Privacy

Policy

If you have any queries or requests about this privacy policy or how we handle your information more generally, you can get in touch by contacting:

• our general customer services team at: support@defected.com
• our Data Protection Officer: support@defected.com

We collect your information when you interact with us or use our services, such as when you use our Site to place an order. We also look at how visitors use our Site, to help us improve our services and optimise customer experience. We collect information:

1. when you create an account with us or you change your account settings;
2. when you place an order with us and during the order process (including for payment and order delivery);
3. through your interactions with us or our services, such as when you request information or to receive marketing, information about Defected initiatives or other communications from us by email, phone, post, SMS, push notification, or via any future chat function that we introduce;
4. when you participate in a competition, prize draw, promotion about our services, or our partners’ services; and
5. when you browse or use our Site (before and after you create an account with us).

We also collect information from third party sites, such as advertising and social media platforms and our fraud detection provider. If you link your social media or your third-party accounts to us, we will keep a record of your social media handle, and the other information that is made available to us according to your social media account settings. 

We will only process your information if there is a reason for doing so, and if that reason is permitted by law. Where we need to provide you with the service you have requested or to enter into a contract with you we use your information to:

• enable us to provide you with access to the relevant parts of the Sites, we collect necessary cookies from your device;
• supply the services you have requested, we collect your name, contact details, delivery address and order details;
• enable us to collect payment from you, we collect your credit or debit card information; and
• contact you where necessary concerning our services, such as to resolve issues you may have with your order, we collect the information listed above and any additional information we may need to resolve your issue.

We also process your information where we have a legitimate interest for doing so, which are to:

• personalise our services, including to make it easier and faster for you to place orders;
• improve the effectiveness and quality of service that our customers can expect from us in the future;
• tailor content that we or our partners display to you, for example so that we can show you partners which are in your area or make sure you see the advertising which is most relevant to you, based on characteristics determined by us;
• enable our customer support team to help you with any enquiries or complaints in the most efficient way possible and to provide a positive customer experience;
• send you information by post about our products, services, promotions and Defected initiatives (if you do not want to receive these, you can let us know by getting in touch (Please see section Contact Us))
• analyse your activity on the Sites so that we can administer, support, improve and develop our business and for statistical and analytical purposes and to help us to prevent fraud; and
• detect, investigate, report and seek to prevent fraud or crime.

We also process your information to enforce our contractual terms with you and any other agreement, to ensure compliance with our internal policies and procedures and for the exercise or defence of legal claims and to protect the rights of Defected and our partners or others (including to prevent fraud).

If you submit comments and feedback regarding the Sites and the services, we may use such comments and feedback on the Sites and in any marketing or advertising materials. We will only identify you for this purpose by the name and the city you have provided us and such comments and feedback may be shared with our partners to assess and improve their services.

We will also analyse data about your use of the Sites and the services to create profiles relating to you and for you. This means that we may make certain assumptions about what you may be interested in and use this, for example, to send you more tailored marketing communications, to present you with partners that we think you will prefer, or to let you know about special offers or products which we think you may be interested. This activity is referred to as profiling. You have certain rights in relation to this type of processing. Please see section Your Rights for more details.

We may also use your information to comply with any legal obligation or regulatory requirement to which we are subject.

Where you have given your consent or where we have a legitimate interest for doing so (and are permitted to do so by law) we will use your information to let you know about our other products and services, or Defected initiatives that may be of interest to you and we may contact you to do so by email, post, phone, or push notification or in-app message.

We use online advertising to keep you aware of what we’re up to and to help you see and find our products.

You may see Defected banners and ads when you are on other websites and apps, such as on social media. We manage this through a variety of digital marketing networks and using a range of advertising technologies. The banners and ads you see are based on information we hold about you, or your previous use of our services (for example, your order history) or on banners or ads on our Site that you have previously clicked on.  We use your information to send you communications that are the most relevant to you. You have certain rights in relation to this type of processing. Please see section Your Rights for more details. For more information on our use of advertising technologies and cookies, please see our Cookie Policy.

We undertake fraud checks on all customers which is necessary for us to:

• perform our contracted services to customers;
• ensure that our services (and those of all our partners) provided are duly paid for;
• ensure that customers themselves are protected from fraudulent transactions being made on their payment cards.

Given the volume of customer orders we handle, we may sometimes use automated systems, including from a third party fraud detection provider. Such system may analyse your order data to make automated decisions as to whether or not we should accept an order. This is a fairer and more accurate and efficient way of conducting fraud checks since human checks would simply not be possible in the timeframes and given the volumes of customers that we deal with.

