Legal
Operator Privacy Notice
Last updated 31 July 2026
This notice explains what we do with information about you when you work through Recovr as an independent recovery operator. It is written for you, not for lawyers, and it is deliberately specific about the things operators most often ask about: where you are, how jobs reach you, and what your rating does. A separate notice covers customers. If you also use Recovr as a customer, both apply to you in those separate roles. What changed on 31 July 2026: section 9.1 now sets out both right to work routes in full, the British or Irish passport route and the share code route, and section 2 corrects a statement that we hold no immigration document, which was not true of an operator who evidences their identity with a residence permit.
Jump to a section
1. Who is responsible for your information
Dapper Trading LTD, trading as Recovr ("we", "us"), is the data controller for the information described here. That means we decide why and how it is used, and we are accountable for it. Company: Dapper Trading LTD (company number 08800299), trading as Recovr. Registered address: Oak House, Reeds Crescent, Watford, England, WD24 4QP. Data protection contact: privacy@recovr.uk.com. ICO registration: we are not yet registered with the Information Commissioner's Office. The registration number will be added here once registration is complete. In the app: Settings, then Privacy and data.
2. What we collect about you
Who you are. What it includes: your name, date of birth, mobile number, email address and profile photograph. Where it comes from: you, when you sign up. Your business. What it includes: whether you are a sole trader or a limited company, your business name, business address, VAT number if you have one, company number if you have one, and your website. Where it comes from: you, during operator onboarding. Your identity check. What it includes: the legal name, date of birth, nationality, document type, document number and expiry read off your identity document; the result of the chip read where your passport has one; images of your document; the photograph and the short video of your face taken for the liveness test; the score of the match between that face and the photograph on your document; and whether sanctions screening raised anything. Where it comes from: our verification provider (see section 9), and we do receive and keep all of it. This used to say we never received your document or your photograph. That changed on 30 July 2026, when a person at Recovr began reading the evidence rather than a status line, and this notice was corrected to say so. Right to work. What it includes: if you hold a British or Irish passport, that passport. If you do not, the nine-character share code and the date of birth you enter, a note of what the Home Office page showed when a member of our staff opened it, and the identity document you upload, which may be a passport, a national identity card, a residence permit or a driving licence. Where it comes from: you, and the Home Office's own online service. Section 9.1 sets out both routes in full. Insurance. What it includes: your motor insurance certificate and policy schedule as files, your employers' liability certificate if you employ anyone, and the details read out of them, including the insurer, the policy number, the policyholder, the dates and the limitations as to use printed on the certificate word for word. Where it comes from: you. Where you are. What it includes: your position while you are online, and your route while you are on a job. See section 4, this is the most detailed thing we hold about you. Where it comes from: your device. How you work. What it includes: which jobs you were offered, which you accepted, which you declined, which you completed and which you cancelled. Where it comes from: the app, automatically. What customers say. What it includes: your star rating, the number of ratings, any compliments awarded, and the number of jobs you have completed. Where it comes from: customers, after a job. Money. What it includes: your payment account details held with our payment provider, your payouts, your membership payments and your invoices. Where it comes from: you and our payment provider. Communications. What it includes: messages you send in the app, photographs and video you attach, and the fact, time and length of in-app calls. Where it comes from: you. Your vehicle. What it includes: the registration, make, model and photograph of your recovery vehicle. Where it comes from: you, and the official vehicle record. Device and app data. What it includes: your device type, app version, notification token, and how the app is used and where it fails. Where it comes from: your device. What we do not hold. We never see or store the contents of your in-app calls. They connect directly between you and the customer and are not recorded. We never store your full card or bank details, which are held by our payment provider. We do not obtain any immigration decision, visa history or Home Office file about you: from the right to work check we see only the result page the Home Office's own service shows us when your share code is entered. This notice used to say we hold no immigration document at all. That was wrong and was corrected on 31 July 2026: if you choose a residence permit as your identity document, we hold an image of it, and a residence permit is an immigration document.
