Legal
Rider Privacy Notice
For riders, and people applying to ride, with Smart Eatx
Last updated 10 November 2026
1. Who we are
This notice is from Smart Approaches Limited, trading as Smart Eatx, a company registered in England and Wales (company number 14796914), whose registered office is at 4 Admiral Way, Regus House, Doxford International Business Park, Sunderland, Tyne and Wear, SR3 3XW ("Smart Eatx", "we" or "us"). We're the controller of the personal data it describes: data about riders and people applying to ride. You can contact us about your data at hello@smarteatx.com, or by post at our registered office.
You sign in with a Smart Eatx account, which also works in our other apps. If you order food or send parcels with us too, the Order Food Privacy Notice and Parcel Delivery Privacy Notice cover that. Our Rider Terms set out the agreement between us, and our Cookie Policy covers cookies on our websites.
2. What we collect and where it comes from
| Data | What it includes | Where it comes from |
|---|---|---|
| Account | Name, email address, phone number (verified with a code) and password (stored in a protected form) | You |
| Application | Date of birth, home address, emergency contact (name, phone number and relationship), the zone you choose and any referral code | You |
| Identity and right to work | Images of your ID document and passport, your selfie, identity check results (document type, issuing country, date of birth, expiry date, outcome and reasons), your Home Office share code (stored encrypted) and the result of our check, with any expiry date | You, Didit and the Home Office |
| Background check | Its status, reference and result | Our team, and any checks provider we use |
| Vehicle and licence | Vehicle type, make, model, year, colour, registration number and photos; driving licence images and expiry date | You and Didit |
| Training | Modules completed, quiz answers and results | You |
| Payouts | Your Stripe account reference and status, your bank's name, the account holder's name and the last four digits of the account number. Your full bank details go to Stripe, not to us | You and Stripe |
| Work | When you're online, on a break or offline; offers sent, accepted, declined or handed back; each delivery's steps and times; pickup and delivery code tries; proof photos; problems you report and your notes; ID types you record for age checks; when you call customers through the app | The rider app and our systems |
| Location | Your live position while you're online or on deliveries, a location trail, and where you were at each hand-over | Your phone |
| Pay and tax | Earnings, waiting, boosts, tips, adjustments and their reasons, holds, payouts, referral bonuses and quarterly totals for HMRC | Our systems |
| Feedback | Ratings, tags and comments from customers, and complaints about deliveries | Customers |
| Support | Your chats with support and any files you send | You |
| Device and sign-in | Device type, app, notification token, IP address, browser or app details, sign-in history, and a record of changes to your application and of who on our team viewed it | Your device and our systems |
3. How we use it, and our lawful basis
UK data protection law (the UK GDPR and the Data Protection Act 2018) says we need a lawful basis for each use of your data. These are ours.
| Why we use it | Lawful basis (UK GDPR Article 6) |
|---|---|
| Assessing your application, checking who you are and approving you to ride | Steps you ask for before a contract, and the contract (6(1)(b)); our legitimate interests in keeping customers safe and preventing fraud (6(1)(f)) |
| Checking your right to work in the UK | Our legitimate interests in working only with people allowed to work here (6(1)(f)), and legal obligation where the law requires the check (6(1)(c)) |
| Background checks | Our legitimate interests in the safety of customers and the public (6(1)(f)). See Biometric, health and criminal record data |
| Keeping your documents in date, reminding you, and pausing your account when one expires | Contract (6(1)(b)); legitimate interests (6(1)(f)) |
| Sending you offers, running deliveries, and the pickup, code and photo checks | Contract (6(1)(b)); legitimate interests in preventing fraud and settling disputes (6(1)(f)) |
| Showing customers who's delivering and where you are, and letting them call you | Contract (6(1)(b)); our and our customers' legitimate interests in knowing who's coming and when (6(1)(f)) |
| Paying you: earnings, payouts, referral bonuses and adjustments | Contract (6(1)(b)) |
| Reporting to HMRC, and keeping tax and accounting records | Legal obligation (6(1)(c)) |
| Watching for deliveries going wrong, handling accidents and incidents, and keeping people safe | Legitimate interests (6(1)(f)); vital interests in an emergency (6(1)(d)) |
| Support, complaints and reviewing decisions | Contract (6(1)(b)); legitimate interests (6(1)(f)) |
| Notices about your application, offers, documents and pay, by push notification, email and the app's inbox | Contract (6(1)(b)) |
| Marketing by email, text or push notification | Your consent, given separately for each (6(1)(a)) |
| Security, preventing fraud and misuse, and keeping an audit trail | Legitimate interests (6(1)(f)) |
| Legal claims, and helping the police or regulators when the law requires | Legal obligation (6(1)(c)); legitimate interests (6(1)(f)) |
| Improving our service from overall statistics | Legitimate interests (6(1)(f)) |
Where we rely on legitimate interests, we've weighed them against your rights. You can ask us how, and you can object (see Your rights).
4. Biometric, health and criminal record data
Biometric data. When identity checks are on, Didit compares your live selfie with the photo on your document, and checks you're a real person who's present, to confirm you're the person on the document. That is biometric data used to identify you, which is special category data. We use it only with your explicit consent (UK GDPR Article 9(2)(a)), which you give when you start the check. Didit does the matching for us. We keep the document images and your selfie, but no face template. You can withdraw your consent at any time, but we then can't complete the check, and so can't approve you while identity checks are how we verify riders. When identity checks aren't available, our team compares your selfie with your ID by eye, which isn't biometric processing.
Health data. If you tell us about an injury after an accident, or about a disability or health condition so we can make an adjustment, that's health data. We use it to help you, handle the incident and make adjustments: with your explicit consent (Article 9(2)(a)), to protect your or someone else's vital interests when you can't consent (Article 9(2)(c)), or where it's needed for legal claims (Article 9(2)(f)).
Criminal record data. Our background check may include a criminal record check. If it does, we'll tell you first and ask for your agreement. We use the result only to decide whether you can ride, and only the team making that decision can see it. Our conditions under the Data Protection Act 2018 are your consent (Schedule 1, paragraph 29) and, where it applies, preventing or detecting unlawful acts (Schedule 1, paragraph 10). We keep the appropriate policy document the Act requires.
Your passport, share code result and other documents can show your nationality and immigration status. That isn't special category data, but we protect it in the same way.
5. Your location
The app sends us your location while you're online, including in the background, and while you're carrying deliveries. We don't collect it while you're offline: any location the app sends then is ignored.
We use your location to offer you deliveries nearby; work out routes and arrival times; show customers and senders where you are while you're delivering to them; check you're within 200 metres of the pickup when that check is on; spot deliveries that may be going wrong, such as a rider who isn't moving; record where each delivery was handed over; and look into complaints, incidents and fraud.
We keep your live position only while you're online. A location trail (a point every 30 seconds or 100 metres) is kept for 90 days, then deleted.
7. Automated decisions
Some decisions are made automatically, without a person:
- Offers. Who gets an offer is worked out from distance to the pickup, vehicle size and whether you're free. Your ratings and past declines aren't used.
- Pausing your account. If a document in use passes its expiry date, your account is paused until a new one is approved.
- Identity checks. Didit's check, and our own automatic checks that the document is in date, of the right kind and shows the date of birth you gave us, can refuse a check. After three refused or unfinished tries, a person on our team must allow more.
- Codes and staying online. Five wrong pickup or delivery codes lock that step until support unlocks it. If your phone goes quiet for 30 minutes, we take you offline.
These can affect the work you can do. We use them because they're needed to run deliveries under our contract with you (UK GDPR Article 22(2)(a)). You can ask for a person to review any of them, give your view and challenge the result, through support or at hello@smarteatx.com. Decisions to approve or reject an application, and to suspend or end your account, are always made by a person.
8. International transfers
Our servers are hosted by Hetzner in the European Economic Area (EEA). Some of our providers, such as Stripe, Google, Apple, Twilio, Cloudflare, Slack and Didit, may process data in the US or other countries outside the UK.
When data leaves the UK, it's protected by UK adequacy regulations (which cover the EEA); by the UK Extension to the EUโUS Data Privacy Framework, for US firms certified under it; or otherwise by the ICO's International Data Transfer Agreement, or its Addendum to the EU's standard contractual clauses. You can ask us for details.
9. How long we keep it
| Data | How long we keep it |
|---|---|
| An application that doesn't lead to riding (rejected, withdrawn or never finished) | 12 months after your last activity on it |
| Identity, right-to-work, background check, vehicle and licence records, and their audit trail | While you ride, and 6 years after your last delivery |
| Delivery and work records, including feedback | 6 years after the delivery |
| Proof-of-delivery photos | 1 year |
| Location trail | 90 days. Your live position is kept only while you're online |
| Pay, payout and HMRC reporting records | 6 years after the end of the year they relate to |
| Support chats and files | 2 years after the conversation closes |
| Your account, inbox notices and consent records | Until your account is deleted |
| Sign-in sessions | An unused sign-in lapses after 60 days, and ended ones are deleted 30 days later |
When you ask to delete your account, it's deleted 30 days later, unless you sign back in. We keep the records above for their periods because the law requires it, or because we may need them to deal with claims. After that, we delete or anonymise them.
10. Your rights
You have the right to:
- access your data and get a copy of it;
- have inaccurate or incomplete data corrected;
- have your data erased, where we don't need to keep it;
- restrict how we use it, for example while we check a correction;
- port the data you gave us, in a machine-readable form, where we use it under our contract or your consent;
- object to our use of it based on legitimate interests, and to direct marketing at any time;
- withdraw your consent at any time, without affecting what we did before. You can change your marketing choices in your account settings; and
- ask for a person to review an automated decision (see Automated decisions).
To use your rights, email hello@smarteatx.com. We may need to confirm who you are. We'll reply within one month, or tell you if a complex request needs up to two more months. It's free, unless a request is clearly unfounded or excessive.
11. Do you have to give us your data?
To apply and ride, yes. We need your identity, date of birth, home address, emergency contact, phone number, right to work, vehicle details, a driving licence for a motorcycle, car or van, and payout details for Stripe. Without them we can't approve or pay you. The law also requires the details we report to HMRC. Your location is needed while you're online, because offers depend on it.
A referral code, marketing consent and files you send to support are up to you.
12. Other people's data you give us
Please tell your emergency contact that you've given us their details, and point them to this notice. We'll contact them only if we're worried about your safety. They can use the rights above by emailing us.
If you refer a rider, you'll see their first name and initial and whether they've qualified, and they'll see yours.
13. Keeping your data safe
Your documents and photos are stored privately. Our team opens them only through links that work for a few minutes, and every view is recorded. Your share code is encrypted. Access to rider data is limited to the people on our team who need it.
14. Questions and complaints
If you have a question or concern about your data, contact us at hello@smarteatx.com and we'll try to put it right.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk, or 0303 123 1113.
15. Changes to this notice
We'll update this notice when what we do changes, and tell you about important changes in the app or by email. The date at the top shows when it last changed.
Questions about this document? Email hello@smarteatx.com. See all our legal documents.