Privacy Policy

1. Who We Are

YSOMA Logistics Ltd is the data controller for personal information collected through this website and through its logistics, driver membership and introduction services. As data controller, YSOMA determines the purposes and means of processing personal information and is responsible for ensuring that processing complies with UK GDPR and the Data Protection Act 2018.

Company number: 12574660 VAT Registration No. 348 4791 59 Registered in England and Wales

Registered Office and Correspondence Address: Suite 214, Legacy Centre Hanworth Trading Estate Hampton Road West Feltham TW13 6DH

Driver Trading Address: 3 Forest Road, Feltham, TW13 7EA — for driver operations only and not for correspondence.

Data Protection Officer: Lady Sophia Hull-Assaf

Privacy enquiries: Email: ysoma@ysoma.com Phone: 075 70 808 808

2. Who This Policy Applies To

This policy applies to: 1. Visitors to our website 2. Individuals who register interest in Driver or Own Van Driver opportunities 3. Applicants for free membership 4. Registered driver members and contractors 5. Logistics businesses and their representatives 6. Recruitment partners and their representatives 7. Any other person who contacts us or submits information through our website

3. Information We May Collect

Depending on how you interact with YSOMA, we may collect:

1. Your name, email address, telephone number and postcode 2. Registration, membership and enquiry information 3. Driving-licence information and driving experience 4. Vehicle, insurance and operating-area information 5. Availability and opportunity preferences 6. Identity, right-to-work and other verification information where required 7. Contract, invoicing, payment and tax-related information where applicable 8. Communications, complaints and consent records 9. Business names, company numbers and business-contact information 10. Driver or service requirements submitted by logistics and recruitment businesses 11. Website, device, security and cookie information 12. Delivery Driver CV information including work history, previous employers, roles, dates, skills and experience 13. Document uploads including identity, licence, vehicle and insurance documents 14. Driver assessment records, YSOMA Driver Level and Digital Driver Performance Certificate information 15. Opportunity matching records and recorded interests 16. Information about previous applicants where YSOMA already holds that information lawfully 17. Account credentials (stored in hashed, non-reversible form)

We do not ask applicants to provide identity documents, bank details or other sensitive documents through the general contact form.

Where special-category information or criminal-offence information is genuinely required, it will only be collected and used when an appropriate lawful condition under Schedule 1 of the Data Protection Act 2018 applies, and you will be informed of that condition at the time of collection.

4. Where Information Comes From

We normally receive information directly from you.

We may also receive relevant information from: 1. Businesses or recruitment partners involved in a proposed opportunity 2. Identity, licence or document-verification providers 3. Publicly available business registers 4. Professional advisers or service providers 5. Referees or other sources you have authorised

Where information is obtained from a source other than you directly, we will provide the required Article 14 UK GDPR privacy information within a reasonable period and no later than one month of obtaining it, unless an exemption applies.

5. How and Why We Use Information

We may use personal information to:

1. Respond to enquiries 2. Create and manage member accounts and profiles 3. Review free membership applications and verify submitted documents 4. Assess whether a profile may match an opportunity 5. Carry out proportionate identity, licence, vehicle or document checks 6. Contact drivers about opportunities they have chosen to hear about 7. Arrange direct YSOMA services and separate van-lease arrangements 8. Make an authorised introduction to a logistics business or approved recruitment partner 9. Review business and recruitment-partner applications 10. Administer contracts, invoices and payments 11. Operate, secure and improve the website 12. Handle complaints, legal claims and regulatory obligations 13. Keep records of preferences, acknowledgements and consent 14. Generate and issue Digital Driver Performance Certificates

Registering interest or creating a membership profile does not automatically authorise YSOMA to share your information with another business.

Before an intended introduction, you will be told what information may be shared and with whom, and your agreement will be obtained where consent is the applicable lawful basis.

6. Our Lawful Bases

UK GDPR requires that every processing activity has a lawful basis. Depending on the purpose, YSOMA relies on one or more of the following:

CONTRACT OR STEPS BEFORE A CONTRACT (Article 6(1)(b)) Where processing is necessary to consider or administer a direct service, contractor, lease or business arrangement requested by you. Examples: reviewing a membership application, processing a service agreement, administering invoices.

LEGITIMATE INTERESTS (Article 6(1)(f)) Where necessary to respond to enquiries, operate and secure our services, review suitable profiles, manage business relationships or protect legal rights, and where those interests are not overridden by your rights and reasonable expectations. We carry out a legitimate interests assessment before relying on this basis. Examples: responding to general enquiries, website security, fraud prevention, maintaining audit logs.

LEGAL OBLIGATION (Article 6(1)(c)) Where processing is necessary to meet legal, tax, accounting, regulatory or record-keeping requirements imposed on YSOMA. Examples: retaining financial records under HMRC requirements, responding to lawful regulatory requests.

