Qbab Privacy Statement for Customers

Introduction

The Qbab App has been designed and built with your privacy in mind. Unlike most food ordering apps, you do not have to provide us with your name, phone number, email address or other contact details to order and pay for your food and drink if you are collecting it yourself. But we do of course need some information from you in order for the App to work, and some of that information constitutes ‘personal data’ under applicable data protection laws. Also, even though you don’t need to in order to use the Qbab App when you’re collecting your order, we will need some of your personal information if you want your order delivered, or you may choose to share certain personal information with us, for example your email address if you want a receipt for your food and drink purchase.

This Privacy Statement explains what information we do or may collect when you use the Qbab App, what we do with that information, who we share it with, how we keep it secure, and how long we keep it for.

The Qbab App is owned and operated by Qbab (which is a trading name of Software Hothouse Ltd, a company incorporated and registered in England and Wales with registration number 04714088 and its registered office at Ivor Cottage, South Chailey, East Sussex, BN8 4AP).

If you have any questions or concerns about this Privacy Statement, or the Qbab App itself, then don’t hesitate to contact us by email at info@qbab.app.

To make it easier for you to review, we have divided up this Privacy Statement into the sections listed below.

  • Section 1 – What information do we collect?

  • Section 2 – What do we do with the information that we collect?

  • Section 3 – Who do we share your information with?

  • Section 4 – How do we keep your information secure?

  • Section 5 – How long do we keep your information?

  • Section 6 – What are your rights in relation to your information?

We may update this Privacy Statement from time to time in response to changing legal, technical or business developments, so please review it frequently. If we update our Privacy Statement and the amendments involve a material change to the way we collect, use, share, store or otherwise process your information then we will notify you the next time you open the app.

Section 1 – What information do we collect?

This section describes the types of information that we may collect from you, whether as a result of your use of the Qbab App or otherwise.

Your name and contact details

You do not need to provide your name, email address or even your phone number to use the Qbab App. When you download and run the Qbab App, we use Google Firebase to automatically create an ‘anonymous account’ which then assigns a unique identifier (UID) to your phone or other device. Creating a UID this way means that Apple (for iOS) or Google (for Android) knows your phone number and other details of your device, but Qbab does not have access to this information.

If you delete the Qbab App (for example if you’re changing your phone) the UID is also automatically deleted, and you will be assigned a new UID when you reinstall the Qbab App on your new device.

Although not required to use the Qbab App when you’re collecting your order, you may need or choose to provide us with your name, phone number, email address, postal address and/or other contact details in various circumstances, e.g.:

  1. You want to have your food order delivered to a specific address.

  2. You ask for a receipt for your food order to be sent to you by email or text.

  3. You provide a name for your food delivery (which only needs to be your first name, or even a nickname).

  4. You want to tell us about an error in our vendor listings, or you have a query regarding the Qbab App.

  5. You ask us to provide you with such optional, additional services that we may make available in the future, such as letting you specify your favourite vendors, or receiving notifications about changes to opening times, new vendors in your area, or special offers.

Location data

When you are using the Qbab App, we collect information about your geographical location.

You can stop sharing your location data at any time within your device’s Settings, but the Qbab App will not work if you do so. Please see Section 2 for details of why we collect your location data, and what we do with it.

Order information

When you place an order via the Qbab App, we again use Google Firebase to create a another unique identifier – the “Google Firebase Cloud Messaging Token” - which enables us to send notifications to your device without us knowing your phone number.

Note that the Qbab App will not work if you disable notifications on your device – we have to be able to notify you of the status of your order and any problems with it.

When you order any item using the Qbab App, there is a free text field which gives you the option of sending a message or provide information to the vendor, such as information about your allergies or other dietary requirements. We will store this information.

If you specify any food allergies or dietary requirements, we may collect information about your health.

Payment information

When you pay for a food and/or drink order, we instruct our payment processing provider, Stripe, to process the payment, using either your credit/debit card or the Apple Pay (for iOS) or Google Pay (for Android) account associated with your device. None of your credit or debit card, or other payment method information, is collected or stored by Qbab.

Section 2 – What do we do with the personal information that we collect, and what is the lawful basis for us using it?

Your name and contact details

If you have provided us with your name, phone number, email address and/or other contact details we only use those contact details in order to provide you with the information or service that you have requested, whether via the Qbab App or by other means, or to reply to any communication you may send us. You consent to us communicating with you using these methods.

