Legal
Privacy Notice
How Nicolau Ltd collects, uses, shares and looks after personal data — for people who apply to drive with us, drivers who work with us, and anyone who visits this website.
Last updated: 27 September 2026 · Version 1.2
1. Who we are
Nicolau Ltd is the “data controller” for the personal data described in this notice. That means we decide why and how it is used, and we are responsible for looking after it.
- Registered office: 134 Waterville Road, North Shields, Northumberland, NE29 6BL
- Registered in England & Wales, company number 14228361
- ICO data protection registration: [add ICO registration number once registered at ico.org.uk/registration]
- Contact for anything in this notice: team@nicolau.co.uk · +44 7842 891703
2. Who this notice is for
- Job applicants — people who fill in the “Apply to drive” form.
- Drivers — self-employed subcontractors we engage to run delivery routes.
- Website visitors — anyone browsing nicolau.co.uk.
3. What we collect, why, and our legal basis
“Lawful basis” is the UK GDPR reason we are allowed to use the data. Where a basis is legal obligation we have no choice; where it is contract we need the data to work with you; where it is legitimate interests we have judged that our need does not override your rights — you can object (section 7).
Job applicants
| Data | Why | Lawful basis | Kept for |
|---|---|---|---|
| Name, email, phone | To contact you about the role | Legitimate interests / steps before a contract | 6 months from your application, then deleted |
| Date of birth | To check you meet the minimum age and licence requirements for the work and our insurance | Legitimate interests | 6 months, then deleted |
| Driving experience, your message | To assess whether the role suits you | Legitimate interests | 6 months, then deleted |
| Notes we add while reviewing you | To keep track of where you are in the process | Legitimate interests | 6 months, then deleted |
If we take you on as a driver, the relevant information moves into your driver record (below) and is then kept under those rules instead.
Drivers
| Data | Why | Lawful basis | Kept for |
|---|---|---|---|
| Name, home address, date of birth, phone, email | To engage you, contact you and run the subcontract | Contract | 6 years after our last dealing with you (tax record period) |
| Unique Taxpayer Reference (UTR) | Evidence you are registered self-employed; printed on your self-billed invoices | Legal obligation (tax records) / Contract | 6 years after our last dealing with you |
| Bank name, sort code, account number | To pay you | Contract | 6 years after our last dealing with you |
| Driving licence “check code” and the date we last checked your entitlement | To confirm you are legally entitled to drive for our insurance | Legal obligation / Legitimate interests | 2 years after you stop driving with us |
| Right-to-work and identity documents you upload | To meet our duty to prevent illegal working | Legal obligation | 2 years after your engagement ends (Home Office requirement) |
| Proof of address, and — if you use your own van — its hire-and-reward insurance certificate, goods-in-transit certificate and MOT | Compliance checks for the work and our insurers | Legal obligation / Legitimate interests | 2 years after you stop driving with us, or until the document expires plus 12 months |
| Driving-licence details our insurers ask for (licence categories, the date you passed your test, penalty points, convictions and pending prosecutions), and any medical condition that affects your driving | So our motor insurance covers you, and to deal with any claim | Legitimate interests / Contract; health information only under the insurance condition in the Data Protection Act 2018 (Schedule 1) | 2 years after you stop driving with us, or until any claim you were involved in is closed |
| Company van tracker data (location, speed, journeys and times) and any dashcam footage, while you drive a company van | Managing our vans and fuel, keeping drivers and vans safe, dealing with accidents, claims and disputes, and checking the work invoiced. Not used to monitor you outside the work. | Legitimate interests | 12 months, or longer only while needed for a claim or dispute |
| Your delivery and collection records (stops, dates, amounts) received from Evri/DHL | To calculate what you are owed and produce your invoices | Contract | 6 years after our last dealing with you |
| Invoices, deductions, fuel drawn on a company fuel card assigned to you | To pay you and keep proper accounts | Contract / Legal obligation (tax records) | 6 years after the end of the tax year they relate to |
| Agreements you sign electronically: the text you signed, your typed name and drawn signature, the date and time, your IP address and device, and a fingerprint of the document | Evidence of what we agreed and that you signed it | Contract / Legitimate interests | 6 years after our last dealing with you |
| An audit log of high-stakes actions (who deleted a record, sent an invoice, etc.) | Accountability — being able to answer “who did that” | Legitimate interests | 6 years |
We do not use your data for automated decision-making or profiling. We do not sell it or use it for marketing.
