Privacy Policy
Version 2.0 · last updated 15 September 2026
The short version
If we are delivering a parcel to you, we did not get your details from you — we got them from the shop you ordered from. We use them to bring you your parcel, to tell you when it is coming, and to prove it arrived. We keep the record for six years, mainly because tax and disputes need it. We do not sell your information and we do not use it to advertise to you. You can ask us what we hold, ask us to correct or delete it, and object to us using it. Email matt@quiver.co.uk and it comes to a person.1. Who we are
Quiver is operated by Quiver Solutions Limited, company number 16961611, registered at 27 Old Gloucester Street, London, England, WC1N 3AX. We are the controller of the information described here and we are registered with the Information Commissioner's Office under number ZC243618.
This notice covers two groups of people: the people we deliver to, and the people we deal with at the merchants we deliver for. Most of it applies to both, and section 12 covers what is different for merchants. Couriers who work through the Quiver app are covered by a separate notice at quiver.co.uk/courier-privacy-policy.2. Information we collect
If we are delivering to you: your name, delivery address, email address and telephone number; the order and its contents as described to us by the merchant; the delivery instructions you or the merchant gave; the time of delivery and its outcome; the messages and calls between you and the courier; and, where one is taken, a photograph of the parcel at the delivery point or a signature.
If you work for a merchant: your name, work email address and telephone number, your role, the addresses we collect from and deliver to, and the record of what was booked, delivered and invoiced.
We do not ask for and do not want special category information — health, ethnicity, beliefs, and the rest. Please do not put any of it in a delivery instruction.3. Where your information comes from
If we are delivering to you, your information comes from the merchant you ordered from, not from you. They pass it to us so that we can carry out the delivery. Some of it is then added by us or by the courier in the course of the delivery — the time, the outcome, any photograph or signature, and anything you tell the courier or tell us through the tracking page.
If you work for a merchant, your information normally comes from you or from a colleague when the account is set up. Some merchant contact details reached us from Quiver Delivery Ltd, the company that ran this business before us and which went into liquidation in April 2026.4. How we use your information
To plan the route and get the parcel to the right place; to tell you when it is due and let you follow it; to let the courier contact you, and you the courier; to record that the delivery happened, and to settle it if someone says it did not; to invoice the merchant; to answer questions and complaints; to keep the service secure and working; and to meet our legal obligations, including tax.
We do not sell your information, we do not share it for anyone else's marketing, and we do not use it to profile you or to make decisions about you automatically.5. Photographs and signatures
Couriers are asked to record proof that a delivery was made. That is usually a photograph of the parcel where it was left, and it may be a signature. A photograph taken at your door is information about you, so we treat it that way.
We use it only to show the delivery happened and to resolve a dispute about it, and it is kept with the delivery record. If a photograph has caught something it should not have, tell us and we will remove it.6. Calls and messages
When a courier needs to reach you, the call or message goes through a masking service so that the courier does not see your personal number and you do not see theirs. The service that does this is Twilio, and it necessarily receives both numbers and the record of the call or message.7. Our lawful bases
For delivering to you, our basis is legitimate interests — ours and the merchant's in getting you the thing you ordered, and yours in receiving it. We rely on legitimate interests and not on consent, because your details came to us from the merchant and because we could not stop delivering a parcel that is already on its way if consent were withdrawn. Saying otherwise would give you a control that is not real. What you do have is the right to object, which is set out in section 11.
For merchant accounts, the basis is performance of a contract with the merchant, and legitimate interests in running and improving the service. For keeping records that tax and accounting law require, the basis is legal obligation.
The previous version of this notice said the basis was consent. That was wrong, and it was corrected on 15 September 2026.8. Who receives your information
Your information is handled by the courier making the delivery, and by the merchant, who is a separate controller of the information they hold about their own customers. Beyond that it reaches only suppliers who process it for us on our instructions and may not use it for their own purposes:
Amazon Web Services, which hosts our systems. Doorstep AI, which tells the courier when they have reached the delivery point, and which receives the delivery address in order to do so. Twilio, for the calls and messages described in section 6. Sentry and PostHog, which tell us when something breaks and how the service is being used. At times of peak demand we may also use another delivery company, in which case they receive what they need to complete the delivery.
