Lunchbox Privacy Notice

1. Introduction

Lunchbox Inc. and/or its affiliates ("Lunchbox," the "Company," "we," "us," and "our,") respect your privacy and are committed to protecting it through its compliance with its privacy policies. This policy describes:

• the types of information that Lunchbox may collect from you when you access or use its websites,applications and other online services (collectively, referred as "Services"); and
• its practices for collecting, using, maintaining, protecting and disclosing that information.

This policy applies only to the information Lunchbox collects through its Services, in email, text and other electronic communications sent through or in connection with its Services.

This policy DOES NOT apply to information that you provide to, or that is collected by, any third-party, such as restaurants at which you make reservations and/or pay through Lunchbox’s Services and social networks that you use in connection with its Services. Lunchbox encourages you to consult directly with such third-parties about their privacy practices.

Please read this policy carefully to understand Lunchbox's policies and practices regarding your information and how Lunchbox will treat it. By accessing or using its Services and/or registering for an account with Lunchbox, you agree to this privacy policy and you are consenting to Lunchbox's collection, use, disclosure, retention, and protection of your personal information as described here. If you do not provide the information Lunchbox requires, Lunchbox may not be able to provide all of its Services to you.

Lunchbox, Hallegatan 15,Götehnburg,Swedenwill be the controller of your personal data provided to, or collected by or for, or processed in connection with our Services.

2. Overview
This notice applies to users of Lunchbox’s apps, websites, and other services globally

This notice describes how Lunchbox and its affiliates collect and use data. This notice applies to all Lunchbox users globally, unless they use a service covered by a separate privacy notice

• Delivery persons: those who provide delivery services via Lunchbox Delivery partner app.
• Order recipients: those who request or receive food or other products and services for delivery or pick-up via their Lunchbox account. This includes those who use guest checkout features to access delivery or pick-up services without creating and/or logging into their account.

This notice also governs Lunchbox’s other collections of data in connection with its services. For example, we may collect contact information of owners or employees of restaurants or merchants on the Lunchbox’s Customer, Vendor and Driver platforms; contact information of those who manage and use accounts owned by Enterprise Customers; or data of those who start but do not complete their applications to be drivers or delivery persons.

All those subject to this notice are referred to as “users” in this notice.

Our privacy practices are subject to applicable laws in the places in which we operate. This means that we engage in the practices described in this notice in a particular country or region only if permitted under the laws of those places.

In addition, please note the following:

• For users in Sweden:: Lunchbox Hallegatan 15,Götehnburg,Sweden is Lunchbox’s appointed representative for purposes of the Federal Act on Data Protection, and may be contacted here or by mail as relates to that act.
• For users in the European Economic Area (“EEA”), United Kingdom (“UK”), and Sweden: Due to data protection and other laws in these regions, including the European Union’s General Data Protection Regulation (“GDPR”), Lunchbox does not perform certain of the data collections and uses described in this notice in the EEA, UK or Sweden. Such data collections and uses are indicated herein with an asterisk (*).

Please contact us Luncbox with any questions regarding our practices in a particular country or region.

3. Data collections and uses
1. The data we collect

Luncbox collects data:

1. provided by users to Lunchbox
2. created during use of our services
3. from other sources

Lunchbox collects the following data from these sources:

1. Data provided by users. This includes:

   • Account information:

     We collect data when users create or update their Lunchbox accounts, or place orders via guest checkout features. This includes first and last name, email, phone number, login name and password, address, profile picture and user settings

     For drivers and delivery persons, this may also include vehicle or insurance information, emergency contact information, and evidence of health or fitness to provide services using Lunchbox delivery app.

   • Background check information (drivers and delivery persons):

     This includes information submitted during the driver/delivery person application process, such as driver history or criminal record (where permitted by law), license status, known aliases, prior addresses, and right to work. This information may be collected by Luncbox service providers.

   • Identity verification documents and photos:

     This includes government issued identification such as driver’s license or passports (which may contain identification photos and numbers, date of birth, and gender), and user-submitted photos such as selfies and profile pictures.

2. Data created during use of our services. This includes:

   • Location data (delivery person):

     We collect precise and approximate location data from drivers’ and delivery persons’ mobile devices when the Lunchbox delivery app is running in the foreground (app open and on-screen) or background (app open but not on-screen).

   • Location data (order recipients):

     We collect precise and/or approximate location information from riders’ and order recipients’ mobile devices if they enable us to do so via their device settings.

