This Rider Privacy Policy explains how DoDelivery LTD ("DoDelivery", "we", "us") handles personal data when you register and use the rider features of Partner Portal. DoDelivery acts as controller for the account administration, verification, security and support processing described here. Contact legal@do.delivery for privacy questions or rights requests, or support@do.delivery for operational help.
1. Information and sources
- Account and profile: your name, email, phone number, address, profile information and images, account identifiers, roles, permissions and verification status.
- Verification evidence: the identity, address and right-to-work details and documents you submit for available checks. Depending on your circumstances these can include identity or birth documents, nationality and immigration/right-to-work evidence.
- Payment administration: bank account and sort-code details, proof of address, company or tax information where requested, and related verification records needed for the features you use.
- Vehicles and eligibility: vehicle details and relevant driving-licence, insurance, roadworthiness, tax and training evidence, including uploaded images, expiry information and review status.
- Security and service use: IP address, browser/device and session details, linked sign-in provider identifiers, authentication events, account changes, review/audit records, and legal-document versions and acceptance times.
- Support: messages, emails, issue descriptions and attachments you submit, relevant diagnostic information and records of replies and actions.
We obtain information from you, your linked sign-in provider, authorised personnel reviewing or updating records, and connected DoDelivery account and operational services where needed for your permitted features. Not every rider must supply every type of document. Do not send passwords, payment-card security codes or unrelated sensitive information in uploads or support messages.
2. Purposes and lawful bases
We use relevant information to register and manage your account; authenticate you and enforce permissions; review identity, eligibility, vehicle and payment information; provide the features you request; communicate about your application or account; resolve support issues; prevent fraud and misuse; maintain reliable records; and comply with applicable obligations or deal with legal claims.
Where applicable, the lawful bases are taking steps at your request before a contract or performing a contract with you; compliance with a legal obligation; and legitimate interests in operating, verifying and securing the service, preventing fraud and providing support, assessed against your rights. We do not assume that every check is legally required in every country. If particular information requires additional protection or a separate lawful condition, we must establish that condition before using it. Acknowledging this notice is not an additional condition for processing sensitive data.
Where an optional activity requires consent, we ask separately and explain how to withdraw it. Agreement to Portal terms and acknowledgement of this notice do not amount to blanket consent, a waiver of rights or permission for unrelated marketing. Without information necessary for a selected feature or applicable eligibility check, that feature, verification or related payment administration may be unavailable.
3. Reviews, connected services and your responsibilities
Authorised staff can review documents and update verification or support records. Changing details may reopen a review. Contact support if a decision or recorded detail appears wrong and ask for it to be reviewed; this notice does not authorise solely automated decisions with legal or similarly significant effects.
Portal profile changes can update the corresponding records used by other DoDelivery services. Rider-app delivery operations may process additional information, such as delivery activity and location, under the notices and permissions presented for those services. Merely accepting these Portal documents does not enable device-location collection or give permission for continuous tracking.
Merchant POS synchronisation, menu management and terminal monitoring are covered by the merchant documents when that access is enabled. Rider-only access does not itself connect a POS terminal or authorise access to a merchant's private business records.
4. Access, sharing and international transfers
Access is limited to authorised people and systems for relevant tasks, including DoDelivery personnel handling rider verification, payment administration, support and security. Your rider account does not make your identity documents or bank details generally visible to other riders or merchants.
We use providers for hosting, storage, communications, sign-in and technical operations, limited to their functions. Relevant information may also be shared with professional advisers, authorities or regulators when needed for legal obligations or claims, or in a business transfer subject to appropriate protection. Separate delivery-service notices explain any operational sharing needed for deliveries.
Recipients or providers may operate outside your country. Restricted transfers must have an applicable lawful basis, such as a recognised adequacy decision or appropriate contractual safeguards. Contact legal@do.delivery for the destinations and safeguards relevant to your data and how to obtain a copy. Using the Portal does not consent to unrestricted transfers.
5. Retention and security
We retain records for their purpose, considering whether an application or account remains active, the need to verify eligibility or payments, applicable accounting and legal requirements, disputes, security investigations and legal holds. Verification evidence, payment-related records and security or acceptance history can have different retention needs. We do not keep all rider data indefinitely simply because an account once existed; ask us about the retention applicable to a particular record.
Removing or replacing an upload does not necessarily remove prior review records, lawful audit evidence or backup copies immediately. Closing an account does not erase information that must still be retained. We use access controls and technical and organisational measures appropriate to the data; no service can promise absolute security. Keep your sign-in methods secure and report suspected exposure promptly.
6. Your rights and complaints
Depending on applicable law and the processing involved, you may request access to and a copy of your personal data, correction, erasure, restriction or portability, and object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. Rights can be subject to statutory conditions and retention obligations. We may need to verify your identity before acting on a request.
You can contact legal@do.delivery to exercise rights, challenge a record or ask about processing. You may also complain to the relevant supervisory authority, including the Gibraltar Regulatory Authority or the UK Information Commissioner's Office where applicable. You do not have to raise a complaint with us first.
7. Cookies and changes
Essential session and security technologies support sign-in and protect forms. Optional tracking, if offered, requires its own applicable notice and choices; accepting these documents does not enable it. Public policy pages and the required agreement screen do not load analytics or session replay.
We publish versioned notices and may ask you to acknowledge updated documents. The acceptance history records which rider or merchant documents you actually accepted and when. It does not create a record of acceptance merely because an administrator changed your role.