Security & Data Protection

DeliveryPro is operated by Ovon Group Ltd. Security and data protection are fundamental to the way our vehicle movement platform, driver applications and customer tracking services are designed and operated.

We recognise the responsibility that comes with processing customer and driver information, journey locations, vehicle inspection photographs, verification information and handover evidence. We maintain technical and organisational controls designed to protect the confidentiality, integrity and availability of our systems and data.

This document provides an overview of our approach. It does not replace an agreed service contract or data processing agreement, and no system can guarantee absolute security.

Our primary production systems and customer data are hosted in the United Kingdom. Production infrastructure is designed to provide appropriate separation, resilience and access control.

Some service providers may operate internationally. Where personal information is transferred outside the UK, appropriate protections required by UK data protection law apply, as explained in our Privacy Policy.

We use encryption to protect information in transit and at rest. Connections to DeliveryPro services use modern encrypted transport protocols. Production databases, file storage, backups and other applicable storage services use encryption at rest.

Access to production systems and customer information is restricted to authorised personnel who need access for legitimate business purposes. Access is removed or adjusted when an individual's role or responsibilities change.

Organisations using DeliveryPro are responsible for administering their users and sharing customer tracking links only with intended recipients. Access to delivery records, driver locations, verification information and handover evidence should be proportionate to each user's responsibilities.

• Role-based access and least-privilege principles.
• Authentication controls and restricted administrative access.
• Logging of relevant system activity and periodic access reviews where appropriate.

We manage infrastructure through controlled, repeatable infrastructure and deployment processes, and review our arrangements as the platform and services evolve.

• Separation of production and non-production environments.
• Restricted production access and controlled infrastructure changes.
• Network and application-level security controls.
• Encrypted storage, automated backups and operational monitoring.
• Logging of relevant system and security activity.

Security is considered throughout DeliveryPro's development and deployment. Production changes are made through controlled deployment processes rather than routine manual changes directly to production systems.

• Source control, change tracking and code review.
• Automated testing and controlled deployment processes.
• Dependency and software package management.
• Separation of development and production environments and restricted production access.
• Review and remediation of identified security issues.

Production personal information is not ordinarily used in development or testing. We prefer synthetic, anonymised or non-production information where realistic data is needed.

Where production information is exceptionally required for investigation or support, access is restricted to authorised personnel and the minimum information necessary for the task should be used. This applies to delivery records, location information, photographs, verification records and signatures.

We maintain operational and security logging appropriate to our systems. Monitoring helps identify service failures, investigate unexpected behaviour and potential security issues, troubleshoot problems, maintain reliability and investigate incidents.

Access to logs containing potentially sensitive information is restricted. Logs have defined retention periods and are not intended as permanent storage of customer information.

We maintain automated backups and recovery arrangements for critical production data and services. Backups are encrypted where applicable, access controlled, retained according to defined lifecycle rules and managed separately from normal application access.

These arrangements support recovery following system failure or data loss. Backups are intended for disaster recovery and resilience, not as a permanent archive of customer or vehicle movement information.

We maintain a documented Data Retention Policy and Retention Schedule. Personal information is retained only as long as reasonably necessary for its purpose and applicable contractual, legal, regulatory, accounting, audit and dispute-resolution requirements.

Relevant customer, transaction and vehicle movement records are generally retained for up to 7 years after the relevant customer relationship, service or transaction ends. Associated inspection and handover evidence, signatures and driver location information may be included where necessary. This is not a blanket requirement to retain every location point or document for the full period.

Operational logs and other information are subject to shorter periods appropriate to their purpose. Where we process records on an organisation's behalf, its instructions and the applicable agreement govern return, deletion and retention, subject to law.

Where practical, automated controls enforce retention and deletion. Information reaching the end of its retention period is securely deleted or irreversibly anonymised unless there is a legitimate reason for continued retention.

We maintain processes and documentation to support compliance with applicable UK data protection requirements, including the UK GDPR and Data Protection Act 2018. Our Privacy Policy explains our controller and processor responsibilities and how we process personal information.

• A Record of Processing Activities and documented retention policy and schedule.
• A public Privacy Policy and processes for handling data subject rights.
• Personal data breach and incident management.
• Supplier and third-party controls.
• Staff data protection and information security training.

Security is not solely a technical responsibility. Employees are subject to confidentiality obligations and receive data protection and information security training based on Information Commissioner's Office (ICO) guidance and training material, supplemented with information relevant to our systems and responsibilities.

Employees with access to systems and customer information are expected to follow our security, confidentiality and data protection requirements.

We maintain processes for identifying, investigating, containing and responding to security incidents and personal data breaches. Assessments consider what happened, the systems or information affected, potential impact, containment and remediation, and whether customers, partners, the ICO or affected individuals must be informed.

Relevant incidents and decisions are documented. Where acting as a processor, we notify the relevant controller in accordance with applicable obligations. We review incidents to identify corrective actions and improvements.

We use selected technology and service providers to operate DeliveryPro, which may include hosting, mapping, communications and verification services. Where suppliers process personal information on our behalf, we assess contractual, data protection and security requirements appropriate to the information and service.

These suppliers are expected to provide appropriate safeguards and process information only for agreed purposes. An organisation acting as an independent controller, such as a dealer, fleet operator or transporter, is responsible for the security and processing of information it receives.

Our infrastructure and operational arrangements are designed to reduce the impact of individual system failures and support recovery of critical services. They include appropriate use of managed cloud infrastructure, automated backups, infrastructure-as-code, controlled deployments, monitoring and recovery procedures.

Resilience arrangements are reviewed as the platform and its operational requirements evolve.

We take reasonable measures to identify and address vulnerabilities affecting DeliveryPro and its underlying technology. This includes maintaining software dependencies, monitoring relevant security information and assessing identified vulnerabilities according to their potential impact.

Security issues are prioritised and remediated according to the risk they present.

We welcome responsible reports from researchers and others who believe they have identified a vulnerability affecting DeliveryPro. Report issues privately to security@ovon.co.uk with enough information to understand and reproduce the issue where possible.

We investigate credible reports and aim to maintain appropriate communication with the reporter. This document does not grant permission to access systems or information without authority.

• Do not access, modify or download customer information beyond what is strictly necessary to demonstrate an issue.
• Do not disrupt or degrade services.
• Do not use social engineering against employees, customers or partners, or attempt physical attacks against premises or personnel.
• Do not publicly disclose a potential vulnerability before we have had a reasonable opportunity to investigate and address it.
• Act in good faith.

Customers, prospective customers and partners may contact security@ovon.co.uk with security or information assurance questions.

For privacy enquiries, contact privacy@ovon.co.uk. DeliveryPro is provided by Ovon Group Ltd, company number 16230222, registered at C4DI Suite 4, Building 1, 31-38 Queen St, Kingston upon Hull, HU1 1UU, United Kingdom.

Security requirements and threats change over time. We continually develop our controls as DeliveryPro, our infrastructure and services evolve. This document may be updated to reflect material changes to our security practices.