CONSENT (Article 6(1)(a)) Where you choose to receive opportunity updates by email, SMS or WhatsApp, or where you authorise information to be shared for a particular introduction. Consent is always freely given, specific, informed and unambiguous. It may be withdrawn at any time without detriment, and withdrawal does not affect the lawfulness of processing carried out before withdrawal.

7. Driver Introductions

YSOMA may identify a driver whose profile appears relevant to a business request.

Registration or membership alone will not be treated as permission to disclose that driver's personal information.

Before an intended introduction: 1. The driver will be informed about the proposed recipient and opportunity 2. The information intended to be shared will be explained 3. The driver's agreement will be obtained where consent is the applicable lawful basis

After an authorised introduction, the receiving business becomes an independent data controller responsible for its own use of the information. YSOMA will take reasonable steps to ensure that the receiving business is aware of its own data-protection obligations.

7a. Delivery Driver CVs and Documents

Where a member creates a Delivery Driver CV, the information provided — including work history, previous employers, roles, dates, skills, availability and experience — is stored securely and used to assess suitability for relevant opportunities.

Documents uploaded through the member portal — including identity, licence, vehicle and insurance documents — are stored in encrypted, non-public storage. They are protected by role-based access controls and are not attached to ordinary emails or shared through messaging applications.

A Delivery Driver CV will not be shared with another business without first informing the member, explaining what will be shared and recording approval for that specific introduction.

YSOMA Driver Level assessments and Digital Driver Performance Certificates are internal records. They are not shared with third parties without appropriate authorisation.

7b. Previous Applicants

YSOMA may hold information about individuals who previously applied through external platforms such as Indeed.

Before contacting a previous applicant, YSOMA will check for previous opt-outs, invalid details, do-not-contact status and applicable retention periods.

Previous optional marketing preferences will not automatically be carried forward. Any new communication preference must be separately confirmed.

Imported records are marked as awaiting member confirmation and are not treated as verified until the individual has confirmed their information.

8. Opportunity Updates and Marketing

Email, SMS and WhatsApp opportunity updates are optional and require your separate consent under the Privacy and Electronic Communications Regulations 2003 (PECR) and UK GDPR.

Consent choices are: 1. Separate for each communication method 2. Unticked by default 3. Freely given — not bundled with other terms 4. Recorded with a timestamp and the version of the consent wording shown 5. Easy to withdraw at any time

You may unsubscribe or change your preferences at any time by using an available unsubscribe facility or contacting ysoma@ysoma.com.

Withdrawing consent does not affect processing that took place lawfully before withdrawal.

9. Who We May Share Information With

Where necessary and lawful, information may be shared with:

1. A specifically identified logistics business or approved recruitment partner for an authorised introduction 2. Service providers supporting website hosting, forms, email, communications and IT security — acting as data processors under a written data-processing agreement 3. Verification, accounting, payment, insurance or vehicle-service providers 4. Professional advisers bound by duties of confidentiality 5. Courts, regulators, law-enforcement bodies or public authorities where required by law 6. A purchaser or successor if the business is reorganised or transferred, subject to appropriate safeguards and prior notice where required

YSOMA does not sell personal information to any third party.

Service providers acting as data processors on YSOMA's behalf must only process information under written instructions and appropriate contractual safeguards, including standard contractual clauses where required.

10. International Transfers

Some website, communication or technology providers may process information outside the United Kingdom.

Where a restricted international transfer occurs, YSOMA will rely on an appropriate transfer mechanism recognised under UK GDPR, such as an adequacy decision, UK International Data Transfer Agreement (IDTA), or UK Addendum to EU Standard Contractual Clauses.

Further information about relevant safeguards, including a copy of the applicable transfer mechanism, may be requested by contacting ysoma@ysoma.com.

11. How Long We Keep Information

YSOMA keeps personal information only for as long as reasonably necessary for the purpose for which it was collected and for applicable legal, accounting, regulatory or claims requirements.

As a general guide, retention periods are: 1. General enquiries and register-interest submissions — up to 2 years from last contact, or until a do-not-contact request is received 2. Free membership applications (incomplete or declined) — up to 2 years from submission or last activity 3. Active member profiles — for the duration of membership plus up to 3 years after closure 4. Uploaded identity and licence documents — for the duration of the relevant arrangement plus up to 2 years, or as required by law 5. Contract and invoicing records — 7 years from the end of the relevant tax year, in line with HMRC requirements 6. Consent and communication records — for the duration of the consent plus up to 3 years 7. Audit logs and security records — up to 3 years 8. Legal claims and regulatory correspondence — for the duration of any claim or investigation plus applicable limitation periods

Information that is no longer required will be deleted, anonymised or securely archived in accordance with YSOMA's retention procedures. Anonymised data from which no individual can be identified is not personal information and may be retained for statistical purposes.

