Privacy Policy

1. Who we are

Twyft is a courier and parcel delivery service incorporated on the Isle of Man. Our registered address is Twyft, Isle of Man. You can contact us at [email protected].

References to "we", "us" or "our" in this policy refer to Twyft. References to "you" refer to any individual whose personal data we process.

We are a data controller under the Isle of Man Data Protection Act 2018 (IOM DPA 2018), which incorporates the UK GDPR as adapted for the Isle of Man.

2. What data we collect

We collect the following categories of personal data:

• Account data: name, email address, phone number, and password (stored as a secure hash — we never store your plaintext password).
• Booking data: sender and recipient names, delivery and collection addresses, contact numbers, parcel dimensions, weight, declared value, and booking references.
• Payment data: billing address. Card details are processed directly by SumUp and are not stored on our systems.
• Customs and export data: for international shipments, goods descriptions, HS codes, and declared values as required by customs authorities.
• Usage data: pages visited, actions taken on the site, browser type, device type, and IP address — collected only with your consent to analytics cookies.
• Communications: messages you send us via contact forms, support tickets, or email.
• EPOS / counter transactions: if you use our counter service, transaction records including items purchased, payment method, and operator reference.

3. How we use your data

• To process and fulfil your parcel bookings and deliveries.
• To send booking confirmations, tracking updates, and delivery notifications.
• To manage your account and respond to support requests.
• To process payments, issue invoices, and manage credit accounts.
• To comply with customs, export control, and tax obligations.
• To prevent fraud and ensure the security of our services.
• To improve our services through anonymised analytics (only with your consent).
• To send service-related communications where we have a legitimate interest or your consent.

4. Legal basis for processing

• Contract (Article 6(1)(b)): processing your bookings, managing your account, and processing payments.
• Legal obligation (Article 6(1)(c)): tax records, customs declarations, and regulatory compliance.
• Legitimate interests (Article 6(1)(f)): fraud prevention, service security, and improving our operations — where these interests are not overridden by your rights.
• Consent (Article 6(1)(a)): analytics cookies and any optional marketing communications. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. Cookies

We use cookies to operate our website and, with your consent, to understand how visitors use it.

You can withdraw your analytics consent at any time by clicking Manage Cookie Preferences.

6. Who we share data with

We share personal data only where necessary to deliver our services or comply with legal obligations:

• Parcel2Go / EVRi / DPD: recipient name, address, and parcel details to fulfil UK deliveries. These carriers are based in the United Kingdom.
• Easyship: shipment data for international bookings. Easyship processes data in accordance with its own privacy policy.
• SumUp: payment processing. SumUp is certified to PCI DSS Level 1. SumUp's privacy policy governs card data.
• Email delivery providers: your email address to send transactional messages (booking confirmations, tracking updates).
• Isle of Man Customs and Excise / HMRC: customs declarations for international shipments as required by law.
• Professional advisers: accountants, lawyers, and auditors, under duties of confidentiality.

We do not sell your personal data to third parties, and we do not use your data for advertising profiling.

7. International data transfers

Some of our service providers (including SumUp and Easyship) may process data outside the Isle of Man or the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place — such as Standard Contractual Clauses approved by the relevant authority — to protect your data to an equivalent standard as required under the IOM DPA 2018.

8. Data retention

• Booking and transaction records: retained for 7 years to comply with Isle of Man tax and accounting obligations.
• Account data: retained for the duration of your account and for 2 years after closure, unless a longer period is required by law.
• Analytics data: retained for up to 13 months in anonymised form.
• Support communications: retained for 3 years from the date of resolution.

You may request deletion of your account data at any time (subject to legal retention requirements — see Section 9).

9. Your rights

Under the Isle of Man Data Protection Act 2018 you have the following rights:

• Access: obtain a copy of the personal data we hold about you.
• Rectification: have inaccurate or incomplete data corrected.
• Erasure: request deletion of your data where there is no lawful reason to retain it.
• Restriction: ask us to restrict processing in certain circumstances.
• Portability: receive your data in a structured, machine-readable format where processing is based on consent or contract.
• Objection: object to processing based on legitimate interests.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior lawful processing.

To exercise any of these rights, email us at [email protected]. We will respond within one calendar month. You also have the right to lodge a complaint with the Isle of Man Information Commissioner.

10. Security

We use industry-standard security measures including HTTPS/TLS encryption in transit, hashed and salted passwords, role-based access controls, and regular security reviews. No method of transmission over the internet is entirely secure, but we take all reasonable and proportionate steps to protect your personal data against unauthorised access, loss, or disclosure.

11. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or applicable law. The "last updated" date at the top of this page will reflect any changes. Where changes are material, we will notify registered account holders by email. Continued use of our services after notification constitutes acceptance of the revised policy.

12. Contact

For any privacy-related queries or to exercise your rights, contact us at [email protected].