Courier Privacy Statement

This Privacy Statement (“Statement”) explains how the Just Eat Takeaway.com Group, acting through the relevant Data Controller for your jurisdiction (collectively, "JET," “JET Group,” "we," "us," "our," etc., and individually, the "Data Controller"), collects, uses and discloses personal and business data of courier contracted to deliver orders, (including couriers who have signed up to deliver orders, but have not yet completed the contractor signup process) via the Courier App, Courier Portal (web) and associated websites and platforms (collectively and each individually, the "Courier Platform").

The Data Controller responsible for your data is determined by your location:

• United Kingdom: Just-Eat.co.uk Ltd
• Ireland: Just-Eat Ireland Ltd
• Slovakia: Just-Eat Holding Limited (SK)
• Austria: Takeaway.com European Operations B.V. Niederlassung Österreich
• Canada: Skipthedishes Restaurant Services Inc.
• Israel: Scoober Tel Aviv Ltd.

At JET, we are committed to protecting the privacy of everyone in our community and those who make use of our services. It is important that you read this Statement, together with any other privacy statement or policy we may provide on specific occasions when we are collecting or processing data about you, so that you are aware of how and why we are using such data, your rights regarding your data and how to exercise them.

By visiting and/or using the Courier Platform, you acknowledge and consent to the collection, use, storage, processing, disclosure, and transfer of your data as set out in this Statement.

For couriers in Israel: You are under no legal obligation to provide personal data to us by means of using our Services, and provision of personal data is solely based on your free will.

For couriers in Canada: If you do not agree with any part of this Statement, you should not use or conduct any transactions on the Courier Platform, navigate away from the Courier Platform immediately, and uninstall our application. Your continued use of the platform constitutes your ongoing consent to these practices.

For the purposes of this Statement, the legal ground for processing your data depends on your jurisdiction. For example, in the European Economic Area (EEA) and the United Kingdom, we may rely on a number of legal grounds including legitimate interests. However, for couriers in Canada, we process your data primarily based on your consent (as provided above), the performance of our contract with you , or to comply with legal obligations.

What data is processed in the Courier Platform

Personal Data means any information or set of information from which we are able, directly or indirectly, to personally identify you, in particular by reference to an identifier e.g. name, email address, phone number, etc. Personal Data does not include data where the identity has been removed (anonymous data). In some cases, Personal Data can also be business information and may be subject to certain exceptions under applicable privacy laws.

Why we process Personal and Business Data

1. Account creation

In order to provide your independently contracted delivery services via the Courier Platform, you must sign-up for a courier account and provide the following data:

• First and last name
• Contact information
• Identification documents
• Proof of work eligibility
• Driving license information
• Criminal disclosure certificate (United Kingdom, Canada, Slovakia)
• Insurance certificate details
• Banking information
• Tax information
• Face image data (for biometric identity verification) (United Kingdom)

We use this information to handle your submission and to manage any ongoing contractor relationship. Our payment services providers also process your credit or debit card information if you decide to purchase a courier bag via the Courier Platform.

If you are applying in the United Kingdom we may also process your face image data via biometric verification methods for identity verification purposes.

If you are applying in the United Kingdom, Canada or Slovakia we may process your data and identification documents to conduct a background check (such as to check your right to work and a criminal record) for purposes of fraud prevention (for instance, the prevention of duplicate courier accounts or account sharing), and network safety.

The legal ground for this purpose is performance of our contract with you.

2. Setting your availability and obtaining delivery runs

To offer your delivery services on the Courier Platform you must let us know when you are available, so that we can offer delivery runs to you. This includes processing the following data:

• First and last name
• Courier ID
• Your availability times
• Contract related delivery metrics
• IP Address
• Device ID

In Canada, the United Kingdom and Ireland, couriers with contract-related delivery metrics including without limitation, delivery delay, undelivered orders, etc. are less likely to receive delivery opportunities matching their availability. Nonetheless, all couriers will maintain the ability to be offered scheduled delivery runs, as well as sign up for open runs. This approach helps us maintain a high-quality and reliable service.

