Orbit Delivery — Privacy Policy

Last updated: 27 September 2026

Orbit Delivery ("Orbit", "we", "us") runs a delivery platform for takeaway shops in the UK. It has three parts: an online ordering page for each shop (the Storefront), a management system for shop owners and their staff (the Dashboard), and a mobile app for the riders who deliver orders (the Driver App). This policy explains what personal data we collect through each of them, why, how long we keep it, and what your rights are.

Orbit Delivery is operated by Orbit Delivery Ltd, company number 17464514, of 2nd Floor, College House, 17 King Edwards Road, Ruislip, London, HA4 7AE. We are the data controller for the personal data described in this policy, except where stated otherwise below. You can contact us about privacy at privacy@orbitdelivery.co.uk or by post at the address above.

We comply with the UK General Data Protection Regulation, the Data Protection Act 2018 and the Data (Use and Access) Act 2025. Our registration with the Information Commissioner's Office is in progress; we will publish our registration number here once it is issued.

1. Who this policy covers

This policy applies to you if you are:

• a customer who orders food from a shop's Storefront;
• a shop owner or member of shop staff who uses the Dashboard;
• a rider (driver) who uses the Driver App, or who applies to become one, including a substitute nominated by a rider;
• anyone who contacts us, visits orbitdelivery.co.uk, or fills in an enquiry form.

Each section below tells you which data we collect from each group. If a section doesn't apply to you, you can skip it.

2. Customers ordering from a shop's Storefront

What we collect

• Your name and phone number, and for delivery orders your delivery address and postcode.
• Your email address, if you give it, so we can send order confirmations.
• What you ordered, when, the price you paid and the shop you ordered from.
• Your approximate location if you allow your browser to share it, so the Storefront can show whether delivery is available and how many riders are nearby.
• If you pay by card, your payment is processed by Stripe. We never see or store your full card number. Stripe sends us confirmation that payment succeeded and the last four digits of the card.
• Basic technical information: your device type, browser, IP address and the pages you visit, used for security (for example to detect fraudulent orders) and to keep the site working.

Why we collect it and our legal basis

• To take, prepare and deliver your order, and to pass your name, phone number and address to the shop and to the rider delivering it — performance of a contract with you.
• To send you order confirmations and delivery updates — performance of a contract.
• To detect and prevent fraud, abuse and duplicate orders — legitimate interests (protecting our platform, the shops and other customers).
• To let you re-order easily on the same device — legitimate interests; this is stored only in your own browser and you can clear it at any time.
• We do not use your data for marketing unless you have separately opted in, and we do not sell it.

Who sees it

• The shop you ordered from sees your name, phone number, address and order. The shop is a separate data controller for how it uses your data to fulfil the order.
• The rider delivering your order sees your name, delivery address and, through the app, a way to contact you. Where masked calling is available, the rider calls you through a relay number and does not see your real phone number.
• Stripe processes your payment.
• Our hosting and infrastructure providers listed in section 7.

How long we keep it

Order records are kept for 6 years after the order, because we need them for accounting and tax purposes and to deal with any dispute or chargeback. Your name, phone number and address on an order are removed or anonymised after 12 months; the order amounts and items are kept for the full period without identifying you.

3. Shop owners and staff using the Dashboard

What we collect

• Your name, email address, phone number and password (stored as a one-way hash, never in plain text).
• Your shop's name, address, postcode, opening hours, menu and prices.
• Your subscription and billing details. Card payments are processed by Stripe; we store your Stripe customer reference, subscription status and invoice history, never your full card number.
• Your shop's own Stripe account reference, which customer card payments go into (bank details are held by Stripe, not by us).
• The orders your shop receives and how they were handled, statements and invoices.
• Records of drivers you employ directly, if you register them in the Dashboard (see section 4 — the same rules apply).
• A security PIN you set to protect sensitive settings, stored as a hash.
• Login history: date, time, device and IP address of sign-ins, and the two-factor authentication details you set up.
• Technical and usage information about how you use the Dashboard, for security and to fix problems.

Why we collect it and our legal basis

• To provide the Dashboard, dispatch riders, bill you and pay you — performance of a contract (your Shop Services Agreement).
• To keep your account secure and detect misuse — legitimate interests and our legal obligations under data protection law.
• To send you service messages (order alerts, billing reminders, security alerts) — performance of a contract. These are not marketing and you cannot opt out of them while you have an account.
• To meet accounting, tax and regulatory obligations — legal obligation.

