Privacy Statement
for Riders
Finland
Privacy Statement
1. Who is the data controller?
2. Why and which personal data do we process?
3. Which personal data do we process?
4. For what purposes do we process personal data?
5. How long do we store personal data?
6. With which data processors and why do we share personal data?
7. Data processing outside the EU and EEA
8. Cookies
9. What are your rights as data subjects and how can they be asserted?
1. Who is the data controller?
The data controller, i.e. the body that defines the purposes and means of the processing specified in this privacy policy is Delivery Hero Finland Logistics Oy, address Pasilankatu 10, 00240 Helsinki, email deliverypartners@foodora.fi, hereinafter referred to as “Foodora”, “we”, “our”, or “controller”. We also use the terms “rider partner”, “your” or “you” to refer to you.
2. Why and which personal data do we process?
Below you can see which of your data we need, for which purposes and under which circumstances we share your data with others.
Personal data is information from which we can directly or indirectly relate to your person, such as first and last name, address, phone number, date of birth, location data or email address.
3. Which personal data do we process?
In order to provide our delivery service to our customers, we use various tools and systems that are absolutely necessary for the delivery of orders. We also use external and internal tools and systems to process your personal data for personnel management and business operations.
We collect, process and store the following categories of personal data within the scope of using the tools and systems:
| Data categories | Explanation | ||
| Identification data | Name, surname, address | ||
| Contact data | Email address, phone number | ||
| Account data | Date of birth, place of birth, nationality, gender, bank account details, social security number, driver’s license | ||
| Performance data | Usage time of applications, order details | ||
| Geolocation data | GPS data | ||
| Technical data | Device data | ||
| Contract details | Contract type, residence permit |
4. For what purposes do we process personal data?
We only collect your personal data if this is necessary and the purpose is legal and the processing is proportionate. Below we would like to give you more information for the purposes and legal basis:
| Purpose | Why do we process data for this purpose? | ||
| Engaging rider partners | As part of the rider partner engagement process, we collect, process and store your personal data on the basis of the data you have made available to us. The purpose of the processing is to make a decision regarding contracting with or refusing to contract with a rider partner applicant. Categories of personal data: Identification dataContact dataAccount data Legal basis:Initiation of contract, Art. 6 para. 1 b) GDPR | ||
| Advertising and marketing | Online marketing Our rider partner engagement process is based to a large extent on finding potential rider partners. In order to reach the right potential service providers, we run marketing campaigns. Therefore, we would like to present to you our processes as transparently as possible. The following online marketing processing activities we pursue include targeting and retargeting: Targeting In principle, targeting means the switching and fading in of advertising banners on websites that are tailored to specific target groups. The aim is to display the most attractive banners as individually as possible for the user and potential riders. Firstly, we define a target group and secondly, we commission our service providers to show our advertising to the defined target group. We do not process any personal data, as these are initially made anonymous. We segment different target groups and place different ads on different portals for optimized targeting. Retargeting As soon as you have visited our website for obtaining further information on our rider program, we store this information in cookies. If you continue to surf other websites, our advertising partners will remind you on our behalf that you have not yet submitted an application. We don’t want you to miss out on our amazing rider program. You can disable retargeting by installing appropriate add-ons for your browser. Furthermore, you can and should also regularly delete the cookies stored in the browser you are using. Categories of personal data: Contact data Legal basis: Art. 6 para. 1 (f) GDPR, legitimate interest. Our legitimate interest is the purpose described above. | ||
| Rider partner candidate reactivation | If a rider partner candidate does not continue the application process, SMS, emails or WhatsApp messages will be sent to remind the candidate of the steps that need to be taken to complete the application process. Categories of personal data: Identification dataContact data Legal basis: Contract initiation, Art. 6 para. 1 b) GDPRLegitimate interest, Art. 6 para. 1 f) GDPR; our legitimate interest is to ensure a smooth application process and better experience. | ||