The legal ground for this purpose is the performance of our contract with you and/or legitimate interest of JET.

3. Order delivery, network efficiency and optimisation

To be able to offer you orders for delivery and improve our network efficiency we process the following data:

• First and last name
• Courier ID
• Live GPS location
• Route taken
• IP Address
• Device ID
• Device Data

To provide the core services of the Courier App, we access your live GPS location during an active delivery run, and any routes taken to pick up or drop off orders. We need to access your GPS location at regular intervals and when you complete key actions in the Courier App so that we can offer you orders for delivery, which you can always accept or decline, and track your location and route taken during delivery. We show your location to partners and customers so they can estimate when to expect the order and reduce the amount of time you spend waiting.

This data is stored and used by JET to better estimate drive times, and to support customer service inquiries from customers and Partners. We also need to access your location while you are looking for a shift in order to show you delivery zones near you.

If you are not using the Courier App, we do not process your GPS location.

We also access your speed to determine if your app has been updated while you are moving through the delivery process.

In addition to the above, contract-related metrics such as those associated with undelivered orders, delivery delays and other similar metrics may be a factor when we offer individual delivery opportunities. This is part of our effort to maintain a high-quality and efficient service for all platform users.

The legal ground for this purpose is the performance of our contract with you and/or legitimate interest of JET.

If you try to contact the customer via the Courier App in order to complete your delivery, we keep a log of whether you attempted to call or text the customer, including timestamps, and we collect the content of text or in-app messages with the customer. This data is used to support customer service inquiries from customers and Partners.

4. Customer and Partner reviews

Partners (restaurants, convenience stores, grocery stores and other businesses that offer products for delivery, or the various associated websites, platforms or applications) and/or customers may be provided with the opportunity to provide a review of your delivery services.

This includes the following personal data:

• First and last name
• Delivery information
• Review

The legal ground for this purpose is the performance of our contract with you and/or legitimate interest of JET.

5. Support & Courier Request Handling

To provide you with effective support and assistance, and to improve operational efficiency, we process personal data when you contact us or when we contact you through our support channels. This includes support during your application process, once you become a courier, or for any issues arising from your courier activities.

Support services include:

• Managing requests from you (including automated resolution of certain repetitive requests, such as zone addition or removal)
• Assisting you with order-related issues
• Providing general support and guidance
• Ensuring consistency and reducing manual workload for routine inquiries

To facilitate multilingual support and improve response efficiency, we use an AI translation tool that processes the content of your support requests, enabling our support staff to respond more effectively to requests in different languages.

To provide these support services, we process the following personal data:

• First and last name
• Contact information (email address and phone number)
• Courier ID
• IP Address
• Zone information (current and new zones)
• Order details and number of completed orders (where applicable)
• Contextual data relating to your support request

The legal ground for this processing is the performance of our contract with you and/or the legitimate interest of JET in providing efficient customer support and improving operational processes.

6. Call Recordings

Calls may be recorded for training and quality purposes. Our team will always inform you when calls may be recorded and explain the purpose of the recording activity. You always have the option to decline being recorded.

Distress Calls

In the event of a distress call made by you we will collect and process relevant personal data to provide immediate support and assistance. For this purpose, we process:

• First and last name
• Courier ID
• Order details
• Vehicle type
• Incident details
• Location and call details
• Health and safety related information

The legal ground for this processing is the performance of our contract with you and/or the legitimate interest of JET.

7. User Research

To improve our services and platforms, JET may approach you to participate in surveys or other research like user testing, focus groups, etc. We may process the following personal data when you participate in such research activities.

• First and last name
• Courier ID
• Engagement data
• Personal data collected when participating

Participation in the courier research is completely voluntary. The legal ground for this purpose is the legitimate interest of JET and/or your given consent.

