Custom App Privacy Notice

1. Who we are

Smart Eatx is run by Smart Approaches Limited, trading as Smart Eatx, a company registered in England and Wales (company number 14796914), whose registered office is at 4 Admiral Way, Regus House, Doxford International Business Park, Sunderland, Tyne and Wear, SR3 3XW. We're the controller of the personal data described in this notice. That means we decide how and why it's used, and we're responsible for it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact us about anything in this notice at hello@smarteatx.com, or by post at our registered office.

2. What this notice covers

This notice covers the people who run a restaurant on our Custom App: its owners, managers and staff who use the Dashboard, the POS and kitchen system, and their logins. Our Custom App Terms are the contract with your restaurant.

It also explains, in Your customers' data, how we handle the data of your restaurant's customers in its branded app and website.

Other notices cover other things:

• orders through the marketplace, the Marketplace Business Privacy Notice and the Order Food Privacy Notice;
• deliveries we carry out, the Business Delivery Privacy Notice;
• enquiries and demo requests through our website, the Website Privacy Notice.

3. What we collect about you

Stripe's checks. Stripe collects identity details from the restaurant's owner, such as date of birth and identity documents, to approve its payout account. Stripe does this as a controller in its own right, under its privacy policy. We see only the account's status and what Stripe tells us.

4. How we use it, and our lawful basis

The UK GDPR says we must have a lawful basis for each use of your data. Where your restaurant is a sole trader or partnership, our contract is with you. Otherwise it's with your restaurant, and we rely on our legitimate interest in providing the service it has asked for.

Where we rely on legitimate interests, we've balanced them against your rights. You can ask us for details, and you can object.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Your customers' data

Your customers sign up and sign in to your branded app and website in your restaurant's own sign-in space, separate from the marketplace and from every other restaurant. Their profiles, addresses and orders are kept for your restaurant alone.

For this data, your restaurant is the controller and we're its processor. We process it only on your restaurant's instructions, under the data processing schedule in our Custom App Terms. That schedule lists the sub-processors we use and our security measures.

This means:

• your restaurant's own privacy notice tells customers how their data is used, and they should contact your restaurant with questions;
• if a customer contacts us about their data, we pass the request to your restaurant and help it answer;
• we never use your customers' data for our own marketing, or sell it.

We act for ourselves, as a controller, only when we carry out deliveries; when we take card payments on our Stripe account and keep the records the law and card scheme rules require; when we protect the service from fraud and attacks; and when the law requires it.

Your website includes a template privacy policy in your restaurant's name. Check that it's accurate for your restaurant, and tell us what to change.

6. Who we share it with

We share your data only with the providers who help us run the service, under contracts that require them to protect it and use it only for us:

We may also share data with our professional advisers and insurers, with the police, regulators or courts when the law requires it, and with a buyer if our business is sold. We never sell your personal data.

7. Transfers outside the UK

Our servers are in the European Economic Area, which the UK recognises as protecting personal data adequately. Some providers, such as Twilio, Google and Slack, may process data in the United States or elsewhere.

When data leaves the UK, we make sure it's protected: by UK adequacy regulations (including, for certified US companies, the UK Extension to the EU-US Data Privacy Framework), or by the International Data Transfer Agreement or the UK Addendum issued by the Information Commissioner. Ask us for a copy of the safeguards that apply.

8. How long we keep it

We keep data longer only if the law requires it, or to deal with a legal claim.

9. How we protect it

We protect your data with encryption in transit, passwords stored only as strong hashes, optional two-step sign-in for every login, and role-based access for our own staff, who must use two-step sign-in and whose actions are recorded. Each store's data is kept apart from every other store's.

Please help by keeping your password private and turning on two-step sign-in.

10. Your rights

You have the right to:

• get a copy of your personal data;
• have inaccurate data corrected;
• have your data erased, or its use restricted, in some circumstances;
• object to our using it on the basis of legitimate interests, and always to direct marketing;
• receive data you gave us in a portable format, in some circumstances;
• withdraw consent at any time, where we rely on it.

To use these rights, email hello@smarteatx.com. We'll answer within one month. If you're one of your restaurant's customers, please contact the restaurant first, as it's responsible for your data.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.

11. Cookies and your devices

The Dashboard keeps you signed in with a cookie set by Smart Eatx Accounts, our sign-in service. The POS app keeps your login on the device. Both are strictly necessary for the service, so they don't need your consent. We use no advertising cookies.

Our Cookie Policy explains what our website uses.

12. Changes to this notice

We'll update this notice when how we use personal data changes, and change the date at the top. We'll tell your restaurant's owners about important changes by email.