Purpose
This policy defines how Carriyo collects, processes, stores, and protects personal data in compliance with the General Data Protection Regulation (GDPR), the UK GDPR, and other data protection legislation that applies to the personal data Carriyo processes.
Scope
This policy covers all personal data processed by Carriyo on behalf of our customers, including but not limited to: recipient names, addresses, phone numbers, email addresses, and order details.
Data Processing Principles
Carriyo adheres to the following principles when processing personal data:
- Lawfulness, fairness, and transparency — Data is processed lawfully and transparently
- Purpose limitation — Data is collected for specified, explicit, and legitimate purposes
- Data minimization — Only data necessary for the specified purpose is collected
- Accuracy — Reasonable steps are taken to ensure data is accurate and up to date
- Storage limitation — Data is retained only for as long as necessary
- Integrity and confidentiality — Appropriate technical and organizational measures protect data
Data Processing Role
Carriyo acts as a data processor on behalf of our customers (the data controllers). We process personal data only according to the documented instructions of our customers and in compliance with our Data Processing Agreement (DPA).
Technical Measures
Encryption
- All data in transit is encrypted using TLS 1.2 or higher
- All data at rest is encrypted using AES-256 encryption
- Database backups are encrypted using the same standards
Access Controls
- Role-based access control (RBAC) governs all system access
- Multi-factor authentication (MFA) is required for all administrative access
- Access reviews are conducted at least twice a year
Data Isolation
- Customer data is logically isolated using tenant-based architecture
- No customer can access another customer's data through the platform
Data Subject Rights
Carriyo supports our customers in fulfilling data subject rights requests, including:
- Right of access
- Right to rectification
- Right to erasure
- Right to data portability
- Right to restriction of processing
Breach Notification
In the event of a personal data breach, Carriyo will notify affected customers without undue delay and within 72 hours of becoming aware of the breach, in accordance with GDPR Article 33.