8. Audits

To ensure that we comply with legislation on the delivery of age-restricted goods in the United Kingdom and Canada, we may process your personal data for the purpose of performing compliance audits. These audits assess whether we are meeting our regulatory obligations regarding the delivery of age-restricted products.

To conduct audits, we may process the following personal data:

• First and last name
• Courier ID
• Order details (including age-restricted items)
• Delivery date and time
• Delivery location
• Age verification records (including whether ID checks were performed)
• Proof of delivery data

The legal ground for this processing is compliance with legal obligations and/or the legitimate interest of JET.

9. Analytics

JET uses the following data to create data in aggregate and/or de-identified format to be able to conduct internal research and analytics, improve the Courier Platform including our range of products and services, and to fix any technical issues that arise within the Courier Platform. This data is used anonymously for analytical purposes to understand how our users interact with our services.

Device model,

Manufacturer

MAC Address

Software version

IP Address

In Canada, JET may provide aggregate or de-identified data to meet reporting obligations to promotional partners.

10. Compliance with Tax Regulation Obligations

Due to tax regulations, such as the EU Directive on Administrative Cooperation DAC7 (Ireland, Slovakia), The Platform Operators (Due Diligence and Reporting Requirements) Regulations 2023 (United Kingdom), and the Income Tax Act (Canada) we must collect and transfer specific personal and financial data to the relevant tax authorities. This ensures that JET complies with legal obligations.

Personal data that we share include:

• First and last name
• Contact information
• Address
• Compensation data
• Country of birth
• Date of Birth
• Place of birth
• Tax ID (EU & UK), VAT number (EU & UK) and/or Social security number (Canada)

The legal ground for this purpose is necessity to comply with a legal obligation.

11. Marketing and other communications

Essential Business Communications

JET will process your contact information to communicate with you about your courier account, deliveries, customer/Partner feedback, and any matters relevant to your contract with JET, or your application to contract with JET. We will also notify you of important changes to the Courier Platform, your contract with JET, this Privacy Statement, or JET's Terms of Service. You cannot opt out of these essential communications unless you terminate your contractual relationship with JET.

Marketing and Personalized Communications

With your prior consent, or when permitted by applicable law, we may send you personalized communications about events, products, services, and special offers that may interest you, including offers from select third parties, as described below under “Sharing with others”. We may contact you via email, SMS/MMS, website, mobile app push notifications, or third-party platforms such as social media or other publishers. This includes the following data:

Name

Email address

Phone number

Courier ID

Your Right to Opt Out

You can opt out of marketing communications at any time by clicking the unsubscribe link in emails, replying "STOP" to SMS/MMS, or adjusting push notification settings on your device. Note that disabling push notifications will prevent you from receiving order updates via push

For Essential Business Communications the legal ground is the performance of our contract. For Marketing and Personalized Communications the legal ground is your consent and/or JET's legitimate interest, in accordance with applicable law.

12. Cookies and App Analytics

A “cookie” is a tiny element of data that the Courier Platform can send to your browser, which may then be stored on your web browser or mobile device so we can recognize you when you return. Data processed for cookie purposes differ per purpose (functional, analytical or marketing) and depend on the preferences set by you.

Functional Cookies are used to ensure our website remembers your choices and provides better functionality and personalized features.

Analytical Cookies are used to improve our website and our visitors’ experience by analyzing the behaviors and usage patterns of visitors to the Courier Platform.

We process data through cookies as well as unique device identifiers, which function similarly to cookies in a mobile environment, to gain crucial insights into user activity, platform stability, and feature adoption. This process allows us to understand how our couriers interact with the Courier Platform, providing the foundation for continuous improvements, debugging technical issues, and optimizing the delivery experience. We process the following data to track user activity, understand platform usage, and monitor application performance.