Website visitors
This website does not use tracking or advertising cookies, and there is no analytics on it. See section 9 for the small amount of functional storage the site and the staff/driver dashboards use.
4. Where the data comes from
- Mostly from you — the apply form, and details you enter or upload in your driver dashboard.
- From Evri / DHL — your daily delivery and collection figures, passed to us as the service provider so we can pay you.
- From us — notes, invoice calculations, the audit log.
5. Who we share it with
We share personal data only with the following, and only as far as needed:
| Recipient | What for | Where |
|---|---|---|
| Supabase (database, sign-in, file storage) | Runs the system that stores driver records, documents and invoices | Data hosted in the EU; the company is US-based, covered by standard contractual clauses |
| Cloudflare (website hosting / delivery) | Serves this website and the dashboards | Global network; UK/EU edge, covered by standard contractual clauses |
| Google (Gmail) | Sends account-invite and invoice notification emails; the daily DHL report emails arrive here | EU/US, covered by the EU-US Data Privacy Framework / standard contractual clauses |
| Evri / DHL | The client we deliver for — delivery data flows from them to us | UK |
| HMRC | Tax reporting and records we are legally required to keep | UK |
| Our accountant / bookkeeper | Preparing accounts and tax returns | UK |
| Our insurers, brokers and claims handlers | Arranging and administering motor, goods-in-transit and liability cover, and any claim | UK |
| Our vehicle tracking provider | Runs the trackers fitted to company vans | UK |
We will also disclose data if the law requires it (for example a court order or a police request we are obliged to meet).
6. International transfers
Some of our suppliers (Supabase, Cloudflare, Google) are based in the United States or operate globally. Where personal data is processed outside the UK it is protected by an adequacy decision or by the UK’s International Data Transfer Agreement / standard contractual clauses, so it keeps essentially the same protection it has here.
7. Your rights
Under UK data protection law you can ask us to:
- Give you a copy of the personal data we hold about you (a “subject access request”);
- Correct anything that is wrong or incomplete;
- Delete data, where we no longer have a good reason to keep it (we may have to keep tax and right-to-work records for the periods above);
- Restrict or object to how we use it, where our basis is legitimate interests;
- Receive it in a portable format, where we hold it on the basis of contract or consent;
- Withdraw consent at any time, where we relied on consent.
To exercise any of these, email team@nicolau.co.uk. We will respond within one month and will not charge you. We may ask you to confirm your identity first.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office — ico.org.uk/make-a-complaint, helpline 0303 123 1113. We would ask you to raise it with us first so we have the chance to put it right.
8. How we protect it
- All connections to the website and dashboards are encrypted (HTTPS).
- The database enforces row-level access rules: a driver can only ever see their own record, documents and invoices; only an admin account can see everyone’s.
- Bank details and your UTR are entered by you and then locked — they can’t be changed again without contacting the office.
- Sensitive server keys never reach the browser; privileged actions run through checked server-side functions.
- High-stakes actions are written to an audit log.
9. Cookies and local storage
We do not use cookies for tracking, analytics or advertising. The only browser storage used is functional and stays on your device:
- A sign-in token, so you don’t have to log in on every page (staff and driver dashboards only);
- Small preferences you set — for example a remembered filter, or the name shown on this device.
Because none of this is used to track you, no consent banner is needed. Clearing your browser’s site data removes it.
10. Changes to this notice
If we change how we handle personal data we will update this page and its version number. Drivers are asked to sign an acknowledgement of the current version from their dashboard; if there is a significant change we will let drivers know directly.