Business Delivery Privacy Notice

1. Who we are

Smart Eatx is run by Smart Approaches Limited, trading as Smart Eatx, a company registered in England and Wales (company number 14796914), whose registered office is at 4 Admiral Way, Regus House, Doxford International Business Park, Sunderland, Tyne and Wear, SR3 3XW. We're the controller of the personal data described in this notice, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Contact us about anything in this notice at hello@smarteatx.com, or by post at our registered office.

2. What this notice covers

This notice covers:

• team members of businesses with a business account: owners, admins, finance, developers and members, using the business portal or the Delivery API;
• recipients and pickup contacts: the people whose details a business gives us so we can collect and deliver its parcels. That includes the customers of restaurants on our Custom App, when we deliver their orders.

Our Business Delivery and API Terms are the contract with the business. Riders are covered by the Rider Privacy Notice, and people sending parcels for themselves by the Send a Package Privacy Notice.

3. Our role, and the business's

For recipients' and pickup contacts' details, we're an independent controller, not the business's processor. The business decides to send a parcel and gives us the details. We decide how the delivery is done, and use the details for our own purposes:

• we choose which of our riders gets the delivery, or whether to pass it to Stuart, and what each of them needs to know;
• we set what's needed at the door: the delivery code, ID checks for alcohol, photos and neighbours' details as proof;
• we keep our own records to pay riders, settle charges, answer complaints and claims, keep riders and the public safe, prevent fraud and meet the law.

The business is a controller too, for its own relationship with the recipient. It must have a lawful basis for giving us the details, and should tell recipients about this notice. If you're a recipient with a question about why a business has your details, ask that business.

4. What we collect about team members

5. How we use team members' data, and our lawful basis

Our contract is with the business. Where the business is a sole trader or partnership, it's with you, and we rely on contract. Otherwise we rely on our legitimate interest in providing the service your business has asked for.

Account messages, receipts and service notices aren't marketing, and we send them whatever your marketing choices.

We review business applications ourselves. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

6. If you're receiving a parcel, or it's collected from you

Where your details come from. The business that booked the delivery gave them to us. If you don't know which business that was, ask us and we'll tell you.

What we receive: your name, phone number and address, and its position on a map; for a pickup, a company name; any notes for the rider; the order reference; and whether the parcel contains alcohol.

What we add: a 4-digit delivery code, a tracking link, the times of each step, and what happened at the door. That can include a photo of where the parcel was left, a neighbour's name and door number, the type of ID shown for an alcohol check (never the ID itself or its number) and the rider's position at hand-over.

Who sees it:

• our rider, who sees your first name and initial, your address and the notes, and can get your phone number to call you while they have your parcel. Each request for it is recorded;
• Stuart, if it carries the delivery for us. It receives the names, phone numbers and addresses at each end, the notes and the order reference, but not email addresses;
• the business that booked it, which sees the delivery's progress and what happened at the door;
• anyone with the tracking link, which shows the delivery's progress, an estimated arrival time, the rider's first name and initial, photo, vehicle and live position, the pickup's name and the drop-off's postcode district, but never a full address;
• our support team, when there's a problem.

We don't send you marketing, and we don't use your details for anything other than this delivery and what follows from it.

You can object to our use of your details. Because we need them to deliver your parcel, objecting before it arrives may mean it's returned to the sender.

7. Who we share data with

Besides our riders and the business itself, we share personal data only with the providers who help us run the service:

We may also share data with our professional advisers and insurers, with the police, regulators or courts when the law requires it, and with a buyer if our business is sold. We never sell personal data.

8. Transfers outside the UK

Our servers are in the European Economic Area, which the UK recognises as protecting personal data adequately. Some providers, such as Stripe, Twilio, Google, Cloudflare and Slack, may process data in the United States or elsewhere.

When data leaves the UK, we make sure it's protected: by UK adequacy regulations (including, for certified US companies, the UK Extension to the EU-US Data Privacy Framework), or by the International Data Transfer Agreement or the UK Addendum issued by the Information Commissioner. Ask us for a copy of the safeguards that apply.

9. How long we keep it

When a team member's account is erased, a business they owned alone passes to its longest-serving admin or member, or is closed if there's nobody else. We keep the record of account events without their IP address and browser details. We keep data longer only if the law requires it, or to deal with a legal claim.

10. How we protect it

We protect data with encryption in transit, passwords and API secrets stored only as hashes, signed webhooks, rate limits, and role-based access for our own staff, who must use two-step sign-in and whose actions are recorded. Proof-of-delivery photos are kept in private storage.

Please help by keeping passwords and API secrets private, and by giving each team member only the role they need.

11. Your rights

You have the right to:

• get a copy of your personal data;
• have inaccurate data corrected;
• have your data erased, or its use restricted, in some circumstances;
• object to our using it on the basis of legitimate interests, and always to direct marketing;
• receive data you gave us in a portable format, in some circumstances;
• withdraw consent at any time, where we rely on it.

To use these rights, email hello@smarteatx.com. If you're a recipient, please give us the delivery's reference or tracking link, so we can find it. We'll answer within one month.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.

12. Cookies and your device

The business portal keeps you signed in with a cookie set by Smart Eatx Accounts, our sign-in service, and stores small notes in your browser, such as whether you're signed in. When you pay, Stripe's payment form loads and may set its own cookies to prevent fraud. Address search loads Google Maps. All of these are strictly necessary for the service, so they don't need your consent. We use no advertising cookies.

Our Cookie Policy explains what our website uses.

13. Changes to this notice

We'll update this notice when how we use personal data changes, and change the date at the top. We'll tell business owners about important changes by email.