3. Why we use it, and what allows us to
Setting up and running your operator account. Our legal basis: performance of our contract with you. Verifying who you are and that your business is real. Our legal basis: our legitimate interest in a network customers can trust, and legal obligation where one applies to us. On the right to work check specifically, we rely on legitimate interests today rather than legal obligation, and section 9.1 explains why that is the honest answer while you are engaged as an independent business. Checking your insurance is valid and current. Our legal basis: performance of our contract, and our legitimate interest in customer safety. Finding you when a nearby job comes in. Our legal basis: performance of our contract with you, without it we cannot send you work. Showing the customer where you are while you are on their job. Our legal basis: performance of our contract, and our legitimate interest in the customer knowing help is coming. Paying you, and taking your membership payment. Our legal basis: performance of our contract, and legal obligation for tax and accounting records. Handling disputes about a job, a cancellation or a payment. Our legal basis: legitimate interest in resolving disputes fairly with evidence, and legal obligation where a claim follows. Showing your rating and vehicle to customers. Our legal basis: legitimate interest in customers being able to see who is coming to them. Keeping the platform safe and preventing fraud. Our legal basis: legitimate interest in protecting customers, operators and the business. Meeting our legal and regulatory duties. Our legal basis: legal obligation. Where we rely on legitimate interests, we have considered whether our reasons are outweighed by your interests and rights. You can ask us for that assessment, and you can object: see section 10.
4. Your location: exactly what we do
Read this section even if you read nothing else. This is the most detailed information we hold about you, and we would rather you understood it than discovered it.
4.1 When we collect it
We collect your location whenever you are online in the operator app, whether or not you are on a job. We do this because dispatch works by distance: when a customer books, we look for the operators nearest to them. If we did not know where you were while you were available, we could not offer you work. To do this the app asks for permission to use your location in the background, meaning while the app is not open on your screen. We ask for this and not the lesser permission because a job can arrive while your phone is in your pocket and you are driving.
4.2 How precise it is
It is precise. Your position updates as you move, roughly every ten to twenty metres of travel, at the highest accuracy your device provides. While you are on a job we also keep the route you actually drove, because that record is what proves you attended, and what calculates a cancellation fee fairly if a customer cancels while you are on your way.
4.3 When we stop
We stop when you go offline. Going offline in the app stops us collecting your position. You can also switch the permission off entirely in your phone settings at any time, but you will not receive job offers while it is off, because we will not know whether you are near a job.
4.4 Who sees it
Our dispatch system. What it sees: your position, to work out which jobs are near you. When: while you are online. The customer on your job. What they see: your position on a map, and your estimated arrival time. When: from the moment you accept until the job ends. Other customers. What they see: nothing. Waiting customers see anonymous vehicles moving on the map with no identity attached. When: never linked to you. Our staff. What they see: your position and route on a specific job, when investigating a dispute or a safety issue. When: only when there is a reason. Other operators. What they see: nothing at all. When: never.
5. How jobs are allocated to you
We are required to explain how we decide which operators are offered which jobs, and we would want to anyway. Here is how it works. When a customer books, we search outwards in five stages: about five miles, then ten, fifteen, twenty and finally twenty-five miles. Each stage also has a limit on driving time, so an operator five miles away across a city may not qualify where one five miles away on open road does. If nobody accepts, we widen to the next stage after about thirty seconds. Within each stage, the job is offered to every operator who qualifies, not just the closest one. Whoever accepts first gets it. What decides whether you qualify: whether you are online at that moment; how far you are from the customer, and how long the drive would take; whether your vehicle type suits the job; whether your account is verified and your membership is active; and whether you are already on another job. Your rating does not decide whether you are offered a job. It is shown to customers so they know who is coming, and a customer may form a view from it, but our dispatch does not rank you by it or hide you because of it. Declining a job carries no penalty. You can decline any job for any reason. We record that you declined, because we need to know whether an offer was answered, but declining does not reduce the jobs you are offered afterwards and does not affect your rating.
6. Your rating, and what it is used for
After a job, a customer may rate you from one to five stars and award compliments. Your rating is the average of those, alongside the number of ratings you have received and the number of jobs you have completed. Until you have completed three jobs and received your first rating, customers see "New operator" rather than a score. We do not invent a starting rating for you. Ratings are visible to customers, to you, and to our staff. Individual ratings are not shown to you attached to a named customer.
7. Decisions about you are made by people
No automated suspension, deactivation or down-ranking. We do not use software to suspend you, remove you, or reduce the work you are offered. If we ever suspend or end your access, a person will have decided it, you will be told the reasons in writing, and you will be able to challenge it through our operator complaints process. Some things do happen automatically: matching you to nearby jobs, calculating a cancellation fee from the distance you actually travelled, and flagging unusual activity for a person to look at. None of those end your ability to work without a human decision. If any calculation affecting your money looks wrong to you, ask us and a person will review it.
