Marketplace Partner Privacy Notice

1. Who we are and who this covers

We are Smart Approaches Limited, trading as Smart Eatx, a company registered in England and Wales (company number 14796914), whose registered office is at 4 Admiral Way, Regus House, Doxford International Business Park, Sunderland, Tyne and Wear, SR3 3XW. We decide how and why the information in this notice is used, so we are its controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

It covers the people connected to a business that sells on the Smart Eatx marketplace: owners, directors and partners, managers, staff with Dashboard or POS logins, and the contacts we deal with. If you're a sole trader, your business details are also your personal information.

Customers' information is covered by our Customer Privacy Notice. If we provide your own branded app, our Custom App Privacy Notice covers that service.

Contact us about your information at hello@smarteatx.com, or write to us at our registered office.

2. What we collect and where it comes from

3. How we use it, and our lawful basis

Our lawful basis is contract where we need the information to perform our agreement with your business (this covers you personally if you're a sole trader or partner). It's legitimate interests where we use the information of people who aren't party to the agreement, such as staff and managers, to run the service for the business they work for. Some uses are a legal obligation.

If we email you news about our services, every email will let you opt out. If you're a sole trader or in a partnership, we'll only send it with your consent or where the law otherwise allows.

We don't use any special category data (such as health information) about owners or staff.

4. Who we share it with

Customers see your business name, address, listing and hygiene rating, and your business name and address appear on their receipts. They don't see your staff's details.

Riders and Stuart. Our riders and Stuart's couriers see your business name, address, the owner's phone number and your information for riders.

Stripe opens and runs your Stripe account and makes payouts. For its identity checks, Stripe acts as a controller in its own right, under its own privacy notice.

Our team. Our authorised staff see what they need to onboard you, support you and manage payouts.

Service providers who handle information for us, on our instructions:

We send the Food Standards Agency only your hygiene rating ID, to look up your public rating.

We may also share information when the law requires it, with the police or a regulator, to prevent fraud, or with a buyer if our business is sold, who would have to respect this notice. We don't sell personal information.

5. Information sent outside the UK

Some providers handle information outside the UK. When it goes to the European Economic Area, it's covered by the UK's adequacy regulations. When it goes to the United States, we rely on the UK's adequacy regulations for organisations certified under the UK Extension to the EU–US Data Privacy Framework. Where a provider isn't certified, or the information goes elsewhere, we use the Information Commissioner's International Data Transfer Agreement, or its Addendum to the EU standard contractual clauses. Ask us if you'd like details.

6. How long we keep it

We may keep information longer if we need it for a legal claim or a regulator, or if the law requires it.

7. Automated decisions

We don't make decisions about owners or staff based only on automated processing that have legal or similarly significant effects on them. Some things happen automatically, such as an order being marked ready when its timer runs out and late-order alerts being sent, but these are about orders, not decisions about people. Decisions to suspend or end a store's listing are made by our team.

8. Your rights

You have the right to:

• access your information and get a copy of it;
• correct information that's wrong or incomplete;
• erase it, where we no longer need it;
• restrict how we use it, for example while we check a complaint;
• object to how we use it where we rely on legitimate interests, and to direct marketing at any time;
• data portability, for information you gave us under the agreement;
• withdraw consent, where we rely on it, without affecting what we did before.

To use them, email hello@smarteatx.com. It's free. We'll reply within one month, or tell you within that month if we need up to two more months because your request is complex. We may ask you to prove who you are. Some rights are limited; for example, we must keep payout records for tax.

Owners can remove staff logins from the Dashboard, and anyone can ask us to delete their own login.

9. Do you have to give us your information?

To sell on the marketplace, a business must give us the owner's contact details, its address and its bank details, and complete Stripe's checks. Without them, we can't list the store, book riders or pay you. Each person who uses the Dashboard or POS needs a login with their name and email address.

10. Keeping it safe

Information is encrypted on its way between your devices and our servers. We store passwords and codes only in scrambled form, offer two-step sign-in and ask for it again before changes to money and team settings, and lock sign-in after repeated wrong attempts. The Dashboard keeps people signed in with a secure cookie, explained in our Cookie Policy.

Please keep logins personal, use strong passwords, and remove people who leave.

11. Complaints

If you're unhappy with how we've used your information, please tell us first at hello@smarteatx.com. We'll acknowledge your complaint within 30 days and try to put things right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.

12. Changes to this notice

We'll update this notice when how we use information changes, and show the date at the top. If a change is important, we'll email the owner.