Privacy Policy

Last updated May 1st 2021.

Introduction

At Urb-it AB (publ) (“Urb-it” or “we”), we protect your personal integrity and always strive for a high level of data protection (eg. we would never sell your personal data to another company). This privacy policy explains how, why and for how long we collect, process, store and use your personal information. It also describes your rights and how you can exercise them. It is important that you understand the privacy policy and feel safe in our processing of your personal data. You are always welcome to contact us for any questions. This Data Protection Policy applies to our products (API, Business Portal, eCheckout), our websites (urb-it.com, business.urb-it.com, c.urb-it.com, developer.urb-it.com) and any other Urb-it services. This policy governs all use of our Services, both for Merchants and Partners who offers our services to their customers, to customers who choses Urb-it and to visitors of our web pages.

What is personal data and what is processing of personal data?

Any information related to a natural person or ‘Data Subject’, that can be used to directly or indirectly identify the person is considered to be personal data. It can be anything from a name, a photo, an email address, bank details, posts on social networking websites, or a computer IP address. Encrypted data and different types of electronic identities (e.g. IP number) are personal data if they can be linked to a person. Processing of personal data is all that happens with personal data. For instance, each action taken regarding personal data is 'processing', regardless of whether the action is performed in an automated manner or not. Examples of common processing are collection, editing, registration, organization, structuring, storage, transmission and deletion.

Who Is Responsible For The Personal Information We Collect?

URB-IT AB (publ), Company number: 556959-9755, Vattugatan 17, 111 52 Stockholm, Sweden, and its subsidiaries, including Urb-it Paris SAS, company number 350 261 152, 2 Rue Dieu, 75010 Paris, France, and Urb-it London Ltd, company number 0999823, 66 Old Compton St, Soho, London W1D 4UH, United Kingdom. Please contact us at dataprotection@urbit.com if you have any questions or would like further information about how and why we collect, process and store data and how you can exercise your rights as a data subject. Urb-it has dedicated professionals that are responsible for handling and architecting all the processes and solutions used by our products, systems and services, providing security of information.

What information do we collect?

Information you give us in order to successfully carry out our Service. You may directly or indirectly give us information about yourself in a variety of ways, such as when you place an order on a Merchant’s site, when choosing Urb-it as a delivery option at a later stage in the delivery flow (for example when using Urb-it to deliver a Click & Collect purchase), when you contact us, use our web page and our Business or Consumer portal. To fulfil our delivery commitment we may collect information about yourself in a variety of ways, such as when you place an order on a Merchant’s site, when choosing Urb-it as a delivery option at a later stage (for example when using Urb-it to deliver a Click & Collect purchase), when you contact us, use our web page, our Business or customer portal.  

• Personal and contact information – name, delivery address, email address, mobile phone number.
• Payment information – status of payment, payment information, “token” to connect you with any saved credit cards in 3rd party payment solution (Credit Card information is not stored).
• Information about your purchase – details about the items you purchase, about the seller and where you want them delivered.
• Historical information – your purchase and payment history when using Urb-it as your delivery option.
• Communication with customer support and an on-hand Courier – in case of a customer service errand, we will keep a record of the errand until resolved, with all information you give us regarding the issue, for example device information.
• Information about interaction between you and Urb-it – how you as a user uses our services, including page response times, errors, entry and exit methods, as well as delivery notices when we contact you.
• Device information – e.g. the IP address, language settings, browser settings, time zone settings, operating system and platform and screen resolution.
• Geographical information – we might collect your geographical location if needed when using map related features.

How urb-it handles your personal data?

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on your instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Why Do We Collect, Store And Process Personal Data?

Provide, operate and improve our services. All data is used to provide, operate and improve Urb-it’s services. Urb-it processes personal data for the following purposes and based on the following legal bases:

What personal data do we collect about you as a customer / delivery recipient and for what purpose?

Lawful Basis For Processing

Legitimate Interests The processing of the information is necessary to accommodate ours and the consumer legitimate interest to avoid frauds, abuse and incorrect use our services, platforms and systems. (Rec.30; Art.7(1)(f), Rec.47, 48; Art.6(1)(f))

Legal Obligations The processing of the information is necessary to accommodate ours and the consumer legal obligations regarding frauds and incorrect use of personal information, providing when necessary, information for basis in legal investigations. (Rec.30; Art.7(1)(c), Rec.45; Art.6(1)(c), 6(3))

Data Minimization (Lifetime For The Collected Information)

We store the data for a period of 36 months from when the purchase has been processed (including delivery and payment) to comply with booking laws, customer protection laws, directive on distance selling etc.

What personal data do we collect about you as a web user and for what purpose?

Lawful Basis For Processing

Legitimate Interests The processing is necessary to accommodate ours and the user legitimate interest to improve our services, platforms and systems to provide a better service to the consumer. (Rec.30; Art.7(1)(f), Rec.47, 48; Art.6(1)(f))

Data Minimization (Lifetime For The Collected Information)

We store the data for a period of 36 months from when the purchase has been processed (including delivery and payment) to comply with booking laws, customer protection laws, directive on distance selling etc.

What personal data do we collect about you as a merchant and partner and for what purpose?

