H2O Logistics Ltd (“H2O”) takes the protection and privacy of personal data very seriously. This
Privacy Notice explains to prospective Consultants, Suppliers and Service Providers (herein
“Service Providers”) how we process personal data before, during and after being a Service
Provider to H2O.
Our address for all queries related to Data Protection:
 Tagus House, 9 Ocean Way, Southampton, Hampshire, United Kingdom, SO14 3TJ
The team responsible for Data Protection issues can be emailed
at compliance@h2ologistics.co.uk.
What personal data do we collect about you, how do we use that personal data, and what is our
legal basis?
In order to ensure your trust and to comply with the law, we need a legal basis in order to process
your personal data. Any of your personal data we process is because:
We have your express consent to do so;
It is necessary for the performance of the Contract for Services we have in place with you (or you
wish to consider a contractual relationship with us);
We have a legal obligation to do so; or
It is a legitimate business activity that doesn’t unduly compromise your data protection rights.
On occasion, we may seek your consent to process your personal data for anything we may
consider to be beneficial or advantageous for you, but you are free to refuse.
When you are a Service Provider, or wish to become a Service Provider of H2O, we collect and
process your personal data:
in order to fulfil our Contract for Services with you;
to fulfil our legal obligations under UK legislation;
where the activity is a legitimate one for a business reason; and
with your express consent for anything else.
RELATIONSHIP STAGES
Pre-engagement Stage:
Before you have become a Service Provider and we are discussing and evaluating our
relationship we will process your data to communicate with you, assess your suitability for being
a Service Provider and check your legal documents necessary for undertaking services.
In order to communicate with you and perform basic due diligence we may process personal data
such as:
your name;
email address;
driving license number;
home or registered address;
telephone number(s); and
date of birth.
We process this information with your consent, and also with a legitimate interest where you
have requested information from us, or made enquiries into engaging with us.
To ensure compliance with our (and sometimes our client’s) policies on safe working we will
check the details of your driving license against the data held by the relevant authority.
To ensure safe working practices and prevent road traffic incidents, Service Providers who will
be driving on public roads must be subject to drug and alcohol screening. By ticking the relevant
box on our Supplier Registration form you consent to be subject to drug and alcohol testing
facilitated by our partner, Eurofins NFC UK Limited.
In order to comply with our legal obligations under UK immigration and Home Office legislation
we need to confirm your identity and right to work in the UK. To prevent fraud and comply with
UK immigration law we cannot have a Contract for Services with you unless we can verify your
identity, nationality, home address and right to work in the UK. We may process any combination
of the following documents to perform the required checks:
A passport showing the holder, or a person named in the passport as the child of the holder, is a
British citizen or a citizen of the UK and Colonies having the right of abode in the UK;
A passport or national identity card showing the holder, or a person named in the passport as the
child of the holder, is a national of a European Economic Area country or Switzerland;
A Registration Certificate or Document Certifying Permanent Residence issued by the Home
Office to a national of a European Economic Area country or Switzerland;
A Permanent Residence Card issued by the Home Office to the family member of a national a
European Economic Area country or Switzerland;
A current Biometric Immigration Document (Biometric Residence Permit) issued by the Home
Office to the holder indicating that the person named is allowed to stay indefinitely in the UK, or
has no time limit on their stay in the UK;
A current passport endorsed to show that the holder is exempt from immigration control, is
allowed to stay indefinitely in the UK, has the right of abode in the UK, or has no time limit on
their stay in the UK;
A current Immigration Status Document issued by the Home Office to the holder with an
endorsement indicating that the named person is allowed to stay indefinitely in the UK or has no
time limit on their stay in the UK;
National Insurance number and their name issued by a Government agency or a previous
employer.
A full birth or adoption certificate issued in the UK which includes the name(s) of at least one of
the holder’s parents or adoptive parents;
A birth or adoption certificate issued in the Channel Islands, the Isle of Man or Ireland;
A certificate of registration or naturalisation as a British citizen;
A current Residence Card (including an Accession Residence Card or a Derivative Residence
Card) issued by the Home Office to a non-European Economic Area national who is a family
member of a national of a European Economic Area country or Switzerland or who has a
derivative right of residence;
A current Immigration Status Document containing a photograph issued by the Home Office to
the holder with a valid endorsement indicating that the named person may stay in the UK, and is
allowed to do the type of work in question;
A Certificate of�Application issued by the Home Office under regulation 17(3) or 18A (2) of the
Immigration (European Economic Area) Regulations 2006, to a family member of a national of a
European Economic Area country or Switzerland stating that the holder is permitted to take
employment which is less than 6 months old;
An Application Registration Card issued by the Home Office stating that the holder is permitted
to take the employment in question; and/or
A Positive Verification Notice issued by the Home Office Employer Checking Service to the
employer or prospective employer, which indicates that the named person may stay in the UK
and is permitted to do the work in question.
Engagement Stage:
When you have signed a Contract for Services, supplied all relevant due diligence and
documentation and are a Service Provider to H2O we will process your personal data for the
purposes of communicating, agreeing assignments, routes, organising available work, providing
health and safety briefings and checks, monitoring performance against agreed deliverables,
processing payments and debits.
We process the following data whilst you’re providing services to H2O. Our legal basis to do so is
because we have a contract with you or you would like to enter into a contract with us. We cannot
provide you with a contract without this information.
your name;
home, or registered business address;
home phone number;
mobile phone number;
National Insurance number;
Unique Tax Reference (UTR) Number;
company registration number;
email address;
Nationality;
VAT registration number;
invoice data;
details of receiving a health and safety briefing; and
IP address (DocuSign)
V5 Document (to obtain the relevant VIN details).