How long we keep it

For as long as you have an account, and for 6 years after it closes for accounting and legal purposes. Login and security logs are kept for 12 months.

4. Riders using the Driver App (and substitutes)

Riders give us more personal data than anyone else, because we are legally required to check that people delivering through the platform have the right to work in the UK and are who they say they are. Please read this section carefully.

What we collect

When you apply and verify your account

• Your name, email address, phone number, home postcode, date of birth and the type of vehicle you use.
• Photographs of your identity documents: driving licence, and where relevant motorcycle licence, insurance certificate (hire and reward), vehicle registration document (V5C), and proof of your right to work.
• If you are not a British or Irish citizen, your Home Office share code, which we use to check your right to work through the official online service. If you are a British or Irish citizen, we check your passport by seeing the original on a live video call or in person, or through a certified digital identity provider.
• If you use a motor vehicle, your DVLA check code, which we use to check your licence on gov.uk, once when you join and once a year after that.
• A reference selfie — a clear photo of your face, taken in the app.
• The date each document expires, so we can remind you to renew it.
• Your acceptance of our Driver Terms and of this policy.

Every shift

• A live selfie each time you sign on to a shift, which is compared to your reference selfie to confirm that the person working is the account holder. A live selfie that passes the check is not kept at all: it is compared and immediately discarded. A live selfie that fails the check, cannot be checked because our provider is unavailable, or is sent for review by a person, is kept for 12 months so that a person can review it and so that we can show what happened if the check is later questioned (for example by a right-to-work inspection), and is then permanently deleted; the result (match / no match, with a confidence score) and the time are kept as part of the delivery record. See "Biometric data" below.
• Your location, continuously while you are online, including while the app is in the background or you are using a navigation app. This is used to offer you nearby jobs, to let the shop and customer see where their order is, to confirm you have arrived at the shop and at the customer, and to calculate distance and waiting pay. Location tracking stops when you go offline. You can see when it is active from the notification on your phone.
• Details of every job: which shop, the customer's delivery address, the times you accepted, arrived, collected and delivered, the route distance, any proof-of-delivery photo you take, any hand-backs and the reasons you give.
• Messages between you and Orbit's support team through the in-app Inbox.

Payments

• Your earnings for each job, tips, waiting pay, and your payout history.
• If you set up instant cash-out, your Stripe Connect Express account. Stripe collects and holds your bank details and identity information for its own regulatory checks; we hold only your Stripe account reference and payout records.

Your device

• Device identifier, app version, operating system, and a push notification token so we can alert you to new jobs. We enforce one active device per account; signing in on a new device signs out the old one and we notify you by email so you can report it if it wasn't you.

Substitutes

• If you nominate a substitute to deliver on your behalf, we collect the same verification data from them as from you. Every delivery records who actually performed it.

Biometric data — the selfie check

The face comparison uses biometric data, which is "special category" data under UK GDPR. We process it on the basis of your explicit consent, which you give when you upload your reference selfie and again each time you take a shift selfie. We do this to prevent account sharing and illegal working, which protects you, the shops and Orbit from criminal penalties.

How it works in practice:

• When you upload your reference selfie we check that it contains exactly one clear face. If it does not, it is rejected immediately and nothing is stored; you are asked to take it again.
• Each shift selfie is compared with your reference selfie by Amazon Web Services (Rekognition) in its London region. AWS processes the images to return a similarity score and does not keep them.
• A check passes when the similarity score meets our threshold. If it does not, you can retry. Repeated failures are reviewed by a person at Orbit before any action is taken on your account.
• If the comparison service itself is unavailable, the check does not count as a failure. Your check-in is recorded as "provider error", flagged for a person to review, and you are asked to try again shortly. A provider outage is never treated as evidence against you.
• If you replace your reference selfie, the old one is permanently deleted and only the fact and date of the replacement are kept.
• We keep your reference selfie for as long as you are an active rider (see section 6 for how long after you leave); a passed shift selfie is not kept; a failed, unchecked or reviewed shift selfie for 12 months; and the result and time of each check as part of the delivery record.

If you withdraw consent you will not be able to go on shift, because the check is a condition of using the platform; you can withdraw it at any time by deleting your account from the Profile screen or by writing to privacy@orbitdelivery.co.uk.

Why we collect it and our legal basis

• To verify your identity and right to work — legal obligation (Immigration, Asylum and Nationality Act 2006 and related regulations) and legitimate interests.
• To offer you jobs, run deliveries, and pay you — performance of a contract (your Driver Terms).
• Location tracking while online — performance of a contract and legitimate interests (dispatch, customer tracking, distance-based pay, safety). Location is a condition of being online; we do not track you when you are offline.
• The selfie check — explicit consent (see above).
• To keep your account secure and prevent fraud — legitimate interests and legal obligation.
• To meet tax, accounting and employment-status record-keeping obligations — legal obligation.

Who sees it

• Shops see your first name, vehicle type and live location while you are delivering for them, and a way to contact you during a job. Shops on our software-only tariff who employ you directly may see your documents, as they are your engager; we make this clear in the app.
• Customers see your first name and your live location while you are delivering their order.
• Orbit's admin team can view your documents and verification status to approve your account. Every time an admin views a document, that access is logged.
• Stripe for payouts; AWS for the selfie comparison; Google/Firebase for push notifications and maps; Twilio for masked calling and SMS codes; and our hosting providers (section 7).
• The Home Office online right-to-work service, when we check your share code.
• We may disclose data to law enforcement or regulators where the law requires it.

How long we keep it

• Identity documents, share code, date of birth and reference selfie: for as long as you are an active rider and for 2 years after you leave, because employers and engagers must retain right-to-work evidence for that period. After that they are permanently deleted.
• Shift check-in results (not the images): 12 months.
• Location history: 30 days, after which it is reduced to the job-level summary (distance, times).
• Job and earnings records: 6 years, for tax and accounting.
• Login, device and security logs: 12 months.

Deleting your account

You can delete your account from the Profile screen in the app. When you do, your personal details, documents and selfies are erased or scheduled for erasure under the periods above, and your completed jobs are kept in anonymised form for accounting.

5. Automated decisions

We use automated systems for two things that affect you:

• Face matching at shift sign-in (riders). If the check fails you can retry; if it keeps failing, a person on Orbit's team reviews it before any action is taken on your account. A failure caused by our provider being unavailable is recorded separately and is never counted against you.
• Job dispatch (riders). Jobs are offered automatically to riders based on distance, availability and whether your documents are in date. This is not a decision with legal effect on you and you are free to decline any job.

We do not make fully automated decisions that have legal or similarly significant effects on you without human review.

6. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased in certain circumstances (subject to the retention periods we are legally required to observe);
• restrict or object to certain processing, including processing based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time where we rely on consent (for example the selfie check);
• complain to us about how we have used your data (see below); and
• complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.

To exercise any of these rights, email privacy@orbitdelivery.co.uk. We will respond within one month. We may need to verify your identity first.

Complaints to us. If you are unhappy with how we have used your personal data, please tell us first at privacy@orbitdelivery.co.uk, or by any other way of contacting us. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome. You can still complain to the ICO at any time.

7. Who we share data with (processors)

We use the following companies to run the platform. Each acts on our instructions under a contract that requires them to protect your data.

Some of these providers are outside the UK. Where data leaves the UK we rely on the UK's adequacy regulations (for the EU), the UK International Data Transfer Agreement or Addendum, or the provider's certification under the UK Extension to the EU-US Data Privacy Framework.

We do not sell personal data, and we do not share it with advertisers.

8. Cookies and local storage

The Storefront and Dashboard use only cookies and browser storage that are strictly necessary: to keep you logged in, to protect against cross-site request forgery, and (on the Storefront) to remember your details and recent orders on your own device so you can re-order quickly. The Storefront also keeps a random identifier on your device, containing no personal information, so that we can slow down automated traffic without affecting other customers on the same mobile network. We do not use advertising or third-party analytics cookies. You can clear stored data through your browser settings at any time.

9. Security

We protect your data with encryption in transit (HTTPS), hashed passwords and PINs, two-factor authentication for administrators, signed and verified messages between our systems, access logging for sensitive documents, and time-limited links for viewing documents. No system is perfectly secure; if we become aware of a breach that puts your rights at risk we will tell you and the ICO as the law requires.

10. Children

The Storefront may be used by anyone old enough to order food. The Dashboard and Driver App are for adults only: riders must be 18 or over. We do not knowingly collect data from anyone under 18 through the Driver App.

11. Changes to this policy

We will post any changes here and update the date at the top. If a change materially affects how we use your data, we will notify riders and shop owners through the app or by email before it takes effect.

12. Contact

Orbit Delivery Ltd 2nd Floor, College House, 17 King Edwards Road, Ruislip, London, HA4 7AE privacy@orbitdelivery.co.uk orbitdelivery.co.uk