12. Security

YSOMA uses proportionate organisational and technical measures intended to protect personal information from unauthorised access, loss, alteration or disclosure. These include encrypted storage for sensitive documents, role-based access controls, hashed credential storage, HTTPS transmission, and CSRF and rate-limiting protections.

No online system can be guaranteed completely secure. In the event of a personal data breach that is likely to result in a risk to individuals' rights and freedoms, YSOMA will notify the Information Commissioner's Office within 72 hours where required, and will notify affected individuals without undue delay where the breach is likely to result in a high risk.

Please do not send unnecessary sensitive information through general website forms or ordinary email.

13. Your Data-Protection Rights

Under UK GDPR, you have the following rights: 1. Right to be informed — to receive clear information about how your data is used (this policy fulfils that obligation) 2. Right of access — to request a copy of the personal information we hold about you (Subject Access Request) 3. Right to rectification — to have inaccurate or incomplete information corrected 4. Right to erasure — to request deletion of your information in certain circumstances 5. Right to restriction — to request that processing is restricted while a complaint or accuracy dispute is resolved 6. Right to object — to object to processing based on legitimate interests or for direct marketing 7. Right to data portability — to receive your information in a structured, commonly used, machine-readable format where processing is based on consent or contract and carried out by automated means 8. Rights related to automated decision-making — not to be subject to solely automated decisions that produce legal or similarly significant effects 9. Right to withdraw consent — at any time, without affecting the lawfulness of prior processing 10. Right to complain — to the Information Commissioner's Office

These rights are not absolute and may be subject to legal exceptions. We will respond to valid requests within one calendar month, which may be extended by a further two months for complex or numerous requests, with notice given.

RIGHT TO OBJECT — IMPORTANT Where YSOMA relies on legitimate interests, you have the right to object to that processing on grounds relating to your particular situation. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for legal claims. You have an absolute right to object at any time to personal information being used for direct marketing, including profiling related to direct marketing. We will stop immediately upon receipt of an objection.

To exercise any right, contact the Data Protection Officer at ysoma@ysoma.com or by post to the correspondence address above. YSOMA may need to verify your identity before responding. There is no charge for exercising your rights unless a request is manifestly unfounded or excessive.

14. Automated Decision-Making

YSOMA does not make decisions producing legal or similarly significant effects solely through automated processing without human involvement.

Profiles may be reviewed against stated requirements using automated tools, but all suitability and introduction decisions involve human consideration and review by a member of the YSOMA team.

15. Cookies and Similar Technologies

The website currently uses only technologies that are strictly necessary for website operation, security, form protection, session management and essential functionality. These are exempt from consent requirements under PECR Regulation 6(4).

YSOMA does not currently use optional analytics, advertising or session-recording technologies on the published website.

Further information is available in the Cookie Policy.

If optional technologies are introduced in future, this policy and the Cookie Policy will be updated, visitors will receive clear information about their purpose and duration, and the technologies will not be activated until the required consent has been obtained.

16. Children

YSOMA's driver and business services are not intended for anyone under 18. The minimum age for a Category B driving licence in the United Kingdom is 17, and all driver opportunities require a full valid licence.

YSOMA does not knowingly collect registration or membership information from children. If we become aware that personal information has been collected from a child without appropriate consent, we will delete it promptly.

17. Complaints

If you have concerns about how your personal information has been handled, please contact YSOMA's Data Protection Officer in the first instance. We will acknowledge your complaint within five working days and aim to provide a substantive response within one calendar month.

Data Protection Officer: Lady Sophia Hull-Assaf Email: ysoma@ysoma.com Phone: 075 70 808 808

If you are not satisfied with our response, or if you consider that our processing infringes UK GDPR, you have the right to lodge a complaint with the supervisory authority: Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Website: https://ico.org.uk/make-a-complaint/ Telephone: 0303 123 1113

18. Changes to This Policy

YSOMA may update this policy when its services, data practices or legal obligations change. Where changes are material, we will take reasonable steps to bring them to your attention, which may include a notice on the website or direct communication where we hold your contact details.

The latest version and revision date will be published on this page. We recommend reviewing this policy periodically.

19. Privacy Contact

For privacy questions, data-protection requests, Subject Access Requests, objections or consent withdrawals, contact:

Lady Sophia Hull-Assaf Data Protection Officer YSOMA Logistics Ltd Email: ysoma@ysoma.com Phone: 075 70 808 808

Correspondence Address: Suite 214, Legacy Centre Hanworth Trading Estate Hampton Road West Feltham TW13 6DH