We will also disclose information where the law requires it, or to protect someone's safety.9. Where information is processed
Our systems and your delivery record are hosted in the United Kingdom, in Amazon Web Services' London region. Our error reporting is processed in Germany and our product analytics in the European Union, both covered by the United Kingdom's adequacy regulations.
Some of our suppliers are headquartered in the United States and may process information there. Where that happens we rely on the safeguards that United Kingdom law provides for transfers of that kind.10. How long we keep information
We keep the delivery record — what was delivered, where, when, by whom, and the evidence that it arrived — for six years from the date of the delivery. Six years is the period in which someone can generally bring a claim about it, and it is the period our tax and accounting records have to cover. After that we delete it or strip it of anything that identifies you.
Merchant account information is kept for as long as the account is open, and then for six years for the same reasons.
If you ask us to erase your information we will do so unless we have to keep it for one of the reasons above, and we will tell you if that is the case.11. Your rights
You can ask for a copy of what we hold about you. You can ask us to correct anything wrong and complete anything missing. You can ask us to delete it. You can ask us to restrict what we do with it while something is being sorted out. You can ask for it in a portable form.
And because we rely on legitimate interests, you can object to our using your information at all. If you do, we have to stop unless we can show compelling grounds that override your objection. In practice, if a parcel is already on its way to you we will finish that delivery and explain why — and we will tell you what we have done about everything else.
None of this costs anything, and we have one month to reply. Email matt@quiver.co.uk, or write to us at 27 Old Gloucester Street, London, England, WC1N 3AX.12. If you work for a merchant
Everything above applies, with two differences. Our basis is normally the contract with your employer rather than legitimate interests, and we will contact you about the account, the deliveries and the invoices as part of running it.
We do not currently send marketing to merchant contacts. If that changes you will be told, given a way to opt out in every message, and your choice will be honoured.13. Questions and complaints
Email matt@quiver.co.uk and it reaches a person, not a queue. If you are not happy with how we have handled something you can complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, 0303 123 1113, https://www.ico.org.uk. We would rather you told us first, but you do not have to.14. Changes to this notice
This is version 2.0, last updated 15 September 2026. It replaces the notice of 10 February 2026, which was not versioned. We keep a dated copy of every version, so if you need to know what you were told at a particular time, ask us and we will send it to you.
If we are delivering a parcel to you, we did not get your details from you — we got them from the shop you ordered from. We use them to bring you your parcel, to tell you when it is coming, and to prove it arrived. We keep the record for six years, mainly because tax and disputes need it. We do not sell your information and we do not use it to advertise to you. You can ask us what we hold, ask us to correct or delete it, and object to us using it. Email matt@quiver.co.uk and it comes to a person.1. Who we are
Quiver is operated by Quiver Solutions Limited, company number 16961611, registered at 27 Old Gloucester Street, London, England, WC1N 3AX. We are the controller of the information described here and we are registered with the Information Commissioner's Office under number ZC243618.
This notice covers two groups of people: the people we deliver to, and the people we deal with at the merchants we deliver for. Most of it applies to both, and section 12 covers what is different for merchants. Couriers who work through the Quiver app are covered by a separate notice at quiver.co.uk/courier-privacy-policy.2. Information we collect
If we are delivering to you: your name, delivery address, email address and telephone number; the order and its contents as described to us by the merchant; the delivery instructions you or the merchant gave; the time of delivery and its outcome; the messages and calls between you and the courier; and, where one is taken, a photograph of the parcel at the delivery point or a signature.
If you work for a merchant: your name, work email address and telephone number, your role, the addresses we collect from and deliver to, and the record of what was booked, delivered and invoiced.
We do not ask for and do not want special category information — health, ethnicity, beliefs, and the rest. Please do not put any of it in a delivery instruction.3. Where your information comes from
If we are delivering to you, your information comes from the merchant you ordered from, not from you. They pass it to us so that we can carry out the delivery. Some of it is then added by us or by the courier in the course of the delivery — the time, the outcome, any photograph or signature, and anything you tell the courier or tell us through the tracking page.
If you work for a merchant, your information normally comes from you or from a colleague when the account is set up. Some merchant contact details reached us from Quiver Delivery Ltd, the company that ran this business before us and which went into liquidation in April 2026.4. How we use your information
To plan the route and get the parcel to the right place; to tell you when it is due and let you follow it; to let the courier contact you, and you the courier; to record that the delivery happened, and to settle it if someone says it did not; to invoice the merchant; to answer questions and complaints; to keep the service secure and working; and to meet our legal obligations, including tax.
