Privacy Policy

Draft for review. This page is a draft and must be reviewed by a qualified professional before publication.

This privacy policy explains how JZ CONSULTANT GROUP LTD ("we", "us", "our") collects, uses, shares and protects your personal data when you use our website at https://jzcgroup.co.uk (opens in a new tab), send us an enquiry or service request, or create a customer account. It also explains your rights and how to contact us.

We are an independent consultancy offering administrative support and general guidance to food-delivery riders and couriers. We are not affiliated with, endorsed by or acting on behalf of any delivery platform.

Who we are

JZ CONSULTANT GROUP LTD is the controller of your personal data. This means we decide how and why your personal data is used.

• Company name: JZ CONSULTANT GROUP LTD
• Company number: 16513565 (registered in England and Wales)
• Registered office: 11 Swan Street, Loughborough, England, LE11 5BJ
• Email: jubedmiahh@gmail.com
• Phone: [telephone number — to be confirmed]
• ICO registration number: [ICO registration number — to be confirmed]

We have not appointed a Data Protection Officer because we are not required to. If you have any questions about this policy or how we handle your data, please email jubedmiahh@gmail.com.

Important: what we will never ask for

• We will never ask for your delivery platform passwords or one-time verification codes (for example, codes sent by text message or email to log in to Uber Eats, Deliveroo, Just Eat, Stuart or Amazon Flex). If anyone claiming to be us asks for these, do not share them and please let us know.
• Please do not send identity documents (such as passports, driving licences, right to work documents or insurance certificates) through our initial service request or contact form. If we need to see a document to help you, we will explain why and agree a suitable way to share it first.

The personal data we collect

When you submit a service request or contact form

• Full name
• Mobile number
• Email address
• Preferred contact method (phone, WhatsApp or email)
• Delivery platform you are interested in or working with
• The service you need
• Vehicle type
• Current application status
• The description you type into the free-text box
• Preferred language (English or Bengali)
• The date and time you confirmed you had read this privacy policy

Please only include information in the free-text box that we need to understand your request. Avoid including sensitive information such as health details, criminal records, immigration status or financial account details unless we have specifically asked for it.

When you create an optional customer account

• Name, email address and phone number
• Your password, which we store only as a salted, one-way hash (using bcrypt). We cannot see or recover your actual password.
• Your language and contact preferences
• Records of email verification and password reset requests

When we work on your request

• Notes and status updates added by our staff about your request
• Correspondence between you and us (for example emails, phone call notes and, if you choose it, WhatsApp messages)
• Audit logs recording actions taken by our staff in our administration system (for example, who updated a request and when)

Technical data

• A hashed (scrambled) version of your IP address, used to limit repeated submissions and prevent spam and abuse. We do not store your full IP address for this purpose.
• A session cookie that keeps you signed in, and cookies that remember your cookie and language choices. See our Cookie Policy for details.
• If you agree to analytics cookies, information about how you use our website (such as pages visited and approximate location derived from your IP address). We do not load analytics unless you opt in.

Where we get your data from

We collect most personal data directly from you, through our website forms, your customer account, and when you contact us by email, phone or WhatsApp. Some technical data is collected automatically when you use our website. We do not buy personal data from third parties.

How we use your data and our lawful bases

Under UK data protection law we must have a lawful basis for each way we use your personal data.

• To respond to your enquiry or service request, and to provide our services (including contacting you by your preferred method, giving general guidance and administrative support, and keeping notes on your request). Lawful basis: contract, or taking steps at your request before entering into a contract.
• To create and manage your customer account (including sending email verification and password reset emails). Lawful basis: contract.
• To keep our website and systems secure, prevent spam and abuse, and rate-limit form submissions (including using a hashed IP address). Lawful basis: legitimate interests – our interest in protecting our website, our customers and our business.
• To keep records of our work, maintain audit logs, handle complaints and defend legal claims. Lawful basis: legitimate interests – our interest in running our business properly and being able to show what was done and when.
• To keep financial, accounting and tax records once paid services are offered, and to comply with other legal duties. Lawful basis: legal obligation.
• To understand how our website is used through optional analytics cookies. Lawful basis: consent, which you can withdraw at any time using the "Cookie settings" link in the website footer.
• To send you marketing emails or messages. We will only do this if you have given us your consent, and you can unsubscribe at any time. We do not currently send marketing communications.