| Service agreement | Conclusion of a service agreement Categories of personal data: Identification dataAccount data Legal basis: Performance of contract, Art. 6 para. 1 b) GDPR | ||
| Onboarding | Training of new rider partners to the tools and systems of the company Categories of personal data: Identification dataAccount data Legal basis: Performance of contract, Art. 6 para. 1 b) GDPR | ||
| Presence monitoring | Assessment of the reliability of rider partners with regard to the fulfilment of their contractual obligations. Categories of personal data: Contact details Legal basis: Performance of contract, Art. 6 para. 1 b) GDPR | ||
| Accounts | Creation of required accounts for the applications used Categories of personal data: Identification dataAccount data Legal basis: Performance of contract, Art. 6 para. 1 b) GDPR | ||
| Delivery period recording | Recording of delivery periods performed by the rider partner Categories of personal data: Identification dataStart and end time and date of delivery period and breaks (if applicable) Legal basis: Performance of contract, Art. 6 para. 1 b) GDPR | ||
| Presence monitoring | Assessment of the reliability of rider partners in fulfilling their contractual obligations. Use of location data in case of irregularities during the delivery period. Categories of personal data: Identification dataAccount data Legal basis: Performance of contract, Art. 6 para. 1 b) GDPR | ||
| Customer communication | Communication with customers about the status of the order or delivery Categories of personal data: Identification dataContact detailsLocation dataContent of communication Picture (if available) Legal basis: Legitimate Interest, Art. 6 para. 1 f) GDPRConsent, Art. 6 para. 1 a) GDPR for picture | ||
| Residence permit | Verifying whether a residence permit is required of the rider applicant for the purposes of working and, as applicable, review of rider partner applicants’ and existing rider partners’ residence permits with regard to their validity and applicability. Categories of personal data: Identification dataAccount dataContact detailsContract details Legal basis: Legal obligation, Art. 6 para 1 a c) GDPR | ||
| Service provider administration | We collect, process and store your personal data for the processing and creation of legally required documents and proofs as well as for the remuneration of our rider partners. Categories of personal data: Identification dataContact dataAccount data Legal basis: Performance of contract, Art. 6 para. 1 b) GDPRLegal obligation, Art. 6 para. 1 c) GDPR | ||
| Communication with rider partners | Different tools are used for communication between us and our rider partners. The purpose of the processing is the communication of necessary information. Categories of personal data: Identification dataContact data Legal basis: Performance of contract, Art. 6 para. 1 b) GDPRLegitimate interest, Art. 6 para. 1 f) GDPR for newsletter | ||
| Delivery | To ensure a prompt delivery of the products ordered by our customers, the coordination data of our rider partners is collected and the order is assigned to those rider partners who are in an optimal region. Categories of personal data: Identification dataContact dataGeolocation dataTechnical data Legal basis: Performance of contract, Art. 6 para. 1 b) GDPRLegitimate interest, Art. 6 para. 1 f) GDPR | ||
| Delivery estimation | In order to be able to inform customers of the expected delivery time, average speed data is processed in anonymous form. Categories of personal data: Geolocation data (anonymized) Legal basis: Legitimate interest, Art. 6 para. 1 f) GDPR | ||
| Reclamations | Issuing a reclamation upon breach of service agreement by rider partner Categories of personal data: Identification dataPersonnel file Legal basis: Performance of contract, Art. 6 para. 1 b) GDPR | ||
| Payment of service fee | Preparation of service fee statements; payment of gross amounts; tax withholding (if applicable) Categories of personal data: Identification dataContact dataBank account information Legal basis: Performance of contract, Art. 6 para. 1 b) GDPR | ||
| Rider partner equipment | Our rider partners may choose to use equipment provided by us against the payment of a deposit. This serves the uniform appearance of our riders as well as the protection of our rider partners. We manage and monitor the equipment provided to ensure that the necessary equipment is always available and that any equipment provided to a rider partner is returned in good working order. Categories of personal data: Identification dataContact data Legal basis: Performance of contract, Art. 6 para. 1 b) GDPRLegal obligation, Art. 6 para. 1 c) GDPR | ||
| Delivery period planning and time recording | We collect, process and store personal data of our rider partners for the planning of deployments and the actual exercise of deliveries. The purpose of the processing is to collect and monitor the delivery periods performed and to create necessary records for the purposes of calculating the service fees payable to our rider partners. Categories of personal data: Identification dataContact dataAccount dataPerformance dataGeolocation data Legal basis: Performance of contract, Art. 6 para. 1 b) GDPRLegitimate interest, Art. 6 para. 1 f) GDPR | ||
