Drone deliveries

This Drone Delivery privacy statement (“Privacy Statement”) explains what personal data We (see definitions below) process when we perform drone deliveries, why We process it and who receives Your data. This Privacy Statement supplements our general Customer Privacy Statement, which can be found here.

The definitions set out in the general Customer Privacy Statement shall also apply to this document unless otherwise specifically stated herein.

1. WHO ARE WE AND HOW CAN YOU REACH US?

We are Foodora AB, reg. no. 559007-5643, located at Fleminggatan 20 in Stockholm, Sweden (“foodora, We, Us, Our”), and constitute a part of the Delivery Hero group.

With regard to Your privacy when we perform drone deliveries, it is Us who decide how and for what purposes Your personal data is processed. In data protection language that makes Us a so-called “data controller”, i.e. the party responsible for how Your personal data is processed.

If You have any questions related to how Your personal data is processed, You can contact Us at privacy@foodora.com. If You would like to reach Our data protection officer, please contact DPO@deliveryhero.com.

2. HOW DO WE PROCESS YOUR PERSONAL DATA?

2.1. WHEN YOU SIGN UP FOR DRONE DELIVERIES

When You apply for drone deliveries You will be redirected to our processor and third-party party drone service provider Aviants website. In order for You to apply for drone deliveries You will need to share Your name, phone number, home address and email address. This will allow Us to verify if Your home address is within the designated delivery area and qualifies for a drone delivery. This data will only be shared between Us and Aviant and will not be disclosed to any other parties.

The information We request during the application process is necessary to determine Your eligibility for our drone delivery service. This is required in order for You to potentially be able to receive drone deliveries to Your home address. The legal basis for processing of Your data for the purpose of verifying if you may take part of our drone delivery service is “entering into or performance of a contract’” under Art 6(1)(b) GDPR.

We store this personal data for as long as necessary to assess whether We can deliver to Your specified address using drones. If Your application is rejected, We retain the data only for the period required to complete this assessment. If Your application is approved, We retain the data for as long as You remain Our customer. In the ordinary course of things We delete it when You close Your account, or after three (3) years of inactivity, unless statutory legal requirements mandate longer retention. Should You wish to opt out of drone deliveries, You may submit a request for deletion to addresses specified under Section 1.

2.2 SPECIFICALLY ON THE VERIFICATION OF YOUR HOME ADDRESS

After you have applied for drone deliveries, we, with the support from Aviant, will use the data that You have provided during the application process to verify if You are eligible for drone deliveries. This includes checking if Your home address is within the designated delivery area and if the address has suitable space for the delivery (e.g. enough room, no high obstacles etc.). Thereafter, We will inform You if Your address qualifies for drone delivery or not.

The information We process for this purpose includes your home address, name, email address and phone number.

Verifying that Your home address is eligible for drone delivery is required to be able to perform drone deliveries. The legal basis for this processing is “entering into or performance of a contract” under art. 6(1)(b) GDPR.

The data We process for this purpose will be processed for the same duration as stated under Section 2.1.

2.3 WHEN YOU PLACE AN ORDER

Once Your address has been confirmed eligible for drone deliveries, You may place an order through the Platform. In order for the drone delivery to be performed, We need to share certain personal data with our processor Aviant.

The data is necessary for Us to process Your order and to ensure the successful delivery of Your order. Without sharing this information with Aviant, We would be unable to take necessary steps to fulfill Our contractual obligations to You.

The legal basis for this processing is “performance of a contract” under Art. 6(1)(b) GDPR.

We store this personal data as long as You remain Our customer and in the ordinary course of things We delete it when You close Your account, or after three (3) years of inactivity, unless statutory legal requirements mandate longer retention.

2.4 ENSURING A SAFE DELIVERY

To ensure a safe and efficient delivery process, the drones are equipped with cameras to avoid obstacles, and safely deliver Your order. These cameras help ensure a secure delivery at Your delivery address. The camera quality is intentionally low, to not be able to identify individual characteristics such as the face - however the camera might still make out movement patterns of those who are in or near the delivery area.

During the delivery, the drone may briefly capture footage of the surrounding area, including Your property, to assist with navigation.. However, the drone will never be less than 70 meters above the property and if any individual is detected below the drone, it wont be able to perform the delivery. Video recordings are stored on the drone for seven (7) days for safety reasons, in case an investigation is required due to an incident or similar occurrence. Access to this footage is strictly limited to a small number of people on a need-to-know basis. After seven (7) days, the recordings are automatically deleted.

The legal basis for processing limited visual data during the delivery process is “legitimate interest” under Art. 6(1)(f) GDPR, as it is necessary to ensure the safe and effective operation of the drone delivery service. You can contact us for more information on how we conduct our legitimate interest assessment using the contact information provided in Section 1.

3. HOW LONG DO WE KEEP YOUR DATA FOR?

We retain Your personal data for as long as it is necessary to achieve the purposes We have described above. The duration for which We retain Your personal data is determined by factors such as the scope, nature and purposes of the personal data processing, and whether We have legitimate interests or legal obligations that require Us to retain Your personal data.

4. WHAT ARE YOUR LEGAL RIGHTS?

Information about Your legal rights and how You can exercise them under GDPR can be found in our General Customer Privacy Statement which you can find here.

5. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Statement from time to time to reflect Our new processes, new technologies, and/or new legal obligations. We are committed to keeping You informed of any changes to Our privacy practices, so We encourage You to review this Privacy Statement on a regular basis to stay updated.

Last modified: February 2025