Lawful Basis For Processing

Contractual Necessity The processing of the information is necessary to accommodate ours and the Merchant obligations regarding the contract when referencing to financial agreements, possibility to pay or to invoice. (Rec.30; Art.7(1)(b), Rec.44; Art.6(1)(b))

Legal Obligations The processing of the information is necessary to accommodate ours and the consumer legal obligations regarding frauds and incorrect use of personal information, providing when necessary, information for basis in legal investigations. (Rec.30; Art.7(1)(c), Rec.45; Art.6(1)(c), 6(3))

Data Minimization (Lifetime For The Collected Information)

We store the data during the full length of the Merchant/partner agreement and for an additional period of 36 months from when the purchase has been processed (including delivery and payment) to be able to comply with booking laws, customer protection laws, directive on distance selling etc.

Lawful Basis For Processing

Legitimate Interests The processing is necessary to accommodate ours and the Merchant legitimate interest to improve our services, platforms and systems to provide a better service to the consumer and Merchant experience. (Rec.30; Art.7(1)(f), Rec.47, 48; Art.6(1)(f))

Data Minimization (Lifetime For The Collected Information)

We store the data during the full length of the Merchant/partner agreement.

Lawful Basis For Processing

Legitimate Interests The processing of the information is necessary to enable the capacity of prospect and negotiation of the company as well the Merchants. (Rec.30; Art.7(1)(f), Rec.47, 48; Art.6(1)(f))

Consent By contacting and discussing with us, some personal information can be saved during the process of negotiation to enable business contacts. (Rec.30, 33; Art.7(1)(a), Rec.32, 42, 43; Art.6(1)(a))

Data Minimization (Lifetime For The Collected Information)

We store the data before and during a conversation between you and Urb-it and during the full length of the Merchant/partner agreement if such exists.

Will urb-it share or transfer my personal data?

To successfully carry out our Service we may transfer or share your information with selected third parties, i.e.

• Logistics subcontractors: The personal information and the information about your purchase may be shared with an assigned subcontracted carrier, courier or hub operating company. This information is necessary to fulfil the delivery. Urb-it’s subcontractor selection process places high requirements on liability and Urb-it have a legal agreement with them to ensure the safe keeping of your information. Your information will be accessible only during the time needed to complete the delivery.
• Technical and platform suppliers: This is related to our infrastructure, for example a cloud database or a payment provider. We take all reasonable legal, technical, and organisational measures to ensure that your data is treated securely and with an adequate level of protection when transferred to or shared with such selected third parties, and only if it’s necessary to fulfil the purpose.  See further information about our subprocessors under Urb-it Sub-processors
• Partners. Urb-it might share your information with the Merchant at which you made your purchase when the personal data is necessary for the Merchants/partners performance and administration of your order, including disputes. The personal data shared with the Merchant/partner will be subject to the Merchants/partners privacy policies and practices.
• Authorities. Urb-it may disclose necessary information to authorities such as the police or other authorities unless required by law or if you agreed to it.

Will urb-it transfer my personal data outside of the uk?

Whenever we transfer your personal data out of the UK or EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission or the UK's Information Commissioners' Office (as applicable). 
  

• Where we use certain service providers, we may use specific contracts approved by the European Commission or the UK's Information Commissioners' Office (as applicable) which give personal data the same protection. 

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK or EEA.

What rights do you, as a data subject, have?

• Right to access your data. You may request a transcript of records if you would like to know and verify the information related to you. The transcript of records may be requested free of charge. However, this does not apply if requested multiple times in a short time, i.e. spamming.
• Right to rectification. You have the right to correct inaccurate or incomplete information about yourself.
• Right to be forgotten (Right to erasure). You have the right to request the deletion of your personal data insofar as this personal data is no longer necessary for the purpose it was collected. However, certain legal obligations prevent us from immediately deleting parts of your data. These obligations derive from accounting and tax laws and consumer rights laws. What we will do is block the data that we must keep from being used for any other purposes than meeting such legal requirements.
• Right to object to processing.  You have the right to object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
• Right to request restriction of processing.  You have the right to request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:

1. If you want us to establish the data's accuracy.
2. Where our use of the data is unlawful but you do not want us to erase it.
3. Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
4. You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it

• Right to lodge a complaint with the Information Commissioner's Office. For further information and contact details, please visit https://ico.org.uk or address any query in this respect to Urb-it's data protection officer at dataprotection@urbit.com.

How Can You Exercise Your Rights Provided Under The Gdpr?

Please contact us at dataprotection@urbit.com if you want to exercise any of your rights mentioned above.

How we will notify you about changes in this policy or security breaches?

We’ll notify you before we make changes to this policy. We’ll notify you in case of any security breach that we identify as hurtful for the personal data that we hold from you. The notification process will be done via email or SMS.

Change of Purpose 

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent where this is required or permitted by law."

If You Fail to Provide Personal Data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a service of ours you use but we will notify you if this is the case at the time.

What about cookies and other tracking technologies?

We use cookies and similar technologies to deliver a tailored and smooth online experience. For detailed information about how Urb-it uses cookies and similar, please read our cookie policy. We also use geo-tracking when using map functionality on your device.

Urb-It Sub-Processors

Overview

Urb-it uses certain sub-processors to assist it in providing to its customers the Services as described in the Terms of Service. Defined terms used herein shall have the same meaning as defined in the Agreement A sub-processor is a third-party data processor engaged by Urb-it that has or potentially will have access to or process Customer Data (which may contain Personal Data). Urb-it engages different types of sub-processors to perform various functions as explained in the tables below.

Infrastructure

We use the following sub-processors to provide our cloud infrastructure environment and storage of our Customer Data:

Processing of user content

We work with various sub-processors that monitor, maintain and otherwise support the Services. In order to provide this functionality these sub-processors may, but not necessarily will, have access to Customer Data: