, fraud-prevention and dispute-resolution requirements.
| Information | Retention period |
|---|---|
| Quote-selection tokens and temporary checkout-access records | Up to 10 minutes, or until the displayed expiry time if earlier |
| Unpaid, expired or abandoned delivery requests | 30 days after the payment deadline or last activity, unless needed for fraud prevention, a complaint, a dispute or a legal obligation |
| Completed or cancelled delivery records, including relevant contact, address, package, status and payment-reference information | 6 years from the end of the company financial year in which the delivery was completed or cancelled |
| Accounting and payment-reconciliation records | 6 years from the end of the company financial year to which they relate, or longer where legally required |
| General support enquiries not connected to a claim or dispute | 24 months after the last substantive communication |
| Claims, complaints and disputes | 6 years after closure, or longer while a legal hold, regulatory investigation or legal proceeding applies |
| Application, gateway, diagnostic and security logs | Up to 30 days, unless a specific security incident or legal requirement requires the relevant record to be isolated and retained longer |
| Raw precise-location information used for an active delivery | Up to 90 days after completion, unless it is required for a claim, dispute, security investigation or legal obligation |
| Marketing contact information | Until consent is withdrawn, the user opts out, or after 24 months without engagement, whichever occurs first |
| Marketing suppression record | For as long as reasonably necessary to ensure that an opt-out continues to be respected |
| Backups | Up to 14 days |
When a retention period ends, we delete or anonymise the information. Anonymous statistics that can no longer identify a person may be retained for service analysis.
Backups are access-restricted and are used only for security and disaster recovery. Information deleted from active systems may remain in a backup until that backup expires, for no longer than 14 days. If a backup is restored, applicable deletion requests and retention rules are reapplied.
7. User choices and privacy rights
Depending on the circumstances, individuals may have the right to:
- Request access to their personal information.
- Request correction of inaccurate or incomplete information.
- Request deletion of information when the right applies.
- Request restriction of processing.
- Object to processing based on legitimate interests.
- Receive certain information in a portable format.
- Withdraw consent without affecting processing that occurred before withdrawal.
- Opt out of direct marketing at any time.
- Complain to the UK Information Commissioner's Office.
To exercise these rights, email [email protected]. We may request proportionate information to confirm identity and protect delivery records from unauthorised access. We normally respond within one month, subject to lawful extensions.
The right to deletion is not absolute. We may retain limited information where it remains necessary for legal obligations, accounting, fraud prevention, or establishing, exercising or defending legal claims. If we cannot fulfil a request, we will explain why and identify available complaint rights.
Marketing messages may be stopped by using the unsubscribe mechanism in the message or contacting us. Cookie choices can be managed through the available consent controls and browser settings.
Individuals may complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/.
8. Security
We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or destruction. Access is limited according to operational need. No internet transmission or storage system can be guaranteed to be completely secure.
9. Children
The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn that such information has been collected, we will take appropriate steps to delete it.
10. Cookies and similar technologies
The website may use cookies and similar technologies needed for core operation, security, preferences and, where enabled, analytics. Users can manage non-essential cookies through available consent controls and can also use browser settings. Disabling essential cookies may prevent parts of the Services from working correctly.
11. Third-party services
The Services may contain links to third-party websites or services. Those third parties process information under their own privacy notices, and Send247 is not responsible for their independent privacy practices.
12. Changes to this policy
We may update this policy when our Services, data practices or legal obligations change. We will publish the updated version on this page and change the "Last updated" date. Where required, we will provide additional notice.
13. Contact us
Send 247 UK Logistics LTDCompany number: 16098292
320 City Road
London EC1V 2NZ
United Kingdom
Privacy enquiries and rights requests: [email protected]