Privacy policy

This policy explains how TopHatMedia handles information in connection with HatDrop, the platform businesses use to take orders and manage deliveries.

Two relationships are worth separating. When a business subscribes to HatDrop, we handle that business's own account information directly. When that business serves its customers through HatDrop, we handle customer information on the business's behalf and under its instructions — that business decides what it collects and why, and its own privacy policy governs its relationship with its customers.

Account and business information: the name, contact details, business address and billing details of the business subscribing, and the names and contact details of the staff and drivers it gives access to.

Customer and order information, held on behalf of a business: customer names, contact details, delivery addresses, order history, saved preferences, rewards activity, and messages sent through an order.

Delivery information: addresses, delivery notes, order status and timing, and location information shared by a driver's device while they are working a delivery.

Age verification status, where a business has switched it on.

Support communications: what you send us when you contact us, and our replies.

Basic technical information: the platform records information such as device or browser type and activity in the application, which is used to keep the service working and secure.

To provide the platform: showing a storefront, taking and processing orders, arranging deliveries, keeping customers informed of progress, and giving a business reporting on its own activity.

To support and secure the service: answering questions, investigating problems, preventing misuse, and keeping records of activity in a business's own workspace.

To manage our relationship with a subscribing business: billing, service notices and account administration.

We do not sell personal information.

We use a subscribing business's own details to set up and administer its account, to invoice it, and to contact it about the service.

Customer and order information is held for the business the customer ordered from, and is used to fulfil and support those orders. A business's information is kept separate from that of every other business using HatDrop.

If you are a customer of a business that uses HatDrop, that business is the right first point of contact about your information. We will help them respond.

Businesses using HatDrop collect delivery addresses and related details needed to complete an order. Address information is also used to work out whether an address is within a business's delivery area and what the delivery costs.

While a driver is working a delivery, their device shares its location so the business can manage the delivery and the customer can follow its progress. Location sharing is tied to working a delivery, not to having the application installed.

Some businesses using HatDrop sell age-restricted products and require a customer's age to be verified before ordering. Where that is switched on, verification is carried out by an external verification service configured for that business.

What we record is whether verification was completed and when. Identity documents and the details used to perform the check are handled by the verification service under its own policy.

Card payments made to a business are processed by that business's own payment provider. We do not store full card numbers. The platform records what an order was for, what it came to, and whether it was paid, so the business and its customer both have a record.

Subscription billing information for a business subscribing to HatDrop is handled by us and by our billing provider.

We use a small number of service providers to operate the platform — covering hosting and storage, addresses and mapping, age verification, and email and notifications. They handle information only as needed to provide their service to us. A current list is available on request.

Access to a business's workspace is restricted to that business's own accounts. Our staff do not browse customer data as a matter of course: access for support requires a specific, time-limited session with a recorded reason, which the business can see in its own activity log.

No service can promise that information will never be compromised, and we are not going to claim otherwise. We take reasonable measures to protect information and to detect and respond to problems.

We keep information for as long as a business has an active subscription and, after that, for as long as needed to close out the relationship and meet our legal and accounting obligations.

A business can export its data at any time, and can ask us to delete information it no longer needs to keep. Specific retention periods are being set with counsel and will be published here.

Depending on where you live, you may have rights to access, correct, export or delete information about you, or to object to certain uses of it. Contact us and we will help.

If you are a customer of a business using HatDrop, we will pass your request to that business and support them in answering it, because the information is theirs.

Marketing messages from a business you have ordered from can be turned off in your account with that business, or by using the unsubscribe option in the message.

A business using HatDrop decides what customer information it collects and how it uses it. It is responsible for having a lawful basis for that, for publishing its own privacy notice, and for responding to requests from its customers. We provide the tools; the business sets the policy.

HatDrop is not intended for children, and businesses using it for age-restricted products set a minimum age for ordering. We do not knowingly collect information from children. If you believe a child has provided information, contact us and we will look into it.

We may update this policy as the platform develops. Where a change materially affects how information is handled, we will make that clear rather than quietly revising the page.

Questions about this policy, or a request about your information, can be raised through the contact page.