Once you become a Service Provider with H2O we will assign you a unique identifier number as
this is a legitimate activity in order to avoid any system errors or mistakes in making payments.
If you have a beneficiary or next of kin, we will collect and process their name, address, phone
and DOB as this is a legitimate activity for us. Next of kin will only be contacted in emergency
circumstances if it is in your vital interest that we do so.
If you have sourced a vehicle through H2O in order to provide services to us, the vehicle will be
fitted with a tracking device that records vehicle location, speed, start and stop times. This data is
processed by us to monitor operational efficiency, provide valuable business intelligence related
to our operations and costs, and to protect our assets. Our legal basis for processing this data is by
virtue of the contract and/or rental agreement we may have in place with you.
Post Termination Stage:
How long do we hold your personal data?
We will hold your personal data that was collected over the two relationship stages above for five
years from when your contractual relationship with H2O is terminated, after which it will be
destroyed. This is a legal obligation.
We will hold your name, email and phone number to send you marketing information as long as
you would like us to do so. If you withdraw your consent, we will hold this data for five years in a
suppression list so that we don’t market to you against your wishes.
If you have started the process to become a Service Provider and then changed your mind, or if
you are not accepted as a Service Provider, we will hold your data for two years, after which it will
be destroyed. We hold it for two years in case it is required for by law enforcement agencies, the
Home Office or for legal reasons.
Do we use any automated decision making?
We do not use any automated decision making in our data processes.
Who do we share your personal data with?
Depending on your personal circumstances we may share your personal data with the following
recipients:
Amazon UK Ltd as a key client of H2O for the purposes of confidential data, security, safety,
performance and quality audits;
Blackbeard Consulting Ltd in the capacity of a professional adviser and business consultancy to
H20;
Disclosure Scotland for the purposes of accessing information from the Disclosure and Barring
Service related to unspent criminal convictions only;
Eurofins NFC UK Limited for the purposes of drug and alcohol screening;
Her Majesty’s Revenue & Customs for the purpose of compliance with relevant personal and
business taxes;
Smart Tax and Accountancy LTD, who can provide personal Tax and VAT management services
for H2O Service providers and its sub-contractors, whom we intend to share your data with,
including emails and phone numbers.
K&O Contracting LTD in the capacity of a professional adviser and business consultancy to H20;
High Court Enforcement Officers Association for the purposes of enforcing High Court writs to
seize and sell assets to settle unpaid judgements;
Home Office for the purpose of any right to work checks or queries;
Organisations that verify publicly available, or private documents and information (e.g. DVLA,
Home Office);
Information Commissioners Office in the event of a request for information or breach;
Insurance companies for the purposes of assessing risk;
Legal advisors and business consultants, as required from time to time, for the purposes of
providing their services to H2O Logistics Limited;
NatWest Bank Plc for the purpose of making payments; and
Remote Asset Management Ltd for the purposes of providing vehicle tracking systems and
telematics data;
Third party social media platforms, Facebook Inc and WhatsApp Inc for the purposes of
communication;
Our various software providers, technology applications and database providers (DocuSign UK
Ltd, Dropbox Inc, Google Plc and Microsoft that are necessary for recording, securing and
updating your personal details and administering services internally as well as external
communications);
Where relevant, we have contracts and/or data sharing agreements in place with the above
parties to ensure that all your personal data is treated with the same level of privacy,
confidentiality and protection as it would be by H2O.
Do we transfer your personal data outside of the EU or EEA?
Your data is kept in the EU or EEA, with the exception of Dropbox Inc, certain Microsoft
Corporation applications and services, Google LLC, Facebook Inc and WhatsApp Inc who have
computer servers and electronic data storage facilities in the United States (“US”).
These organisations comply with the EU-US and Swiss-US Privacy Shield Frameworks as set
forth by the US Department of Commerce regarding the collection, use and retention of personal
data transferred from the European Union, the European Economic Area, the United Kingdom
and Switzerland to the United States.
These organisations have certified to the Department of Commerce that they adhere to the
Privacy Shield Principles with respect to such data. More information about Privacy Shield can
be found online at:
https://www.privacyshield.gov.
Your Rights
By law, you have certain rights in respect of our processing of your personal data.
You have the right:
to have access to your personal data and information about our processing of it. You also have
the right to request a copy of your personal data (but we will need to remove any confidential,
irrelevant or personal data relating to others people);
To rectify incorrect personal data that we are processing;
To request that we erase your personal data if:
we no longer need it;
if we are processing your personal data by consent and you withdraw that consent;
if we no longer have a legitimate ground to process your personal data; or
we are processing your personal data unlawfully;
To object to our processing if it is by legitimate interest;
To restrict our processing if it was by legitimate interest; and
To request that your personal data be transferred from us to another company if we were
processing your data under a contract or with your consent.
If you wish to exercise any of these rights, please email our Data Protection team
on compliance@h2ologistics.co.uk, or write us at:
Tagus House, 9 Ocean Way, Southampton, Hampshire, United Kingdom, SO14 3TJ
You also have the right to lodge a complaint about our processing with the UK’s Information
Commissioner’s Office (“ICO”), however the ICO recommends that we seek to resolve any issues
relating to Data Protection between ourselves prior to them being notified.