Legal
Parcel Delivery Privacy Notice
For people sending parcels with Smart Eatx, and the people receiving them
Last updated 10 November 2026
1. Who we are
This notice is from Smart Approaches Limited, trading as Smart Eatx, a company registered in England and Wales (company number 14796914), whose registered office is at 4 Admiral Way, Regus House, Doxford International Business Park, Sunderland, Tyne and Wear, SR3 3XW ("Smart Eatx", "we" or "us"). We're the controller of the personal data it describes. You can contact us about your data at hello@smarteatx.com, or by post at our registered office.
It covers people who send parcels with a personal account on our parcel delivery website, the people receiving their parcels, and anyone else named at a pickup or drop-off, such as a neighbour who takes a parcel in. Our Parcel Delivery Terms set out the service.
Other notices cover businesses sending parcels (Delivery System Privacy Notice), our riders (Rider Privacy Notice) and visitors to our website (Website Privacy Notice).
2. What we collect about senders
| Data | What it includes | Where it comes from |
|---|---|---|
| Account | Name, email address (confirmed with a code), phone number and password (stored in a protected form) | You |
| Billing details | Your billing address | You |
| Bookings | Pickup and drop-off addresses and contacts, package sizes, whether a package is fragile or contains alcohol, notes, what happens if nobody's in, pickup time, prices, status and times, collection and delivery codes, and cancellation reasons | You and our systems |
| Address book | Pickup addresses you save | You |
| Payments | Card type, last four digits and expiry date, holds, charges, receipts and refunds. Your full card details are held by Stripe | You and Stripe |
| Delivery records | Photos of where a parcel was left, a neighbour's name, where the rider was at the hand-over, and the type of ID checked for alcohol | The rider |
| Contact with riders | When you asked for a rider's phone number | Our systems |
| Messages | Emails with us, complaints and claims | You |
| Device and sign-in | IP address, browser details and sign-in history | Your device |
3. If you're receiving a parcel
Where your details come from. The sender gave them to us when they booked: your name, phone number and address, and sometimes your company name, email address and notes for the rider, including which neighbour may take the parcel in. We don't get them from anyone else.
How we use them. Only to deliver the parcel. The rider, or a Stuart courier, uses your address to find you and may call you. You give the rider the delivery code the sender passed to you. If the sender chose, the rider may leave the parcel in a safe place or with a neighbour, and takes a photo of where it was left. We record when and where the parcel was handed over and, for a parcel containing alcohol, the type of ID you showed (not its number, and not a copy). If the sender gave your email address, we keep it with the booking, but we don't use it to contact you.
Our lawful basis. Our legitimate interests, and the sender's, in getting the parcel to you and proving it arrived (UK GDPR Article 6(1)(f)), and, for alcohol, in making sure it reaches only adults.
Marketing. We never use your details for marketing, and we don't sell them.
Who sees them. The rider or courier, our support team, the sender, and the providers listed in Who we share data with.
How long we keep them, and your rights. See How long we keep data and Your rights. You can contact us at hello@smarteatx.com.
Why we don't tell you directly. We usually have no way of contacting you before your parcel arrives, so we publish this notice and ask senders to tell you about it (UK GDPR Article 14(5)(b)).
The same applies to a neighbour who takes a parcel in (the rider records their name or house number and photographs where the parcel was left) and to someone else at the pickup, if the sender names them as the contact there.
4. How we use data, and our lawful basis
UK data protection law (the UK GDPR and the Data Protection Act 2018) says we need a lawful basis for each use of personal data. These are ours.
| Why we use it | Lawful basis (UK GDPR Article 6) |
|---|---|
| Creating and running a sender's account | Contract with the sender (6(1)(b)) |
| Pricing, booking and delivering parcels, including passing them to Stuart | Contract with the sender (6(1)(b)); legitimate interests, for recipients' and other contacts' details (6(1)(f)) |
| Taking payment, holding cards, receipts and refunds | Contract (6(1)(b)); legal obligation to keep accounting records (6(1)(c)) |
| Live tracking, and letting senders call the rider | Contract (6(1)(b)) |
| Codes, photos and hand-over records, to prove delivery and settle disputes | Legitimate interests (6(1)(f)) |
| Age checks for parcels containing alcohol | Legitimate interests (6(1)(f)) |
| Support, complaints and claims for loss or damage | Contract (6(1)(b)); legitimate interests (6(1)(f)) |
| Service emails, such as sign-in codes, receipts and refund notices | Contract (6(1)(b)) |
| Marketing to senders who've agreed to it, by email, text or push notification | Consent, given separately for each (6(1)(a)) |
| Daily booking limits, preventing fraud and misuse, and security | Legitimate interests (6(1)(f)) |
| Legal claims, and helping the police or regulators when the law requires | Legal obligation (6(1)(c)); legitimate interests (6(1)(f)) |
| Improving our service from overall statistics | Legitimate interests (6(1)(f)) |
Where we rely on legitimate interests, we've weighed them against the rights of the people involved. You can ask us how, and you can object (see Your rights). We don't use any special category data, such as health data, for parcel deliveries.
6. Automated decisions
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Prices are calculated automatically from the vehicle needed and the distance by road, and our system applies the daily booking limit. Stripe may automatically decline a payment it believes is fraudulent. If you think something's gone wrong, contact us and a person will look at it.
7. International transfers
Our servers are hosted by Hetzner in the European Economic Area (EEA). Some of our providers, such as Stripe, Google, Twilio, Cloudflare and Slack, may process data in the US or other countries outside the UK.
When data leaves the UK, it's protected by UK adequacy regulations (which cover the EEA); by the UK Extension to the EUโUS Data Privacy Framework, for US firms certified under it; or otherwise by the ICO's International Data Transfer Agreement, or its Addendum to the EU's standard contractual clauses. You can ask us for details.
8. How long we keep data
| Data | How long we keep it |
|---|---|
| A sender's account | Until it's deleted: 30 days after you ask, unless you sign back in |
| Saved addresses | Until you delete them, or your account |
| Booking details, including recipients' and other contacts' names, phone numbers, email addresses, notes and neighbour details | 2 years after the delivery |
| Payment, receipt and refund records | 6 years after the end of our financial year they belong to |
| Proof-of-delivery photos | 1 year |
| Records of contact with riders | 2 years |
| Emails, complaints and claims | 2 years after they're closed |
| Sign-in sessions | An unused sign-in lapses after 60 days, and ended ones are deleted 30 days later |
After these periods, we delete or anonymise the data. We may keep it longer if we need it for a legal claim.
9. Your rights
Whether you send or receive a parcel, you have the right to:
- access your data and get a copy of it;
- have inaccurate or incomplete data corrected;
- have your data erased, where we don't need to keep it;
- restrict how we use it, for example while we check a correction;
- port the data you gave us, in a machine-readable form, where we use it under a contract with you or your consent;
- object to our use of it based on legitimate interests, and to direct marketing at any time; and
- withdraw your consent at any time, without affecting what we did before.
To use your rights, email hello@smarteatx.com. We may need to confirm who you are. We'll reply within one month, or tell you if a complex request needs up to two more months. It's free, unless a request is clearly unfounded or excessive.
10. Do you have to give us your data?
To create an account and book, a sender must give their name, email address, phone number and payment card, and the pickup and drop-off addresses, with a name and phone number for each, so the rider can find the right people. Without them we can't deliver. Notes, a company name, the recipient's email address and saved addresses are optional.
Recipients don't give us anything directly: the sender does.
11. Keeping data safe
A rider can get a contact's phone number only while they have the delivery, and a sender can get a rider's number only while the rider has the parcel and for an hour afterwards. Photos are stored privately, and access to personal data is limited to the people on our team who need it.
13. Questions and complaints
If you have a question or concern about your data, contact us at hello@smarteatx.com and we'll try to put it right.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk, or 0303 123 1113.
14. Changes to this notice
We'll update this notice when what we do changes, and tell senders about important changes by email. The date at the top shows when it last changed.
Questions about this document? Email hello@smarteatx.com. See all our legal documents.