Unique device identifiers

Location data (if actively tracked or if you toggle location permissions)

IP Address

Device model

Manufacturer

Software version

Usage data

Courier ID

Data processed for this purpose depends on the preferences set by you. Mobile users can often refuse tracking or reset their device identifiers (which will reset any prior tracking history) through the settings menus on their device. You may set your smartphone to not accept tracking. By disabling these settings, it is possible that parts of the Courier App will no longer work. By clicking on one of the links below you will find how you can change your settings per operating system:

• Apple devices: Go to Settings > select “Courier App” > Location > select ‘Never’ ‘While Using the App’ or ‘Always’
• Android devices: Go to Settings > Apps > select “Courier App” > Permissions > Location, Turn off

Please note that if you turn off the tracking settings on your phone, the Courier App will not work properly and your phone will prompt you to switch the location settings back on. We need your GPS location to provide you with Courier App’s core services and turning this off means that the Courier App cannot notify you of delivery opportunities, which will impact your ability to earn.

The legal ground for this processing of personal data, is the legitimate interest of JET, unless your consent is necessary according to the applicable law.

13. Fraud prevention and detection and network security

We process your data to implement, carry out and maintain security measures aimed at protecting ourselves and Couriers from identity theft, fraud and unauthorized access to an account, to detect infringements of the courier agreement, and to prevent or detect fraud and other forms of misuse on the Courier Platform, such as, but not limited to: undelivered orders, the identification and prevention of duplicate courier accounts, modifications of the mobile phone, etc.

We employ advanced analytical tools and dedicated security infrastructure that supports us in the analysis of this data. This includes tools within the Courier App to verify the security and integrity of your phone. We process the following data for these purposes:

First and last name

Courier ID

IP Address

Device ID

Device data (security status/integrity of the phone)

Account activity data (log-in times, run patterns)

Contract-related delivery metrics (for checking infringements)

The legal ground for this processing is the performance of our contract with you and/or the legitimate interest of JET.

14. Shop & Pay

If you are performing Shop & Pay deliveries in Canada, we process data in connection with the issuance or use of payment cards for Couriers. For this purpose we process the following data:

• First Name
• Last Name
• Email Address
• Phone Number
• Date of Birth
• Courier ID
• Vehicle Type
• City
• Driver/Courier Location
• Delivery Address
• Order Details (scanned items)
• Order Value
• Payment Method
• Digital Card Transaction Details
• Time of Order

The legal ground for this purpose is the performance of our contract with you and/or legitimate interest of JET.

15. H&S Advisor (Austria)

To comply with Austrian occupational health and safety legislation (ArbeitnehmerInnenschutzgesetz - ASchG), JET is legally required to appoint an external, certified Health & Safety Advisor (Sicherheitsfachkraft). The Health & Safety Advisor's role is to conduct risk assessments, implement workplace safety measures, and perform safety inspections. To enable the Health & Safety Advisor to fulfill their legal obligations, we process the following personal data:

First and last name

Date of birth

Social security number

Work accident information (incident details, circumstances, and injury information)

Under Austrian law (§ 363 Abs. 1 ASVG), we are required to report workplace accidents resulting in work incapacity of more than three days (or death) to AUVA (Allgemeine Unfallversicherungsanstalt). These reports are shared with our appointed Health & Safety Advisor to enable them to conduct risk assessments and develop preventive measures as required by law.

The legal ground for this purpose is compliance with legal obligations as well the legitimate interest of JET.

16. Biometric Identity Verification (United Kingdom)

To enhance platform security, prevent fraud and account sharing, and comply with UK regulatory requirements including Right to Work obligations, we implement biometric identity verification for couriers in the United Kingdom. We use automated facial recognition technology to verify that the person performing deliveries is the authorized, background-checked courier on record.

This includes the following personal data:

• Face image data (selfies)
• Biometric data derived from facial features
• Device ID
• Verification timestamps and results
• National identity card details and National Identification Number (from onboarding documents)

You will be prompted to take a selfie through the Courier App at onboarding and may be requested to do so on a daily or random basis thereafter. The system automatically compares your selfie against stored biometric data to verify your identity. Each newly captured selfie replaces the previously stored selfie.

The legal ground for this processing is the legitimate interest of JET and substantial public interest.

