How ADOPTR handles personal information.

ADOPTR LTD is the controller of the personal information described in this notice. We are registered in England and Wales under company number 16774516. Our registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

For privacy questions or to exercise a data protection right, email privacy@adoptr.uk. General service enquiries can be sent to hello@adoptr.uk.

This notice covers the public website and booking journey, My ADOPTR, the rescue and driver portals, operational share and tracking pages, enquiries and support.

We may collect:

• identity and contact details, including name, email, phone number, addresses and organisation details
• account and security details, including account identifiers, role, authentication events, IP-derived security records and access logs
• booking and journey details, including collection and delivery contacts, addresses, postcodes, route, status and operational notes
• animal details linked to a booking, including species, microchip, welfare, vaccination, veterinary and test-readiness information
• payer, invoice, payment and accounting records
• messages, support requests, complaints, attachments, photos and audit history
• live or recent vehicle location and journey updates where tracking is enabled
• marketing preference and evidence of when and how it was given or withdrawn

We collect information from you, an authorised account user, a rescue or transport organisation, the person who submits a booking, collection and delivery contacts, payers, drivers, vets or laboratories, and public or official sources where verification is necessary.

If someone else gives us your contact details for a booking, we record the booking requester as the source and send you a privacy notice by the first communication, before disclosure where required, or otherwise within one month unless a lawful exception applies.

• Booking and transport service: to take steps at an individual's request before a contract, perform the contract, and manage collections, delivery, welfare and support.
• Organisation representatives and third-party contacts: our legitimate interests in safely arranging and documenting a requested journey, communicating with the right people and protecting animals and participants.
• Accounts and access: contract and our legitimate interests in providing secure, accountable access to My ADOPTR and the operational portals.
• Import, welfare, tax and regulatory records: compliance with legal obligations and, where relevant, contract and legitimate interests.
• Security, fraud prevention, rate limiting and audit: our legitimate interests in protecting users, animals, the service and our legal position.
• Service improvement and complaints: contract and our legitimate interests in maintaining and improving a reliable service.
• Email marketing: consent under UK data protection law and PECR. Marketing is optional and separate from service messages.

Where we rely on legitimate interests, we consider necessity, reasonable expectations and the effect on the individual. You may object, and we will reassess the balance. We do not treat agreement to this notice as consent to processing needed for a booking.

Fields marked as required are needed to assess or perform the requested service, create secure account access, meet legal requirements or communicate about the journey. If they are not provided, we may be unable to accept or perform the booking. Optional fields, including marketing, can be left blank without affecting the booking.

Please only provide another person's details when you are authorised to do so and the details are genuinely needed for the booking.

We share only what is reasonably necessary with:

• the rescue, importer, exporter, collection and receiving contacts involved in the journey
• drivers, transporters, route and logistics providers
• vets, laboratories and animal-welfare professionals where tests or care are arranged
• APHA, border control posts, customs, regulators, law enforcement and other authorities where required
• providers supporting authentication, database and hosting, email, private file storage, mapping, invoicing and accounting
• professional advisers, accountants, insurers and dispute-resolution providers

Our current technical providers include Supabase for database and authentication, Resend for email, Vercel for hosting, private S3-compatible storage, mapping and route providers, and QuickFile where used for accounting. We do not sell personal information.

A cross-border journey necessarily involves sharing operational details between the UK and relevant contacts in Romania. Some technology providers may also store or access information outside the UK.

Where UK restricted-transfer rules apply, we use a UK adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum, together with a transfer risk assessment where required. Contact us to ask about the safeguard relevant to your information.

• an unverified public booking request is deleted after 7 days; its verification link expires after 24 hours and is single-use
• the completed raw request payload is redacted after it is normalised into the booking record
• booking, account, audit and operational records are normally kept for up to 6 years after the last relevant activity, where needed for contract, legal claims, insurance or regulatory evidence
• invoice and accounting records are kept for the applicable statutory accounting and tax period
• live tracking is exposed only for the active journey window; any retained operational snapshot follows the booking retention period
• marketing evidence is kept while consent is active; after withdrawal we keep the minimum suppression record needed to respect the choice

We may keep a record longer where law, a live dispute, safeguarding or a regulator requires it, and may delete it sooner when it is no longer necessary.

We use role-based access, explicit account-to-booking permissions, private storage, time-limited links, audit records, rate limits and other proportionate safeguards. No online service is completely risk-free.

Pricing by postcode, capacity checks and abuse controls use rules. We do not use solely automated decision-making that produces legal or similarly significant effects about you. A person reviews public bookings before approval.

The person submitting a booking must be at least 18. Our requester accounts are not intended for children.

Booking confirmations, operational updates, invoices and safety messages are service communications, not marketing. We may send one proportionate post-delivery service follow-up under our legitimate interests. You can opt out of that follow-up through My Data or by emailing us.

We send promotional email only where we have a valid basis under PECR. A booking marketing checkbox is optional, unticked by default and names email as the channel. Every marketing email must identify ADOPTR LTD and provide an easy unsubscribe method.

We use essential cookies and storage needed for security, sign-in, forms and user-requested functionality. We will not activate non-essential analytics, advertising, replay or similar tracking without an appropriate consent mechanism. See our Cookie Policy.

Depending on the circumstances, you may ask for access, correction, erasure, restriction, portability, or object to processing. You may withdraw consent at any time without affecting earlier lawful processing and may object to direct marketing at any time.

Email privacy@adoptr.uk. We may need to verify identity and normally respond within one month. If you are unhappy, you can complain to the Information Commissioner's Office. We would appreciate the opportunity to address the concern first.

We review this notice when the service, providers or law changes. The version shown here is the current version. If a change materially affects how we use existing information, we will bring it to affected people's attention before the new use begins where required.