     Lunchbox collects such data from the time a ride or order is requested until it is finished, and any time the app is running in the foreground (app open and on-screen). See “Choice and transparency” below for information on how riders and order recipients can enable precise location data collection.

     Order recipients may use the Lunchbox customer app without enabling collection of location data from their mobile devices. However, this may affect certain features in the Lunchbox app. For example, a recipient who has not enabled precise location data will have to manually enter their order delivery address.

     In addition, precise location data collected from a driver’s device during a trip is linked to the recipients account, even if the recipient has not enabled precise location data to be collected from their device. This data is used for purposes such as customer support, fraud detection, insurance, litigation and receipt generation.

   • Transaction information:

     We collect transaction information related to the use of our services, including the type of services requested or provided; Order details (such as date and time, requested pick-up and drop off addressesand items ordered); and payment transaction information (such as a restaurant’s or merchant's name and location, amount charged, and payment method). We also associate a user’s name with that of anyone who uses their promotion code.

   • Usage data:

     We collect data about how users interact with our services. This includes access dates and times, app features or pages viewed, browser type, and app crashes and other system activity.

   • Device data:

     We collect data about the devices used to access our services, including the hardware models, device IP address or other unique device identifiers, operating systems and versions, software, preferred languages, advertising identifiers, device motion data, and mobile network data.

3. Data from other sources. These include:

   • users or others providing information in connection with claims or disputes.
   • service providers who help us verify users’ identity, background information, and eligibility to work, detect fraud, and screen users in connection with sanctions, anti-money laundering, or know-your-customer requirements.
   • insurance, vehicle, or financial services providers for drivers and/or delivery persons.
   • publicly available sources.
   • law enforcement officials, public health officials, and other government authorities.
2. How we use data:

Lunchbox uses data to enable reliable and convenient delivery, and other products and services. We also use data:

• to enhance the safety and security of our users and services
• for customer support
• for research and development
• to enable communications between users

Lunchbox uses the data we collect:

1. This includes using data to:

   • create/update accounts.
   • enable transportation, delivery and other services/features, such as:
     • using location data to navigate order pick-ups and order drop-offs, calculate ETAs, and track the progress of deliveries.
     • enabling features that involve data sharing, such as sharing driver first name and vehicle information with recipients to facilitate pick-ups, or features that enable ETA sharing and fare splitting.
     • matching available drivers and delivery persons to users requesting services, including based on personal data such as location and proximity to other users, and user settings / preferences (such as preferred destinations), and non-personal data such as vehicle type requested.
     • enabling features that involve account linking, such as linking email accounts to create Lunchbox accounts
   • Calculating prices and fares, including using location data and trip or order details (such as requested pick-up and drop off addresses). We may also consider non-personal data or factors, including date and time, estimated distance and time, minimum base fares, tolls, taxes and fees.
   • personalize users’ accounts. For example, we may present order recipients with personalized restaurant or food recommendations based on their prior orders and delivery location.
   • provide users with delivery updates, generate receipts, and inform them of changes to our terms, services, or policies.
   • perform necessary operations to maintain our services, including to troubleshoot software bugs and operational problems.

   Lunchbox performs the above activities on the grounds that they are necessary to fulfill the terms of our agreements with users, are compatible with such uses, or are necessary for purposes of Lunchbox’s and its users’ legitimate interests.

2. Safety, fraud protection and security. We use data to help maintain the safety, security, and integrity of our services and users. This includes:

   • verifying users' accounts, identity or compliance with safety requirements.

     For example, we review delivery person background checks (including criminal history where required or permitted by law) to verify their identities and eligibility to provide deliveries.

     We process user profile pictures, government-issued identification photos and numbers, or other user-submitted photographs to perform this verification.

     We also use such technology to prevent fraudulent use of identification photos, or to prevent users from creating multiple accounts.

     We also use selfies to verify that users are wearing helmets or other safety gear through the use of object verification technology.

     We also use data from delivery persons’ devices to verify the type of vehicles they used to provide deliveries.

   • using customer service information (including reports of safety incidents), device data (e.g., to detect speeding or harsh braking / acceleration), transaction, and usage data to identify potentially unsafe drivers and driving. This can lead to drivers and delivery persons receiving messages encouraging safer driving, and/or account deactivation following human review.

   • using account, device, location, usage, transaction, wireless carrier, and other data, including communications between users and metadata, to prevent, detect, and combat fraud, including by guest users.

   • using driver data (such as past trip information and reported incident rates) and rider data (such as account information, cancellation and reported incident rates, current pick-up and drop-off location, past trip information, and ratings information) to predict and help avoid pairings of users that may result in increased risk of conflict.* We also avoid pairings where one user has previously given the other a low (e.g., 1 star) rating.

