1. Who this notice covers
DXL SAURON Oracle is the delivery-reporting integration operated by DYNAMIC EXPRESS LOGISTICS LTD (DXL), company number 16694115. Our registered and correspondence address is 20 Nowell Close, Radcliffe-On-Trent, Nottingham, NG12 1FE, United Kingdom. Contact us at admin@dynamicxl.co.uk.
DXL is the controller for the use of information for its own delivery operations described in this notice. It covers authorised business users and people whose information appears in the reports: report ingestion, the designated Google register and PDF archive, the DXL application projection, reviews and related diagnostics. Carrier reporting organisations remain responsible for their own collection and disclosures.
This is an operational business service. Its information website does not provide public access to delivery records or connected accounts.
2. Information and sources
| Information | Source and use |
|---|---|
| Report messages and PDFs | Eligible carrier reports received in DXL's Zoho mailbox: sender, subject, message and attachment references, report dates, original message content and PDF bytes needed to verify a source. |
| Delivery report information | Source reports and the designated reporting register: provider and driver names/identifiers, activity dates, consignment references, postcodes/sectors, service/size/items, report status, observed effort/base amounts, enhancements and totals. Raw PDFs may contain other information printed by the sender. |
| Google resource data | The designated spreadsheet's report rows, audit records, review and derived tables, formula results and file metadata; source PDFs and file references in the designated Drive archive. |
| Review and operational records | Evidence references, hashes, counts, import outcomes, observed-rate signals, review reasons, the authorised reviewer and review time; limited technical diagnostics supporting the service. |
| Authorisation material | OAuth client details and tokens used to connect the approved services; repository credentials for the private coordination journal. These are held separately from ordinary reporting output. |
Report information is generally received from carrier reporting systems and DXL-controlled resources, rather than collected directly from every person named in a report. Authorised reviewers provide review information through the DXL application.
3. Purposes and lawful basis
We use information to consolidate delivery evidence, detect duplicates and inconsistencies in received reports, preserve source traceability, compare observed values, support human review and investigate or recover failed imports.
For operational reporting, accuracy, auditability and service security, our basis is our legitimate interests in running and checking DXL's delivery operations, taking account of the rights and interests of the people concerned. Where documents are required for accounting or tax records, we retain the necessary information to meet the applicable legal obligations. We do not treat a Google account owner's authorisation as consent on behalf of every person named in a report.
We use these reports for DXL operations. This workflow does not sell data, provide advertising profiles or make solely automated decisions with legal or similarly significant effects about a person.
4. Google access and use
Drive and Sheets access
An authorised account owner connects Google so the service can read the designated reporting spreadsheet, archive source PDFs in the designated Drive folder, write validated reporting updates and check the stored results. The requested Drive and Sheets scopes are broader than these individual resources. The service targets configured DXL resources; Google OAuth does not itself restrict this grant to one folder.
Where data goes
The Oracle-hosted service reads report rows, source files and related metadata. Private working snapshots and import plans support validation and recovery. The DXL application stores a reporting projection and review evidence. The private GitHub coordination journal receives metadata such as identifiers, source filenames, hashes, counts and verification outcomes; it does not receive detailed delivery rows or PDF contents.
Limited use and support
DXL limits the use and transfer of information received through Google APIs to the disclosed reporting features and their operation, in accordance with the Google API Services User Data Policy, including its Limited Use requirements. DXL does not authorise this data to be sold, used for advertising, supplied to data brokers or used to train general-purpose AI models.
The scheduled Oracle worker uses versioned parsing and comparison rules and does not call a generative AI model. Separately, owner-authorised support and recovery may use OpenAI's ChatGPT/Codex and connected tools to work on specifically authorised records. This is separate from the scheduled worker. Such support must be limited to the requested reporting task, with appropriate service data controls; it is not permission for unrelated processing or model training.
Human access to Google user data must be limited to the user's affirmative authorisation for the relevant records, necessary security or legal purposes, or other access permitted by Google's Limited Use requirements. New uses or recipients require updated disclosures and any required authorisation before they begin.
6. Retention and deletion
Accounting evidence
Reports that support DXL's accounting records, and the audit history necessary to verify them, are kept for six years from the end of the financial year to which they relate. A documented legal obligation, tax enquiry or dispute may require longer retention.
Other operational information
Other personal data is kept only while needed for its stated operational, security, review or recovery purpose. DXL reviews continuing need at least annually. Temporary working copies are assessed after successful verification or completion of recovery; they do not automatically need the same retention period as the source accounting evidence.
Review and deletion
The DXL administrator is responsible for applying this schedule and recording justified extensions. When retention is no longer necessary, information is to be deleted or anonymised through a controlled review. Unresolved recovery incidents or documented preservation holds must be assessed before removal. The current reporting worker does not automatically delete records at the end of a retention period.
A correction or deletion request is assessed across the source archive, spreadsheet, application, working copies, journals and backups. Corrections retain the evidence needed to explain the change. Where deletion from a backup is not immediate, the retained copy must remain restricted until expiry and any restoration must reapply accepted corrections or deletion requirements. Contact DXL for the backup circumstances applicable to a request.
Revoking Google access stops future authorised access once revocation takes effect. It does not itself delete copies already held by DXL or the providers.
7. Security and human review
The implemented controls include OAuth-based connections, restricted credential files, authenticated application access, source and duplicate validation, serialised imports, readback checks and private coordination records. An uncertain write stops for reconciliation instead of being blindly repeated.
SAURON highlights operational observations. Evidence categories indicate support in the available reports; they are not predictive probabilities. The reporting workflow does not make solely automated decisions with legal or similarly significant effects about a person. It does not change an employment contract, calculate a settlement or authorise a payment.
Source reports and interpretations can contain errors. Authorised people remain responsible for checking evidence and deciding what action, if any, is appropriate.
8. Your choices and rights
You can ask DXL about information concerning you and, where applicable, request access, correction, erasure, restriction, portability or object to processing. These rights depend on the circumstances and legal basis. Where processing relies on consent, you may withdraw it without affecting prior lawful processing.
To disconnect Google, the account owner can review and remove the application's access in Google Account connections. This affects the service's access to the connected register and archive. Contact DXL separately about data already retained.
Contact DXL using the details below to make a request. Provide enough information to identify the relevant record, but do not send passwords, tokens or unnecessary identity documents. DXL may need proportionate identity verification.
You may raise a concern with the UK Information Commissioner's Office. You can also contact DXL first so the issue can be investigated.
9. This information website
This public information website contains no login, data-collection form, analytics script, advertising tracker, remote font or embedded media. Its own pages do not set cookies. It is served over HTTPS from DXL's Oracle infrastructure.
The server processes technical connection information, such as an IP address, to deliver a page and protect the service. This website does not enable per-request access logging. Infrastructure or error diagnostics may contain connection information when needed to investigate an issue and fall under the purpose-based retention and annual review described above.
External links lead to services governed by their own notices. A future addition of analytics, forms or other tracking requires this notice and any necessary choices to be updated before that collection begins.
10. Contact and changes
DYNAMIC EXPRESS LOGISTICS LTD
Company number 16694115
20 Nowell Close, Radcliffe-On-Trent, Nottingham, NG12 1FE, United Kingdom
Support and privacy requests: admin@dynamicxl.co.uk
We may update this notice when the service or its handling of information changes. The effective date is shown above. Material changes to the use of connected data must be disclosed and any required authorisation obtained before the new use starts.