8. Who we share your information with
The customer on your job. What they get: your name, photograph, rating, vehicle, number plate and live position. Why: so they know who is coming and can see you approaching. Our identity and business verification provider. What they get: the information needed to verify you. They perform the check and return only the outcome and your verified name to us. Why: legal obligation and network trust. Our payment provider. What they get: the details needed to pay you and to take your membership payment. Why: to pay you. Our hosting, messaging and mapping providers. What they get: only what is needed to run the service. Why: to operate the app. Insurers, and our professional advisers. What they get: information relevant to a specific claim, dispute or advice. Why: only where there is a claim, dispute or legal need. The police, or a regulator. What they get: information they are entitled to require. Why: where we are legally obliged, or where someone's safety is at risk. We never sell your personal information, and we never share it with other operators.
9. Your identity check, and your consent to it
Verifying who you are involves your identity document and a photograph of your face. Comparing your face to your document creates biometric information, which the law treats as a special category needing your explicit consent. We ask for that consent before the check begins, and you can refuse. If you refuse, we cannot let you work through Recovr. That is not a penalty: we are required to know who is being sent to a customer, often alone, often at night, and we will not send someone we have not verified. Who performs it: Didit Identity Spain, S.L., Calle Napoles 227, 08013 Barcelona, Spain, as our processor and on our instructions. What they receive: your identity document, a photograph and short video of your face, your insurance documents, and your share code if you give us one. What we receive and keep: all of it. The images and the video are copied into our own private storage when the check finishes, because the links Didit gives us stop working after sixty minutes, and a reviewer opening your file the next day would otherwise see nothing. A file with no evidence in it is a rubber stamp, and we are not willing to approve people that way. Who looks at it: a named member of Recovr staff, and only through an internal console that logs who opened your file and when. The images are never on a permanent link: each time a page is opened it requests links that stop working five minutes later, so nothing can be forwarded or pasted somewhere it outlives the review. What no machine decides: whether you can work. Didit returning "approved" is its opinion. A person reads the evidence and clears you service by service, and if they refuse something they have to write why, in words meant for you, and you can send that one document again without repeating the rest. How long we keep it: the photograph and video of your face, and the images of the face on your document, are deleted 12 months after the check. Your document images and insurance documents are deleted 6 years after the check, because a claim about a job can be brought for six years. Right to work evidence goes two years after you stop working with us. We keep the record that a check happened, and who decided what, for six years after that. Where it is processed: within the European Economic Area, and stored in the United Kingdom. Their other use of it: they may use anonymised information to improve fraud detection, as a controller in their own right. You can object by asking us to delete the underlying record, or by contacting them at privacy@didit.me. Withdrawing consent: tell us at privacy@recovr.uk.com. We will delete the face and liveness captures and ask them to delete their copy. We keep the record that a check was completed and who approved it, because we have to be able to show why we let somebody onto the road. You will not be able to continue working through Recovr, because we can no longer confirm who you are. Assessment: because this involves biometric data we completed a data protection impact assessment before storing any of it, as Article 35 UK GDPR requires. You can ask for a summary of it at privacy@recovr.uk.com.