We do not sell your information, we do not share it for anyone else's marketing, and we do not use it to profile you or to make decisions about you automatically.5. Photographs and signatures
Couriers are asked to record proof that a delivery was made. That is usually a photograph of the parcel where it was left, and it may be a signature. A photograph taken at your door is information about you, so we treat it that way.
We use it only to show the delivery happened and to resolve a dispute about it, and it is kept with the delivery record. If a photograph has caught something it should not have, tell us and we will remove it.6. Calls and messages
When a courier needs to reach you, the call or message goes through a masking service so that the courier does not see your personal number and you do not see theirs. The service that does this is Twilio, and it necessarily receives both numbers and the record of the call or message.7. Our lawful bases
For delivering to you, our basis is legitimate interests — ours and the merchant's in getting you the thing you ordered, and yours in receiving it. We rely on legitimate interests and not on consent, because your details came to us from the merchant and because we could not stop delivering a parcel that is already on its way if consent were withdrawn. Saying otherwise would give you a control that is not real. What you do have is the right to object, which is set out in section 11.
For merchant accounts, the basis is performance of a contract with the merchant, and legitimate interests in running and improving the service. For keeping records that tax and accounting law require, the basis is legal obligation.
The previous version of this notice said the basis was consent. That was wrong, and it was corrected on 15 September 2026.8. Who receives your information
Your information is handled by the courier making the delivery, and by the merchant, who is a separate controller of the information they hold about their own customers. Beyond that it reaches only suppliers who process it for us on our instructions and may not use it for their own purposes:
Amazon Web Services, which hosts our systems. Doorstep AI, which tells the courier when they have reached the delivery point, and which receives the delivery address in order to do so. Twilio, for the calls and messages described in section 6. Sentry and PostHog, which tell us when something breaks and how the service is being used. At times of peak demand we may also use another delivery company, in which case they receive what they need to complete the delivery.
We will also disclose information where the law requires it, or to protect someone's safety.9. Where information is processed
Our systems and your delivery record are hosted in the United Kingdom, in Amazon Web Services' London region. Our error reporting is processed in Germany and our product analytics in the European Union, both covered by the United Kingdom's adequacy regulations.
Some of our suppliers are headquartered in the United States and may process information there. Where that happens we rely on the safeguards that United Kingdom law provides for transfers of that kind.10. How long we keep information
We keep the delivery record — what was delivered, where, when, by whom, and the evidence that it arrived — for six years from the date of the delivery. Six years is the period in which someone can generally bring a claim about it, and it is the period our tax and accounting records have to cover. After that we delete it or strip it of anything that identifies you.
Merchant account information is kept for as long as the account is open, and then for six years for the same reasons.
If you ask us to erase your information we will do so unless we have to keep it for one of the reasons above, and we will tell you if that is the case.11. Your rights
You can ask for a copy of what we hold about you. You can ask us to correct anything wrong and complete anything missing. You can ask us to delete it. You can ask us to restrict what we do with it while something is being sorted out. You can ask for it in a portable form.
And because we rely on legitimate interests, you can object to our using your information at all. If you do, we have to stop unless we can show compelling grounds that override your objection. In practice, if a parcel is already on its way to you we will finish that delivery and explain why — and we will tell you what we have done about everything else.
None of this costs anything, and we have one month to reply. Email matt@quiver.co.uk, or write to us at 27 Old Gloucester Street, London, England, WC1N 3AX.12. If you work for a merchant
Everything above applies, with two differences. Our basis is normally the contract with your employer rather than legitimate interests, and we will contact you about the account, the deliveries and the invoices as part of running it.
We do not currently send marketing to merchant contacts. If that changes you will be told, given a way to opt out in every message, and your choice will be honoured.13. Questions and complaints
Email matt@quiver.co.uk and it reaches a person, not a queue. If you are not happy with how we have handled something you can complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, 0303 123 1113, https://www.ico.org.uk. We would rather you told us first, but you do not have to.14. Changes to this notice
This is version 2.0, last updated 15 September 2026. It replaces the notice of 10 February 2026, which was not versioned. We keep a dated copy of every version, so if you need to know what you were told at a particular time, ask us and we will send it to you.
