Privacy Policy for Convoy Convos

1. Introduction

Convoy Convos is a UK-based networking platform that connects individuals travelling on the same train or coach journeys, enabling users to communicate and optionally meet before travel or whilst on board their chosen method of transport.

We are committed to protecting your personal data in accordance with the Information Commissioner's Office (“ICO”), the UK General Data Protection Regulation (“UK GDPR”), and the Data Protection Act 2018.

For the purposes of data protection law, Convoy Convos is the data controller.

2. The Data We Collect

2.1 Information You Provide

• Identity Data: name, username, profile photo
• Contact Data: email address
• Profile Data: biography, interests, professional information (optional)
• Journey Data: departure/arrival locations, times, routes, and transport provider
• Communications Data: messages exchanged with other users

2.2 Automatically Collected Data

• Location Data: No real-time or approximate location. The user has complete control on divulging real-time and approximate location.
• Technical Data: IP address, device type, operating system
• Usage Data: interactions with the app

2.3 Special Category Data

We do not intentionally collect special category data (e.g. health, religion). Users do not have to include such information in profiles or messages.

3. How We Use Your Data & Lawful Bases

Under UK GDPR, we must have a lawful basis for processing your personal data.

4. Location Data and Matching

Because Convoy Convos is built around real-world travel:

• We process given journey-based location data to match users on the same routes
• We do not use real-time location to verify proximity to departure points

Where required by ICO guidance, we obtain explicit consent before accessing precise location data. You can withdraw this at any time via device settings.

5. Data Protection by Design & DPIA

In line with ICO expectations, we have conducted a Data Protection Impact Assessment (DPIA) due to:

• Potential use of location data
• Matching individuals in real-world contexts
• Potential risks to user safety

Our DPIA ensures:

• Data minimisation (only necessary journey selection data is used)
• Privacy-preserving matching (limited visibility before mutual match)
• Safety controls (blocking, reporting, moderation tools)

We regularly review and update this assessment as the service evolves.

6. Sharing Your Data

6.1 With Other Users

• Limited profile and journey data is shared with matched users
• Messaging content is visible only to participants and moderators

6.2 With Processors

We use trusted third-party processors for:

• Cloud hosting
• Analytics
• Customer support

All processors are bound by UK GDPR-compliant data processing agreements.

6.3 Legal Obligations

We may disclose personal data where required to:

• Comply with legal obligations
• Respond to law enforcement
• Protect users from harm

7. International Transfers

Where data is transferred outside the UK, we ensure appropriate safeguards, such as:

• UK adequacy regulations
• Standard Contractual Clauses (SCCs)

8. Data Retention

We retain personal data only as long as necessary:

• Account data: retained while your account is active
• Messages: retained to provide the service and for safety purposes
• Deleted accounts: removed or anonymised within 365 days

We regularly review retention periods in line with ICO guidance.

9. Your Rights Under UK GDPR

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Erase your data (“right to be forgotten”)
• Restrict processing
• Object to processing (including legitimate interests)
• Data portability
• Withdraw consent at any time

To exercise your rights, contact: convoyconvos@gmail.com

You also have the right to lodge a complaint with the Information Commissioner's Office.

10. Safety and User Responsibility

While we implement safeguards:

• Users choose whether to meet others
• We strongly recommend meeting in public places (e.g., stations)
• We provide reporting and blocking features

We do not conduct full background checks on users.

11. Security Measures

We implement appropriate technical and organisational measures, including:

• Encryption in transit and at rest
• Access controls and authentication
• Monitoring for suspicious activity

12. Children’s Privacy

Convoy Convos is strictly for users aged 18 and over. We do not knowingly process data relating to children.

13. Changes to This Policy

We may update this policy to reflect legal or operational changes. Significant updates will be communicated via the app or email.

14. Contact Details

15. Transparency and ICO Compliance Statement

We aim to comply fully with UK data protection law and ICO guidance, including:

• Lawfulness, fairness, and transparency
• Purpose limitation
• Data minimisation
• Accuracy
• Storage limitation
• Integrity and confidentiality
• Accountability

---

End of Policy