Rider Privacy Notice

Who is responsible for your data

CurbCast Ltd, Norwich, UK, is the data controller. That means we decide what is collected and why, and we are accountable for it. Contact us about anything in this notice at hello@curbcast.co.uk.

What we collect about you

When you apply: your name, email, phone number, the type and description of your vehicle, which delivery platforms you work with, the hours and Norwich zones you're interested in, and a password (stored only as a one-way hash — we can never see it).

Documents you upload: photo ID, proof of insurance, proof of vehicle ownership (V5C or rental agreement), and optionally photos of you and your bike. These may reveal your date of birth, address and nationality.

If we approve you: your bank sort code and account number for payment (encrypted in our database, shown to us only as the last four digits), the serial number of your box, your earnings history, and any messages between us.

Location data from the box: latitude and longitude, timestamp, speed where the device reports it, and the box serial number. This is the most sensitive thing we hold about you and it gets its own section below.

Location tracking, in plain terms

The box records where it is and sends that to us. We need it to work out what to pay you, to estimate how many people saw an advert in each part of Norwich, and to know where our equipment is.

Being straight with you about the limits:

• The box reports whenever it has power. It does not know whether you are "working", so the record can include times you are not riding for us, and can include your home address if you park there.
• It tracks the box on the vehicle, not you as a person. We do not track your phone and we do not ask for access to it.
• If you want the tracking to stop — for a period or permanently — tell us and we will disconnect or remove the box. There is no penalty, nothing is owed, and nobody will ask you why. The only consequence is that the time doesn't count towards what we pay you.
• We do not use location data to judge how fast you ride, to discipline you, or to check up on your other delivery work.
• We do not make any automated decision about you that has a legal or similarly significant effect. Your pay is a calculation from your hours, and you can challenge it with a human (section 5 of the Terms).

What advertisers see: aggregate coverage across Norwich — heat maps and totals. They are never given your name, your address, your identity, your individual route, or a track they could tie to a person.

Passengers. If you carry a passenger, please tell them the box records location. Nobody else is permitted to ride the vehicle while the box is fitted, so the data we hold should only ever reflect your own riding.

Why we're allowed to (lawful basis)

We rely on two lawful bases under UK GDPR, and deliberately not on consent:

• Performance of a contract (Article 6(1)(b)) — for your identity and contact details, your bank details, and the location data we use to calculate what we owe you. We literally cannot pay you without it.
• Legitimate interests (Article 6(1)(f)) — for verifying your documents, protecting our equipment from loss and theft, and producing the aggregate coverage figures we sell to advertisers. We have weighed these against your privacy; you can object at any time (see your rights below).
• Legal obligation (Article 6(1)(c)) — for records we must keep for tax and accounting.

We do not treat this as "consent", because consent has to be freely given and just as freely withdrawn. You could not realistically refuse location tracking and still be paid for riding, so calling it consent would be misleading. Relying on contract and legitimate interests instead is both more honest and gives you a real right to object.

Who else sees it

We do not sell your personal data. It is shared only with:

• Our hosting and database providers, which store the data on our behalf under contract.
• The LED box vendor's platform. The box hardware reports through the manufacturer's own cloud service, which is operated outside the UK. Location and playback data therefore passes through it before reaching us. We are working to document and minimise this; if you want to know the current position before you sign up, ask us and we will tell you exactly where it stands.
• Our bank and payment provider, to actually send you money.
• Our email provider, to contact you.
• Authorities, where we are legally required to — for example a police request about a stolen box, or HMRC.

Where data goes outside the UK, we are responsible for making sure it is protected to a UK-equivalent standard.

How long we keep it

• Rejected applications — deleted within 6 months, including the documents you uploaded.
• Identity and compliance documents — kept while you ride with us, then deleted within 12 months of the agreement ending.
• Location data — detailed points kept for 13 months, so you can always check a payment against the month before last. After that we keep only aggregated, non-identifying coverage statistics.
• Payment and earnings records — 6 years after the end of the relevant tax year, because HMRC requires it.
• Bank details — deleted within 6 months of your final payment.

Your rights

Under UK GDPR you can ask us to:

• Show you everything we hold about you, including your full location history, free of charge;
• Correct anything inaccurate;
• Delete your data, where we don't have to keep it for tax or legal reasons;
• Restrict or stop a particular use of it;
• Object to anything we do on the basis of legitimate interests;
• Hand it over to you, or to someone else, in a portable format.

Email hello@curbcast.co.uk and we will respond within one month. There is no charge and you do not need to give a reason.

If you want to complain about how we have handled your data, email us and say so. We will acknowledge it within 30 days and give you a substantive answer as quickly as we reasonably can. You do not have to come to us first, but we would like the chance to put it right.

If you are not happy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first, but it is your right either way.

How we protect it

Your password is stored as a one-way hash. Your bank details are encrypted in the database. Your identity and insurance documents are stored so that only a signed-in CurbCast administrator can retrieve them — they are not accessible from a public link. Access is limited to the people who need it, which today is a very short list.

If a breach ever affects your data in a way that puts you at risk, we will tell you, and the ICO, without undue delay.