| Delivery service quality evaluation | Evaluation of the overall level of delivery experience based on restaurant and customer complaints and quantity of orders delivered by rider partners. This also includes reliability before, during and after the duration of a delivery period. This also includes, but is not limited to, the punctual start of the delivery period, proper login and acceptance of orders during and until the end of the delivery period. Also takes into account the proper execution of the order. Categories of personal data: Identification dataContact dataGeolocation dataTechnical data Legal basis: Performance of contract, Art. 6 para. 1 b) GDPR | ||
| Termination | Terminations of service agreements with rider partners Categories of personal data: Identification dataContact data Legal basis: Performance of contract, Art. 6 para. 1 b) GDPR | ||
| Off-boarding | Deactivation of existing accounts; return of any received clothing and equipment. Categories of personal data: Identification dataContact data Legal basis: Performance of contract, Art. 6 para. 1 b) GDPR | ||
| Archiving | Archiving of documents subject to retention for tax purposes. Categories of personal data: Identification dataContact dataDate of birthTax information Legal basis:Legal obligation, Art. 6 para. 1 c) GDPR | ||
5. How long do we store personal data?
We generally delete your data after the purpose has been fulfilled. The exact deletion rules are defined in our regional deletion concepts. Different deletion rules apply depending on the purpose of the processing. Within our deletion concepts we have defined various data classes and assigned rule deletion periods to them. When the retention period is met, the stored data will be deleted accordingly.
Under certain circumstances, any requests for deletion may be opposed by legal retention periods, which prevent us from deleting the stored data for a fixed minimum period of time. In order to comply with these legal requirements, we block the relevant data after the purpose has been fulfilled and thereby guarantee data completeness and data integrity.
6. With which data processors and why do we share personal data?
We never give your data to unauthorized third parties. However, as part of our work we obtain the services of selected service providers and give them limited and strictly monitored access to some of our data. However, before we forward personal data to these data processors for processing on our behalf, each individual company undergoes an audit. All data recipients must meet the legal data protection requirements and prove their data protection level with appropriate proofs.
In the following we would like to inform you in a transparent and understandable way about all our data recipients with the respective reasons:
| Data recipient | Reason | ||
| External service provider | They support our business activities by providing us with IT solutions and infrastructure or by ensuring the security of our business operations, for example by identifying and rectifying faults. Furthermore, personal data may also be disclosed to external tax consultants, lawyers or auditors if they provide services for which they have been commissioned. | ||
| Members of the Delivery Hero SE Group | Within a group it is sometimes necessary to use resources effectively. In this context, we support each other within our Group in optimizing our processes. In addition, we provide joint content and services. This includes, for example, the technical support of systems. This is a joint controllership within the meaning of Art. 26 GDPR. The company is fully responsible for fulfilling the data protection requirements together with Delivery Hero SE. Within the framework of joint regulations, the company and Delivery Hero SE have agreed that both will guarantee their rights equally. You can therefore address any requests both to the local entity that has engaged you as a rider partner, and to Delivery Hero SE, Oranienburger Straße 70, 10117 Berlin. You can reach the data protection officer at dpo@deliveryhero.com. | ||
| Prosecuting authorities and legal proceedings | Unfortunately, it can happen that a few of our rider partners do not behave fairly and want to harm us. In these cases we are not only obliged to hand over personal data due to legal obligations, it is of course also in our interest to prevent damage and to enforce our claims and to reject unjustified claims. | ||
7. Data processing outside the EU and EEA
We process your data mainly within the European Union (EU) and the European Economic Area (EEA). However, some of our service providers mentioned above are based outside the EU and the EEA. The GDPR has high requirements for the transfer of personal data to third countries. All our data receivers have to measure up to these requirements. Before we transfer your data to a service provider in third countries, every service provider is first assessed with regard to its data protection level. Only if they can demonstrate an adequate level of data protection will they be shortlisted for service providers.