9.1 Your right to work check: the two routes
Before the check starts we ask you one question: do you hold a British or Irish passport? Your answer decides which of two routes you go down, and nothing else about your immigration status is asked. We ask it first, rather than working it out from your documents, so that you are never sent looking for paperwork that does not apply to you. IF YOU HOLD A BRITISH OR IRISH PASSPORT. That passport is your evidence on its own, and no share code is involved. You photograph it in the app and Didit reads it, reads the chip inside it where your passport has one, takes a short video of your face to confirm a live person is present, and compares that face to the photograph in the document. We receive all of it. A named member of Recovr staff then opens the evidence and decides. Didit returning "approved" is not the decision; the person is. IF YOU DO NOT. Your right to work is evidenced by a share code, not by a document, because a share code is what the Home Office's own service reads. You generate the nine-character code free at gov.uk/prove-right-to-work and enter it, with your date of birth, in the same Didit flow. A named member of Recovr staff then opens the Home Office online right to work service, enters your code and date of birth, and reads the result page, which shows your photograph and what you are permitted to do. We keep a note of what that page said and when it was checked. We do not receive your immigration history, your visa, or any Home Office file: only that page. You are also asked for an identity document on this route, because the share code proves what you may do and not who you are, and we still have to know who is being sent to a customer. It can be a passport, a national identity card, a residence permit or a driving licence, from any country. If you choose a residence permit, then yes, we hold an image of an immigration document, and section 2 says so. IF YOUR PERMISSION HAS AN END DATE, we check again before it runs out. If it lapses you stop receiving work until it is renewed, and we will tell you before that happens rather than after. WHY WE DO THIS AT ALL, stated plainly because it is not what most people assume. The illegal working civil penalty applies to employers, and you are not our employee: you are an independent business, and the marketplace you work through is not currently caught by it. So today we run this check because we choose to, in our legitimate interest and yours, not because a law compels us. That is changing. The Border Security, Asylum and Immigration Act 2025 extends the right to work scheme to individual sub-contractors and to online matching services that put service providers in front of customers for payment, which is exactly what Recovr is. It is not in force at the date of this notice, and it is expected during 2026. We would rather already be doing the check properly than start doing it in a hurry the week it commences. WHAT WE DO NOT DO WITH IT. Your nationality and your route through this check play no part in which jobs you are offered, what you are paid, or your rating. Section 5 sets out what dispatch actually uses, and this is not in it.
10. Who inside Recovr can see your information
Our staff use an internal console to run the service. Access is limited to the people who need it, every member of staff signs a confidentiality agreement, and what they do in the console is logged. They can see your account, business details and verification status, to approve you, support you and answer your questions. They can see the evidence behind your verification, meaning the images of your identity document, the photograph and video of your face, and your insurance documents, in order to decide whether to clear you. That is the whole point of the check being made by a person: nobody can approve you without looking. The images are reached only through links that stop working after five minutes, every file that is opened is recorded against the member of staff who opened it, and looking at a record you have no business reason to see is a disciplinary matter. They can see jobs you have done, and your position and route on a specific job, to investigate a dispute, a complaint or a safety concern. They can see your ratings and job history, to handle a complaint about a job. They can see your payouts, invoices and membership payments, to resolve a payment query. They can see messages sent on a job, only when investigating a specific dispute or safety issue. Staff do not browse operator locations for interest. Live position is looked at in connection with a specific job or a specific problem, and that access is recorded.
11. Where your information is held
Your information is held in the United Kingdom and the European Economic Area wherever possible. Some of our providers process data outside the UK. Where that happens we rely on either a UK adequacy decision for that country, or the International Data Transfer Agreement or Addendum approved by the Information Commissioner, together with an assessment of the protections in that country. Identity and business verification. Who: Didit Identity Spain, S.L., Barcelona. Where: Spain. Safeguard: UK adequacy regulations for the EEA. No additional safeguard needed. Database and hosting. Who: Supabase. Where: data held in Frankfurt, Germany. The provider is established outside the UK and EEA and can access it from there. Safeguard: EU Standard Contractual Clauses (Module 2) as amended by the ICO's UK Addendum. Frankfurt hosting alone would not be enough, because the access is the transfer. Payment processing. Who: Stripe Payments Europe, Limited. Where: Ireland, then the United States and other Stripe locations. Safeguard: UK Extension to the EU-US Data Privacy Framework, with the UK Addendum to the EU SCCs as the fallback. Transactional email. Who: Sendinblue SAS, trading as Brevo. Where: servers in France and Belgium; group access from Germany, India, the United States and Austria. Safeguard: adequacy covers the European servers. Written confirmation of the safeguard for the wider access is outstanding and is recorded as a gap. Push notifications. Who: OneSignal, Inc. Where: servers in the Netherlands, accessed from the United States. Safeguard: UK Extension to the EU-US Data Privacy Framework, with the UK Addendum to the EU SCCs behind it. Crash reporting. Who: Google Cloud EMEA Limited. Where: Ireland, then wherever Google operates. Safeguard: adequacy for the Irish leg; UK Extension to the EU-US Data Privacy Framework onward. Usage analytics. Who: Google Ireland Limited. Where: Ireland, then wherever Google operates. Safeguard: a separate contract from crash reporting, on the same footing. Reading your insurance certificate. Who: Google Cloud EMEA Limited. Where: European Union only. We use Google's European endpoint deliberately so the document does not leave it. Safeguard: adequacy. No transfer outside Europe. Checking that certificate. Who: Google Cloud EMEA Limited. Where: Ireland, then wherever Google operates. This one cannot be restricted to Europe. Safeguard: adequacy for the Irish leg, then the UK Extension. Google does not use it to train its models. In-app calls. Who: Cloudflare, Inc. Where: Cloudflare's network. It carries both parties' IP addresses and call timing; it cannot decrypt the audio. Safeguard: UK Extension to the EU-US Data Privacy Framework, with the UK Addendum behind it. Vehicle and mapping data. Where: United Kingdom. Safeguard: no transfer. You can ask us for a current copy of this schedule at any time, including the transfer safeguard we rely on for each provider.
12. How long we keep it
Your account and business details: while you are an operator, then 12 months. Why that long: to reinstate you easily if you return, and to answer questions shortly after you leave. Verification outcomes, your verified name, and the record of who approved you: 6 years. Why that long: a claim about a job can be brought for six years, and for that long we may have to show what we checked before sending you to a customer. The photograph and video of your face, and the face images taken from your document: 12 months from the check. Why only that long: these are biometric data, the law treats them as more sensitive than the rest, and once the review is done and any challenge to it has passed there is no reason to hold them. We deliberately do not keep them for the six years we keep documents. Images of your identity document: 6 years from the check. Why that long: the same six-year claim period. Insurance documents: 6 years after the policy expires. Why that long: a claim can be brought years after the work was done. Right to work evidence: while you work with us and two years after that, following Home Office guidance. Why that long, and no longer: after that the check no longer protects us and keeping copies of your documents has no purpose. Your location while online, not on a job: 30 days. Why that long: only needed to run dispatch. It has no long-term purpose. Your route on a completed job: 12 months. Why that long: long enough to answer a dispute about attendance or a cancellation fee. Your route on a disputed job: until the dispute ends, then 6 years. Why that long: it is the evidence. Job records, invoices and payouts: 6 years. Why that long: tax and accounting law, and the limitation period for a claim. Messages and call records on a job: 90 days, longer if the job is disputed. Why that long: support and disputes. Your ratings: while you are an operator. Afterwards they are reduced to anonymous statistics. Why that long: customers rely on them while you are working; nobody needs them attached to you afterwards. Where something is held in a backup, it is deleted when that backup is overwritten in the normal cycle, and it is not restored back into the live service.
13. Your rights
Ask what we hold: we will give you a copy, normally within one month. Ask us to correct it: if something is wrong, tell us and we will fix it. Ask us to delete it: we will, unless we are legally required to keep it, for example accounting records. Object to how we use it: particularly where we rely on legitimate interests. Tell us why and we will stop unless we have compelling grounds not to. Ask us to restrict use: while a dispute about accuracy or our reasons is resolved. Ask for it in portable form: for information you gave us, in a machine-readable file. Withdraw your consent: for the biometric part of your identity check, and for anything else we asked your consent for. It is free, and it takes effect immediately going forward. It does not undo a check already completed: we delete the face and liveness captures and keep the record that the check happened and who approved it, because we have to be able to show why we let somebody onto the road. See section 9. Complain: to us, and to the Information Commissioner. To use any of these, contact us at privacy@recovr.uk.com. We will not charge you and we will not treat you differently for asking. If something goes wrong with your data: where a breach of security is likely to put your rights or freedoms at risk we will tell you without undue delay, in plain words, and say what we are doing about it. Where the law requires it we also report it to the Information Commissioner within 72 hours of becoming aware. A breach involving your identity documents or the images of your face we would treat as high risk by default, and tell you, rather than assessing our way out of telling you.
14. Complaining
Please tell us first, so we can put it right: privacy@recovr.uk.com. If you are not satisfied you can complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or at ico.org.uk. You can complain to them without telling us first.
15. Changes
If we change this notice we will tell you in the app before the change takes effect, and we will give you at least 15 days' notice of any change that materially affects you, unless a shorter period is required by law. The version and date at the top always tell you which version applies.
Recovr is a trading name of Dapper Trading LTD. Registered in England and Wales, Company No. 08800299. VAT No. 190396586. Registered office: Oak House, Reeds Crescent, Watford WD24 4QP, UK. Questions? Email recovr@webmastersldn.com.