The checks and decisions that are made look at various components including known industry indicators of fraud which our expert fraud detection provider makes available to us, as well as fraud patterns we have detected on our Sites. When combined, these generate an automated score indicating the likelihood of a fraudulent transaction. Where we believe there may be fraudulent activity we may block you from placing an order and using our Site. The specific fraud indicators are dynamic so will change depending on what types of fraud are being detected in the industry, country and our Sites at any particular time.

Our fraud detection is in place to protect our customers, as well as Defected. You have the right to contest any automated decision made about you and to be given more information about why any such decision was made. Please see section Your Rights for more details.

We will only retain your information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your information for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

The information we collect about you will be transferred to and stored on our servers located within the EU. We are very careful and transparent about who else your information is shared with.

We share your information with other Defected group companies only where necessary for the purposes set out in the Use of Your Information section above. We share your information with our partners (such as restaurants, grocers, and other retail partners on Defected), who have access to limited information to enable them to fulfil an order. Where relevant and you give your consent, we may share the health information you volunteer to us with partners to enable them to investigate and respond to complaints.

We share your information with third party service providers that provide services on our behalf.

• Payment providers (including online payment providers and fraud detection providers);
• IT service providers (including cloud providers);
• Riders, who have access to limited information to enable them to fulfil an order;
• Customer support providers (including, but not limited to, companies that assist us to provide customer or technical support); and
• Marketing and advertising partners.

We may also share your information:

• if we are under a duty to disclose or share your information in order to comply with (and/or where we believe we are under a duty to comply with) any legal obligation or regulatory requirement;
• in order to enforce our contractual terms with you and any other agreement;
• to protect the rights of Defected, our partners, or others, including to prevent fraud; and
• with such third parties as we reasonably consider necessary in order to prevent crime, e.g. the police or for health and safety purposes.

In some cases the information we collect from you might be processed outside the United Kingdom or the European Economic Area, such as the United States and the countries in which Defected operates. These countries may not have the same protections for your information as the UK or EEA has. To the extent these countries have not been lawfully recognised as providing an adequate level of data protection, we will ensure that the information that is processed by us and our suppliers outside of the UK or EEA is protected in the same way as it would be if it was processed within the UK or the EEA. We ensure to use an appropriate data transfer mechanism, such as reliance on the protections set out in approved standard contractual clauses.

Please contact us using the contact details above for further information on the specific mechanism used by us when transferring your information.

We adopt robust technologies and policies to protect your information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We have implemented procedures to deal with any data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will take steps to protect your information, we cannot guarantee the security of your information transmitted to the Sites; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

When you open an account you may create a password, or other secure login method and also provide payment card details. You must use a unique password and keep any password you create, or other secure login method, secret in order to help prevent others from accessing your account.

Under certain circumstances, you have rights under data protection law in relation to the information we hold about you.

• The right of access. This is also known as a “data subject access request”. You have the right to receive a copy of the information we hold about you and to check that we are lawfully processing it.
• The right to rectification. You are entitled to have any incomplete or inaccurate information we hold about you corrected, though we may need to verify the accuracy of the new information you provide to us. 
• The right to erasure. This is also known as “the right to be forgotten” which enables you to request the deletion or removal of certain of the information that we hold about you where there is no good reason for us continuing to process it. This right is not absolute and only applies in certain circumstances.
• The right to restrict processing. You have the right to block or suppress further use of your information in certain circumstances. When processing is restricted, we may still have a lawful reason to store your information, but we will not use it further.
• The right to data portability. You have the right to receive your information in a structured, commonly used and machine-readable format which you can transfer to another service provider or other third party. This right is not absolute and only applies in certain circumstances.
• The right to withdraw consent. Where we rely on consent to use your information, you have the right to withdraw that consent at any time.  Withdrawing consent will not, however, make unlawful our use of your information before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain services to you.
• The right to object to processing. You have the right to object to certain types of processing of your information, including processing for direct marketing purposes and profiling. You can object by changing your marketing preferences and disabling cookies as set out in section Cookies and section Marketing or by contacting us. 
• You have the right not to be subject to a decision based solely on automated processing of your information, such as in connection with our fraud checks. 
• Account Deletion (Mobile App). You have the option of deleting your account in the mobile app by following the procedure available in the application as follows: Open the mobile app, go to your account, click on the settings icon and scroll to the bottom where you will find a button to permanently delete your account.

To exercise any of these rights, please contact our Data Protection Officer in writing at support@defected.com. 

If you are unhappy with how we have handled your information you can contact your local data protection authority. In the UK, this is the Information Commissioner’s Office . We would, however, really appreciate the chance to deal with your concerns before you approach your local data protection authority and so we please ask that you contact us first.

We update this privacy policy from time to time, so remember to check back in every so often, in case anything has changed and, where appropriate, we may notify you of the changes, for example by email or push notification.

This privacy policy was last updated: 12th April 2022