Regardless of whether our service providers are located within the EU/EEA or in third countries, each service provider must sign a data processing agreement with us. Service providers outside the EU/EEA must meet additional requirements. According to Art. 44 ff. GDPR personal data may be transferred to service providers that meet at least one of the following requirements:
a. The EU Commission has decided that the third country ensures an adequate level of protection (e.g. Israel and Canada).
b. Standard data protection clauses have been accepted. Contractual clauses which cannot be modified by the contracting parties and in which they undertake to ensure an adequate level of data protection are recognized by the GDPR as a suitable transfer mechanism.
8. Cookies
In order to make the visit of our website attractive and to enable the use of certain functions, we use so-called cookies on various pages. These are small text files that are stored on your device. Some of the cookies we use are deleted after the end of the browser session, i.e. after closing your browser (so-called session cookies). Other cookies remain on your device and allow us or our affiliate to recognize your browser on your next visit (persistent cookies). You can set your browser so that you are informed about the setting of cookies and individually decide on their acceptance or exclude the acceptance of cookies for specific cases or in general. Failure to accept cookies may limit the functionality of our website/app.
You can install additional add-ons in your browser that block unnecessary cookies. By doing so, you will not see any interest-based advertisements.
Categories of personal data:
Limited device information such as IP address, device ID, MAC address, operating system, device type, Apple Advertiser ID (IDFA) or Android Ad ID (AAID)
Legal basis:
If processing takes place with your consent, the legal basis is Art. 6 Para. 1 (a) GDPR, namely your consent. Otherwise, the processing is based on our legitimate interest pursuant to Art. 6 para. 1 (f) GDPR. Our legitimate interest lies in the aforementioned purpose.
You can find our cookie policy with all the cookies we use in our Cookies and Web-Tracking Policy.
9. What are your rights as data subjects and how can they be asserted?
You have the right to receive explicit information from us about the personal data we have stored about you, free of charge.
In addition, you have the following rights:
| Right to access | You have the right to be informed which data we store about you and how we process this data. |
| Right to rectification | If you notice that stored data is incorrect, you can always ask us to correct it. |
| Right to erasure | You can ask us at any time to delete the data we have stored about you. |
| Right to restriction of processing | If you do not wish to delete your data, but do not want us to process it further, you can ask us to restrict the processing of your personal data. In this case, we will archive your data and only reintegrate it into our operative systems if you so wish. However, during this time you will not be able to use our services, otherwise we will process your data again. |
| Right to data portability | You can ask us to transmit the data stored about you in a machine-readable format to you or to another responsible person. In this context, we will make the data available to you in JSON format. |
| Right to object to the processing of your data | You can revoke your consent at any time or object to the further processing of your data. This also includes objecting to our processing, which we process without your consent but based on our legitimate interest. This applies, for example, to direct marketing. You can object to receiving further newsletters at any time. If you do not agree with one of our processing purposes based on our legitimate interest or wish to object to it, you may object to the processing at any time on grounds relating to his or her particular situation. Please write an email to deliverypartners@foodora.fi. In this case we will review the processing activity again and either stop processing your data for this purpose or explain to you our reasons worth protecting and why we will continue with the processing. |
| Automated decision making | We also process your personal data in the context of algorithms in order to simplify our processes. Of course, you have the right not to be subject to decisions based solely on automated processing. If you believe that we have denied your access in an unjustified way, you can always contact us at deliverypartners@foodora.fi. In this case, we will examine the case separately and decide on a case-by-case basis. |
| Right of complaint | If you believe that we have done something wrong with your personal data or your rights, you can complain to the appropriate supervisory authority at any time. |
The supervisory authority responsible for us is:
Office of the Data Protection Ombudsman
P.O. Box 800
00531 Helsinki
tietosuoja@om.fi
To exercise your rights, you can contact deliverypartners@foodora.fi at any time.
If you believe that we have done something wrong with your personal data or your rights, you can complain to the above supervisory authority at any time.
Last update: November 2024