Where we rely on legitimate interests, we have considered your rights and expectations and believe our use is proportionate. You can ask us for more information about this balancing exercise.

If you do not give us the information we need to handle your request (for example a way to contact you), we may not be able to help you.

Who we share your data with

We do not sell your personal data. We use the following service providers (processors), who act only on our instructions and must keep your data secure:

• Website hosting: Vercel, which hosts our website and may process data in the United States.
• Database hosting: a managed PostgreSQL database provider (provider to be confirmed).
• Transactional email: Resend, a US-based provider used to send emails such as request confirmations, account verification and password resets.
• Website analytics (only if you opt in): an analytics provider such as Google Analytics 4 or Plausible (provider to be confirmed).

We may also share your data where necessary with:

• WhatsApp (Meta): if you choose WhatsApp as your contact method, your messages are processed by WhatsApp under its own terms and privacy policy. WhatsApp acts independently of us in respect of its own processing.
• Professional advisers, such as accountants, lawyers or insurers, where reasonably necessary.
• Law enforcement, regulators or courts, where we are required or permitted to do so by law.
• A buyer or successor, if our business is sold or restructured, subject to equivalent protections.

We will not share your data with a delivery platform or insurer without your knowledge. Where you ask us to help you with something that involves a third party, you remain in control of your own applications and accounts.

International transfers

Some of our service providers (including Vercel and Resend) are based in, or may process data in, the United States or other countries outside the UK. Where personal data is transferred outside the UK, we make sure it is protected by an appropriate safeguard, such as:

• UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge") where the recipient is certified; or
• the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

You can contact us for more information about the safeguards we use.

How long we keep your data

We keep personal data only for as long as we need it. Our proposed retention periods (to be confirmed) are:

• Enquiries and service requests that do not progress: deleted 24 months after our last contact with you.
• Customer records (where we have provided services): kept for 6 years after our last service to you, for legal, accounting and tax purposes and to deal with any claims.
• Customer accounts: kept while your account is active. If you ask us to close your account, we will delete or anonymise account data unless we need to keep some of it under the periods above.
• Audit logs: kept for 2 years.
• Hashed IP addresses used for rate-limiting: kept only for a short period needed for security purposes.

When data is no longer needed, we securely delete or anonymise it.

How we keep your data secure

We use appropriate technical and organisational measures to protect your personal data, including:

• encrypted connections (HTTPS) to our website;
• storing passwords only as salted bcrypt hashes;
• httpOnly session cookies that cannot be read by scripts in your browser;
• restricting staff access to personal data to those who need it, and logging administrative actions;
• rate-limiting and spam protection on our forms.

No method of transmission or storage is completely secure, but we work to protect your data and will act promptly if a security incident occurs, including notifying you and the Information Commissioner's Office (ICO) where required.

Your rights

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the right to:

• be informed about how we use your personal data (this policy);
• access the personal data we hold about you;
• rectification – ask us to correct inaccurate or incomplete data;
• erasure – ask us to delete your data in certain circumstances;
• restrict processing in certain circumstances;
• data portability – receive data you gave us in a commonly used format, where processing is based on contract or consent and carried out by automated means;
• object to processing based on legitimate interests, and to object at any time to direct marketing;
• withdraw consent at any time where we rely on consent (for example analytics cookies), without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, email jubedmiahh@gmail.com. We may need to confirm your identity before responding. We will respond within one month, which may be extended by up to two further months for complex requests (we will tell you if this applies). There is normally no charge.

Automated decision-making

We do not make decisions about you based solely on automated processing (including profiling) that have legal or similarly significant effects on you.

Children

Our services are intended for adults. Our website and services are not aimed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us their personal data, please contact us and we will delete it.

How to complain

If you have concerns about how we use your personal data, please contact us first at jubedmiahh@gmail.com and we will try to resolve them. You can also read our Complaints Procedure.

You have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:

• Website: ico.org.uk (opens in a new tab)
• Helpline: 0303 123 1113

Changes to this policy

We may update this policy from time to time, for example when we launch paid services or change our service providers. The "last updated" date shows when it was last changed. If we make significant changes, we will tell you through our website or by email where appropriate.