   • using location, phone number, user name, vehicle details and other relevant information to provide live support from safety experts during trips or deliveries.

     The fraud and unsafe driving prevention and detection activities described above may be considered profiling under applicable laws, and can result in deactivation of users (generally only after human review).

   Lunchbox performs the above activities on the grounds that they are necessary to fulfill the terms of our agreements with users, and/or for purposes of the legitimate safety and security interests of Lunchbox, our users and members of the general public.

3. Customer support. We use the information we collect to provide customer support, including to investigate and address user concerns and to monitor and improve our customer support responses and processes.

   Lunchbox performs the above activities on the grounds that they are necessary to fulfill the terms of our agreements with users or for purposes of Lunchbox’s legitimate interests in monitoring and improving its customer support services.

4. Research and development. We use data for analysis, machine learning, product development, research, and testing. This helps us make our services more convenient and easy-to-use, enhance the safety and security of our services, and develop new services and features.

   Lunchbox performs the above activities on the grounds that they are necessary for purposes of Lunchbox’s legitimate interests in improving and developing new services and features.

5. Enabling communications between users. For example, a driver may message or call a recipient to confirm a pick-up location, a recipient may call a driver to a restaurant or delivery person may contact an order recipient with information about their order.

   Lunchbox performs the above activities on the grounds that they are necessary to fulfill the terms of our agreements with users.

6. Legal proceedings and requirements. We use data to investigate or address claims or disputes relating to use of Lunchbox’s services, to satisfy requirements under applicable laws, regulations, operating licenses or agreements, insurance policies, or pursuant to legal process or governmental request, including from law enforcement.

Lunchbox performs the above activities on the grounds that they are necessary for purposes of Lunchbox’s legitimate interests in investigating and responding to claims and disputes relating to use of Lunchbox’s services and features, and/or necessary for compliance with applicable legal requirements.

3. Data sharing and disclosure

Some of Lunchbox’s services and features require that we share data with other users, or at users’ request or with their consent. We may also share such data with our affiliates, subsidiaries, and partners, for legal reasons or in connection with claims or disputes.

Lunchbox may share data:

1. With other users:

This includes sharing:

• recipient’s first name, rating, and pickup and/or dropoff locations with drivers.
• order recipients’ first name and order details, including items ordered, allergies or food preferences and special instructions, with other recipients in a group order.
• order recipients’ first name, delivery address, and order information (including drug prescriptions, special instructions, allergies or food preferences) with the restaurant or merchant and, for order deliveries, with the delivery person. We may also share ratings and feedback, or other information to the extent required by law, with the restaurant or merchant and, for order deliveries, the delivery person.
• for drivers and delivery persons, we may share data with the order recipient(s) and restaurants or merchants, including name and photo; vehicle make, model, color, license plate, and vehicle photo; location (before and during trip); average rating provided by users; total number of trips; period of time since they signed up to be a driver or delivery person; contact information; and driver or delivery person profile, including compliments and other feedback submitted by past users.
• We also provide Order recipients with receipts containing information such as a breakdown of amounts charged, driver or delivery person first name, photo, and route map. We also include other information on those receipts if required by law.
2. At users’ request or with users’ consent
• Other people at a user’s request. For example, we share a user’s ETA and location with a friend when requested by that user, or a user’s trip information when they split a fare with a friend.
• Insurance companies. If a user has reported or submits a claim to an insurance company relating to Lunchbox’’s services, Lunchbox will share certain data with that insurance company for the purpose of adjusting or handling the user’s insurance claim.
3. With Lunchbox service providers and business partners

These include the third parties, or categories of third parties, listed below. Where a third party is identified, please see their linked privacy notices for information regarding their collection and use of personal data.

• background check, identity verification and risk solutions providers
• cloud storage providers.
• customer support platform and service providers.
• Google, in connection with the use of Google Maps in Lunchbox’s apps.
• service providers that assist Lunchbox to enhance the safety and security of Lunchbox apps and services.
• service providers that provide us with artificial intelligence and machine learning tools and services.
• accountants, consultants, lawyers, and other professional service providers.
• insurance and financing partners.
• insurance companies, in connection with insurance claims made or reported by a user relating to Lunchbox’’s services, and for the purpose of adjusting or handling the insurance claim.

4. For legal reasons or in the event of a dispute

Lunchbox may share users’ data if we believe it’s required by applicable law, regulation, operating license or agreement, legal process or governmental request, insurance policy, or where the disclosure is otherwise appropriate due to safety or similar concerns.

