Customer Privacy Notice

1. Who we are

We are Smart Approaches Limited, trading as Smart Eatx, a company registered in England and Wales (company number 14796914), whose registered office is at 4 Admiral Way, Regus House, Doxford International Business Park, Sunderland, Tyne and Wear, SR3 3XW. We decide how and why your personal information is used, so we are its controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This notice is for customers who order food or groceries in the Smart Eatx app, with an account or as a guest. It doesn't cover a restaurant's own branded app (that restaurant's privacy notice does), our riders (see our Rider Privacy Notice) or visitors to our website (see our Website Privacy Notice and Cookie Policy).

To ask about your information or to use your rights, email hello@smarteatx.com or write to us at our registered office.

2. What we collect and where it comes from

The app doesn't send us your phone's location. We use the address you give us to show stores that deliver to you, to work out the delivery fee and to guide the rider.

3. How we use it, and our lawful basis

The law only lets us use personal information when we have a lawful basis. Ours are: contract (we need it to provide what you've asked for), legal obligation (the law requires it), legitimate interests (it's needed for a reasonable purpose of ours, and your interests don't outweigh it) and consent (you've said yes).

Where we rely on legitimate interests, we've weighed them against your rights, and you can object (see Your rights).

4. Allergies, dietary needs and other sensitive information

Some information can reveal something about your health or your beliefs. The UK GDPR calls this special category data and gives it extra protection. We don't ask for it, but some of what you tell us may include it.

Notes on your order. If you mention an allergy, intolerance or medical need in a note, that's health information. The note goes to the store, and to the rider or Stuart courier who delivers your order. By including it, you give your explicit consent for us to share it with them for that order. Only include what they need to know. You can ask us to remove it from our records once your order is over.

Dietary preferences. If you choose preferences such as gluten-free or halal, they could suggest something about your health or religion. We use them only to show you suitable stores and items, with your explicit consent, which you give by choosing them. You can remove them at any time, and we won't use them after that.

Support chats. If you tell our team about a health problem, such as a reaction after a meal, we use it only to deal with your complaint. We rely on your explicit consent, or on the need to establish, exercise or defend a legal claim.

ID checks. For age-restricted items, the rider looks at your ID. We record only that it was checked and what type of ID it was. We don't keep a copy or record its number.

We don't collect information about criminal offences.

5. Who we share it with

The store you order from. It receives your name, phone number, order and note, and for a delivery your address, which is printed on its kitchen ticket. It uses them as a separate controller, only to prepare and hand over your order and to deal with any problem with it. Our terms with stores don't allow them to use your details for their own marketing.

Riders and Stuart. The rider gets your name, phone number, address and note. If Stuart delivers, we send Stuart the same details, and its courier uses them only to deliver your order. In return, you see the name of whoever delivers. For our riders, you also see their photo, vehicle, rating and phone number, so you can call them.

Other customers. Signed-in customers can see your reviews, with your name and profile picture.

Our team. Our authorised staff see what they need for support, operations and refunds.

Service providers who handle information for us, on our instructions:

Stripe also uses payment information as a controller in its own right, for its legal duties and to prevent fraud.

We may also share information when the law requires it, with the police or a regulator, to prevent fraud or to protect someone's safety, or with a buyer if our business is sold, who would have to respect this notice.

We don't sell your personal information.

6. Information sent outside the UK

Some providers handle information outside the UK, as the table above shows. When it goes to the European Economic Area, it's covered by the UK's adequacy regulations. When it goes to the United States, we rely on the UK's adequacy regulations for organisations certified under the UK Extension to the EU–US Data Privacy Framework. Where a provider isn't certified, or the information goes elsewhere, we use the Information Commissioner's International Data Transfer Agreement, or its Addendum to the EU standard contractual clauses. Ask us if you'd like details.

7. Marketing

We only send you marketing, such as offers and news from us or from stores in the app, by email, text or push notification if you've said yes to that channel. Saying no is the default. We ask first rather than relying on the ‘soft opt-in’ in the Privacy and Electronic Communications (EC Directive) Regulations 2003.

You can change your mind at any time: use the unsubscribe link in any marketing email, change your choices in the app where it shows them, or email hello@smarteatx.com. Withdrawing your consent doesn't affect messages sent before you did.

Messages about your orders, account, security, receipts and changes to our terms aren't marketing. We send them whatever your marketing choices, because they're part of the service. You can turn off notifications in your phone's settings, but you'll miss order updates.

We don't give your details to other businesses for their own marketing.

8. How long we keep it

We may keep information longer if we need it for a legal claim or a regulator, or if the law requires it.

9. Automated decisions

We don't make decisions about you based only on automated processing that have legal or similarly significant effects on you.

Some everyday checks are automatic: whether a store delivers to your address, whether an offer applies to you, whether a code is right, and Stripe's fraud screening of card payments. If you think one of these has gone wrong for you, contact us and a person will look at it.

10. Your rights

Under data protection law, you have the right to:

• access your information and get a copy of it;
• correct information that's wrong or incomplete;
• erase your information, where we no longer need it or you withdraw consent;
• restrict how we use it, for example while we check a complaint;
• object to how we use it where we rely on legitimate interests, and to direct marketing at any time;
• data portability: get the information you gave us in a common format, or have it sent to someone else;
• withdraw consent at any time, where we rely on it, without affecting what we did before;
• not be subject to decisions based only on automated processing that significantly affect you.

To use any of these rights, email hello@smarteatx.com. It's free. We'll reply within one month, or tell you within that month if we need up to two more months because your request is complex. We may ask you to prove who you are. Some rights have limits; for example, we must keep payment records for tax.

You can also correct your details in your profile, and delete your account from Settings in the app.

11. Do you have to give us your information?

To create an account and order, you need to give us your name, email address, mobile number and address, and pay by a method Stripe accepts. Without them, we can't take or deliver your order. For age-restricted items, you need to confirm your age and show ID. Everything else, such as notes, preferences, reviews and marketing choices, is up to you.

12. Keeping it safe

Information is encrypted on its way between your phone and our servers. We store passwords and codes only in scrambled form, limit who in our team can see what, and lock sign-in after repeated wrong attempts. Card details are handled by Stripe.

No system is completely secure. If a breach puts your rights at high risk, we'll tell you.

13. Children

The app isn't for children: you must be 18 or over to use it. If you think a child has given us their information, contact us and we'll delete it.

14. Complaints

If you're unhappy with how we've used your information, please tell us first at hello@smarteatx.com. We'll acknowledge your complaint within 30 days and try to put things right.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.

15. Changes to this notice

We'll update this notice when how we use information changes, and show the date at the top. If a change is important, we'll tell you in the app or by email.