Information about your device

Technical information about your mobile phone or other device is used to authenticate the device and create your ‘anonymous account’ which then enables you to place orders

Location data

We use your location data when you are using the Qbab App for the following purposes:

  • To provide you with details of food vendors that are geographically close to you.

  • If your food order is being delivered, to provide the food vendor with your geographical location.

  • If you are collecting your food, to provide the food vendor with the approximate distance your phone is from the vendor’s location so that the vendor can decide whether to accept your order.

  • To prevent hoax orders.

Order information

We use the Google Firebase Cloud Messaging Token created when you place your order to send you notifications, including when your order starts being prepared and when it is ready for collection, or if for any reason the order cannot be fulfilled.

If we collect any personal information as part of your order (e.g. information about your allergies or dietary requirements) we only collect that information for the purpose of providing it to the vendor.

Legal basis for collecting and using your personal information

Our legal basis for collecting and using your personal information will depend on the information concerned and the specific context in which we collect it.

However, we will normally collect and use personal information from you only where:

  • the collection and use are in our legitimate interests, and not overridden by your data protection interests or fundamental rights and freedoms or

  • we have your consent to do so.

Section 3 – Who do we share your information with?

When you use the Qbab App we will share your information with third parties as follows:

  1. When you download and run the Qbab App, details of your device (including your phone number) will be shared with Google so that they can create your ‘anonymous account’ and assign the UID to your device.

  2. If you place an order via the Qbab App, the details of your order and the Google Firebase Cloud Messaging Token that identifies the Qbab App running on your device are stored in our Google Cloud Firestore database and therefore again shared with Google.

  3. If you place an order via the Qbab App for collection, we will share your approximate distance with the food vendor.

  4. If you place an order via the Qbab App for delivery, we share with the food vendor the delivery address you enter, the phone number you provide, together with either the location of your phone (if you select “Here” as the delivery destination) or the location you indicate on a map. The Qbab App will also ask you for a name which will be linked to your order and shared with the food vendor, but this need only be your first name (or even a nickname).

  5. If you ask for a receipt for your food order, we will store your email address and then share it with Stripe so they can email the receipt to you.

If you decide to communicate with us via a social media platform such as Facebook or Twitter then we may need to share your personal information with that platform and will need to store your account identifier in order to respond to you.

Section 4 – How we keep your information secure?

We will take commercially reasonable, appropriate technical and organisational measures to ensure a level of security appropriate to the risk that could be encountered via the use of the Qbab App, taking into account the likelihood and severity those risks might pose to your rights and freedoms.

In particular, we will take precautions to protect against the accidental or unlawful destruction, loss or alteration, and unauthorised disclosure of or access to the personal information transmitted, stored or otherwise processed by us. Please be aware that, while we make the security of the Qbab App and your personal information a high priority and devote considerable time and resources to maintain robust IT security, no security system can prevent all security breaches. When you choose to share your personal information with us, you accept this and provide your information at your own risk.

Section 5 – How long we keep your information?

Where you provided us with personal information, we will only keep this for the period of time that is necessary to provide our service. This period is usually less than 30 days.

Section 6 – What your rights are in relation to your information?

You have the following data protection rights:

  1. You have the right at any time to withdraw your consent to our processing of your personal information.

  2. You have the right to be told what personal information we hold about you on our database and how we process that data.

  3. You have the right to request that we provide you with a copy (in a commonly used electronic format) of all the personal information that we hold about you. Unless you make repeated requests, we will not charge a fee for providing you with a copy of this data.

  4. You have the right to request that we correct any inaccurate or incomplete personal information that we hold about you.

  5. You have the right to request that we irretrievably delete all personal information that we hold about you (the so-called “right to be forgotten”). Note that there are limited circumstances in which we are legally entitled to refuse to comply with this request.

  6. You have the right to request that we transmit all the personal information that we hold about you (in a structured, commonly used and machine-readable form) to another organisation’s IT environment. Note that we are only legally obliged to comply with this request if it is technically feasible for us to do so.

  7. You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact the UK Information Commissioner’s Office at: https://ico.org.uk/concerns/.

If you wish to exercise any of the rights set out in 1 – 7 above you can do so at any time by sending us an email at info@qbab.app. We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with Data Protection Laws.