This includes sharing data with law enforcement officials, public health officials, other government authorities, airports (if required by the airport authorities as a condition of operating on airport property), insurance companies, or other third parties as necessary to enforce our Terms of Service, user agreements, or other policies; to protect Lunchbox’s rights or property or the rights, safety, or property of others; or in the event of a claim or dispute relating to the use of our services.

This also includes sharing data with others in connection with, or during negotiations of, any merger, sale of company assets, consolidation or restructuring, financing, or acquisition of all or a portion of our business by or into another company.

5. With consent

Lunchbox may share a user’s data other than as described in this notice if we notify the user and they consent to the sharing.

4. Data retention and deletion

Lunchbox retains user data for as long as necessary for the purposes described above. Users may request account deletion through the Lunchbox apps and websites.

Lunchbox retains user data for as long as necessary for the purposes described above, which varies depending on data type, the category of user to whom the data relates, the purposes for which we collected the data, and whether the data must be retained after an account deletion request for the purposes described below.

For example, we retain data:

• for the life of users’ accounts if such data is necessary to provide our services. E.g., account data.
• for 7 years if necessary to comply with tax requirements. E.g., drivers’ and delivery persons’ trip or delivery location information.
• for defined periods as necessary for purposes of safety or fraud prevention. E.g., we retain incomplete driver applications for 1 year, and rejected driver applications for 7 years.

Users may request deletion of their account through the Privacy menus in the Lunchbox app, or through Lunchbox’s website

Following an account deletion request, we delete the user’s account and data, except as necessary for purposes of safety, security, fraud prevention or compliance with legal requirements, or because of issues relating to the user’s account (such as an outstanding credit or an unresolved claim or dispute). For drivers and delivery persons, this generally means that we retain certain of their data for as long as necessary for actual or potential tax, litigation, or insurance claims. For rider and order recipients, we generally delete data within 90 days of an account deletion request, except where retention is necessary for the above reasons.

4. Choice and transparency

Lunchbox enables users to access and/or control data that Lunchbox collects, including through:

• privacy settings
• device permissions
• User data requests

1. Privacy settings
• Share Live Location (Order recipients)

Order recipients can enable/disable Lunchbox’s sharing of their mobile device real-time location data with their drivers or delivery persons (as applicable) through their device settings.

• Location data collection (Order recipients)

Order recipients can enable/disable Lunchbox’s collection of their mobile device location data through their device settings.

2. Device permissions

Most mobile device platforms (iOS, Android, etc.) have defined certain types of device data that apps cannot access without the device owner’s permission, and these platforms have different methods for how that permission can be obtained. Users should check the available settings on their devices, or check with their provider.

3. User data requests

Lunchbox provides users with a variety of ways to learn about, control, and submit questions and comments about Lunchbox’s handling of their data. In addition to the methods indicated below

• Data access and portability: Depending on where they are located, users may have the right to “access” their data (meaning, to be informed of the data that Lunchbox has collected about them), and to “portability” of their data (meaning, to receive a copy of such data). Regardless of their location, Lunchbox provides an option for viewing and obtaining copies of the data Lunchbox has collected about them. Users can access data including their profile data and trip or order history through the Lunchbox apps help section which includes two communication channels of whatsapp and an email.. This allows users to download a copy of the data relating to use of Lunchbox, including account, usage, communications, and device data.
• Changing or updating data: Users can edit the name, phone number, email address and profile picture through the Settings menu in Lunchbox’s apps or driver portal.
• Deleting data: Users may request deletion of their account through Lunchbox apps help section.
• Objections, restrictions, and complaints: Users may request that we stop using all or some of their data, or that we limit our use of their data. This includes objecting to our use of data that is based on Lunchbox’s legitimate interests. Lunchbox may continue to process data after such objection or request to the extent required or permitted by law.

In addition, depending on their location, Users may have the right to file a complaint relating to Lunchbox’s handling of their data with the data protection authority in their country. For example, users in the EU and Latin America may submit such requests to the data protection authorities in the country in which they live.

5. Legal information

Updates to this Privacy Notice We may occasionally update this notice. We may occasionally update this notice. If we make significant changes, we will notify users in advance of the changes through the Lunchbox apps or through other means, such as email. We encourage users to periodically review this notice for the latest information on our privacy practices Use of our services after an update constitutes consent to the updated notice to the extent permitted by law. Lunchbox does not perform the data collections or uses indicated with an asterisk (*) in the EEA, UK or Sweden.