PRIVACY POLICY
Last Updated: August 10, 2025
1. Introduction
Welcome to DrFast ("drfast.uk", "we," "our," "us"). We are committed to protecting and respecting your privacy.
This privacy notice tells you the types of information we collect about you when you visit our website drfast.uk (the "Site") and use our products and services or which we otherwise obtain directly from you or a third party, how we use that information, and the instances in which we share your information.
This privacy notice may change occasionally, so please check this policy regularly.
Our Site, products and services are not intended for children, and we do not knowingly collect data relating to children.
For this privacy notice, "personal data" means any information that identifies you or allows you to be identified when combined with other information. Please read this policy carefully to understand our views and practices regarding your personal data and how we will treat it.
2. Overview
Our methodology for safeguarding data security and ensuring privacy encompasses, without limitation, the following critical measures:
- We meticulously and comprehensively follow the requirements of the UK General Data Protection Regulation ("UK GDPR").
- Our Site is strengthened with cutting-edge, state-of-the-art security protocols to protect against unauthorised access and data breaches.
- We implement robust encryption protocols that secure all customers' and end-users data, ensuring that such information remains confidential and protected from unauthorised disclosure.
- Our operations rely on utilising top-notch cloud service providers who adhere to exemplary and stringent security standards, ensuring our infrastructure remains resilient and secure against potential threats.
3. The Data We Collect
As drfast.uk, we offer our services to real people and businesses that offer their services to their customers. While using our services, we may ask our users to provide us with certain personal data that can be used to contact or identify them, which are listed as follows:
- Identity Data includes first name, maiden name, last name, username or similar identifier and title.
- Contact Data includes billing address, email address and telephone numbers.
- Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us, including the type of card used for a particular transaction (but not any other card details). We do not process all credit card details and actual transaction data. Only payment service providers collect such information.
- Technical Data includes internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this Site.
- Profile Data includes your username and password, purchases or orders made by you, your job title, profession, employer, interests, preferences, feedback and survey responses.
- Usage Data includes information about how you use our Site, products and services.
- Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.
- Content Data includes any content you upload onto the Site, such as comments and other text or images containing personal data.
We also collect, use and share Aggregated Data, such as statistical or demographic data, for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific Site feature. However, suppose we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you. In that case, we treat the combined data as personal data, which will be used in accordance with this privacy notice.
We use cookies and similar tracking technologies to track activity on our service and store certain information. Cookies are files with a small amount of data, which may include an anonymous unique identifier, sent to your browser from a website and stored on your device. Tracking technologies also used are beacons, tags, and scripts to collect and track information and to improve and analyse our services.
4. The Usage of Data
We utilise the information collected from users for various essential purposes, including but not limited to delivering, sustaining, and enhancing the quality and functionality of our services. Additionally, we use this data to inform you of any updates, modifications, or changes to our services and enable your participation in the interactive features of our services, should you choose to engage in them. The information is also employed to offer and facilitate customer support, addressing any inquiries or issues you may encounter. Furthermore, we compile analyses and gather valuable insights contributing to our service's ongoing improvement and refinement. In monitoring and assessing the utilisation patterns of our services, we ensure optimal performance and identify, prevent, and resolve any technical problems that may arise, thereby safeguarding the integrity of our services. Lastly, we use the collected data to furnish you with news, exclusive offers, and general updates concerning other products, services, or events provided by us that are similar to those you have previously purchased or shown interest in, except in cases where you have explicitly chosen to opt out of receiving such communications.
Below are listed all processing activities, including which we plan to use your personal data and which legal bases we rely on. We have also identified our legitimate interests where appropriate.
| Purpose/Activity | Type of data | Lawful basis for processing, including basis of legitimate interest |
|---|---|---|
| To register you as a new customer/user | (a) Identity (b) Contact (c) Profile |
(a) Performance of a contract with you (where you are using the Site as an individual) (b) Necessary for our legitimate interests (where you are using the Site as an authorised user of one of our enterprise customers, for us to perform our contract with that customer, to optimise your onboarding and user experience by ensuring you receive relevant instructions and tutorials regarding the use of our Site, products and service) |
| To process and deliver orders for our products and services, including: (a) Manage payments, fees and charges (b) Collect and recover money owed to us |
(a) Identity (b) Contact (c) Transaction (d) Marketing and Communications |
(a) Performance of a contract with you (b) Necessary for our legitimate interests (to recover debts due to us and verify you are entitled to any student discount we offer) |
| To manage our relationship with you, which will include: (a) Notifying you about changes to our terms or privacy policy (b) Asking you to leave a review or take a survey (c) Dealing with your enquiries and complaints |
(a) Identity (b) Contact (c) Profile (d) Marketing and Communications |
(a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests (to keep our records updated and to study how customers use our Site, products and services) |
| To enable you to partake in a prize draw or competition or complete a survey | (a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications |
(a) Performance of a contract with you (b) Necessary for our legitimate interests (to study how customers use our Site, products and services, to develop them and grow our business) |
| To administer and protect our business and this Site (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data) | (a) Identity (b) Contact (c) Content (d) Technical |
(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise) (b) Necessary to comply with a legal obligation |
| To make claims or defend claims in relation to our Site and services | (a) Transaction (b) Content |
Necessary for our legitimate interests (to ensure we are able to resolve disputes with customers relating to our Site and services) |
| To restore our Site and services in the event of an issue which prevents them from functioning properly | (a) Transaction (b) Content (c) Usage (d) Technical (e) Profile |
Necessary for our legitimate interests (to ensure we meet our customer service levels for availability and can continue to provide our Site and services to customers if there is an issue). |
| To deliver relevant Site content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you | (a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications (f) Technical (g) Content |
Necessary for our legitimate interests (to study how customers use our Site, products and services, to develop them, to grow our business and to inform our marketing strategy) |
| To use data analytics to improve our Site, products and services, marketing, customer relationships and experiences | (a) Technical (b) Usage (c) Content |
Necessary for our legitimate interests (to define types of customers for our products and services, to keep our Site updated and relevant, to develop our business and to inform our marketing strategy) |
| To make suggestions and recommendations to you about goods or services that may be of interest to you | (a) Identity (b) Contact (c) Technical (d) Usage (e) Profile (f) Content |
Necessary for our legitimate interests (to develop our products/services and grow our business) |
5. Remarketing and Behavioral Targeting
None
6. Data Sharing with Third Parties
We share data with vendors of third-party tools to enable the Site to function and manage its services. These below-listed vendors help us deliver the best functionality and user experience for our users:
| Subprocessor Name | Location of Processing | Purpose & Applicable Service |
|---|---|---|
| Amazon Web Services | United Kingdom | Used for server hosting |
| Amplitude | United States of America | Used for analytics |
| Facebook Ads | United States of America | Used for advertising |
| Google Ads | United States of America | Used for advertising purposes |
| Google Analytics | United States of America | Analytics provider |
| Google Data Studio | United States of America | Used for analytics purposes |
| Google Drive | United States of America | Used for files and documents |
| Google, Inc | United States of America | Regional data hosting provider |
| Metabase | United States of America | Used for business intelligence |
| Mixpanel | United States of America | Used for product analysis |
| Segment | United States of America | Used for analytics |
| Twilio | United States of America | Used for Communication Services |
7. Data Storage and Security
7.1. Data Storage Location
All user data is stored, handled, and processed by Amazon Web Services servers in the UK, ensuring compliance with the UK GDPR.
7.2. Security Measures
We have implemented appropriate security measures, including encrypting all collected user information, to prevent your personal data from being accidentally lost, used or accessed unauthorised, altered or disclosed. All data is stored on highly secured servers with ISO 27001 and ISO 27701 information security system quality certifications. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data according to our instructions and are subject to confidentiality duties.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
8. Data Retention
We will retain your personal data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your personal data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.
We will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when it is used to strengthen security or improve the functionality of our services or when we are legally obligated to retain it for longer periods.
If customers or individuals request the deletion of their data, we will perform this deletion within five (5) working days.
9. User Rights
Under certain circumstances, you have the following rights under data protection laws with your personal data:
- Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
- Request correction of the personal data we hold about you. This enables you to correct any incomplete or inaccurate data, though we may need to verify the accuracy of the new data you provide.
- Request to erasure your personal data. This enables you to ask us to delete or remove personal data without an acceptable reason for continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons, which will be notified to you, if applicable, at the time of your request.
- Object to processing of your personal data where we rely on a legitimate interest (or those of a third party), and something about your particular situation makes you want to object to processing on this ground as you feel it impacts your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling, legitimate grounds to process your information, which overrides your rights and freedoms.
- Request restriction of processing your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data's accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have to override legitimate grounds to use it.
- Request the transfer of your personal data to you or a third party. We will provide you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information you initially provided consent for us to use or where we used the information to perform a contract with you.
- Withdraw consent when we rely on it to process your personal data; however, this will not affect the legality of any processing carried out before your withdrawal. Please note that if you withdraw your consent, we may be unable to provide certain products or services, and we will inform you accordingly should this situation arise.
If you wish to exercise any of the rights set out above, please send your requests to support@drfast.uk.
10. Changes to This Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. You are advised to review this Privacy Policy periodically for any changes.