17. Loyalty programs and campaigns (Canada)

In Canada, JET offers loyalty programs to provide you with offers and discounts. When you make use of one of our loyalty programs, we process your data to provide you with the discounts or offers as set out in the respective loyalty program. From time to time, JET may also launch contests, sweepstakes or other promotions.

The legal ground for this processing is your consent.

Automated decision-making

In the performance of our contract with you and to improve our platform, JET Group and its service providers uses your data to render decisions based exclusively on automated processing for the following purposes:

• Order matching;
• Determining the payable fee;
• To select orders to offer you for delivery and predict/estimate drive times;
• Use the availability provided by you to provide you with shifts,
• By our service providers in the performance of background checks and/or identity and document verification,
• Network security and fraud detection purposes; and
• Checking infringements of the courier agreement.

We make sure necessary measures are in place to safeguard your rights when we use automated decision-making, including human oversight. You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and have notified you. You have the right to submit observations regarding any automated decision that affects you and the right to object to this type of processing. Please contact us using the details at the end of this Statement to exercise this right.

How long we store data for

JET, as a globally operating company, has to take into account various local data retention requirements. We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for (for details see above paragraph “What personal data we process and why”), including for the purposes of satisfying any legal, accounting, or reporting requirements, or to prevent fraud or future abuse. To determine the appropriate retention period for personal data, we take into account the following criteria

1. the period required to serve the respective business purpose;
2. to the extent reasonably necessary to comply with an applicable legal requirement;
3. amount, nature, and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure of your data, the purposes for which we process your data and whether we can achieve those purposes through other means, and the applicable contractual requirements.

In the event the data falls into more than one retention terms category, the category with the longer retention requirement shall prevail, other requirements (such as access, security etc) notwithstanding.

In some circumstances we may anonymise your personal data so that it can no longer be associated with you, in which case we may use such information without further notice to you

Sharing with customers and Partners

If you are collecting an order, both the Partner and the customer will be able to see your first name and your location while you are on delivery. This data is provided to ensure timely collection and delivery of orders.

Sharing with others

The JET entities may work with other companies within JET Group in order to provide our services. These group companies will process your Personal Data on behalf of us (as data processors) or as separate data controllers and have access to your data for the purposes described in this Statement.

We may also share your personal data with service providers, such as cloud service providers, to operate and provide our services. By submitting your data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Statement.

With your prior consent we may share your data with select third parties, including Partners, advertising and marketing companies, and promotional partners, so that we or they may contact you about products or services that may be of interest to you. Such third parties may contact you by email, SMS/MMS, telephone, or mail. This is subject to compliance with applicable laws, including Canada's anti-spam legislation (CASL). If you change your mind about being contacted by these parties in the future, you can opt out at any time by using the contact details at the end of this Statement or by following the unsubscribe instructions provided in the communications.

Furthermore, we may share personal data with payment service providers, insurance companies, social security institutions, and parties that manage or process payments to you to fulfill our contractual or legal obligations.

We may also share your data with insurance and partnership providers for specific purposes:

• Zego (United Kingdom, Ireland): For business use insurance purposes.
• Chubb Insurance (United Kingdom, Ireland): As part of any claim you or your substitute may make, including name, email address, time worked, and fees earned.
• ONSI (United Kingdom, Ireland): To offer a Public Liability Insurance policy and discounts.
• Eskuta (United Kingdom only): To offer discounted rates for e-bikes, sharing your name and last 4 digits of your phone number.
• AUVA (Austria only): To notify specific incidents to the Allgemeine Unfallversicherungsanstalt.

Additionally, we may use the data that you provide to us if we are under a duty to disclose or share your data in order to comply with (and/or where we believe we are under a duty to comply with) any applicable legal obligation; or in order to enforce the Terms of Service/Use and any other agreement we have with you. This includes among other things exchanging data with other companies and authorities for the purposes of fraud protection and prevention. We and our service providers may use or disclose your data in response to a search warrant or other legally valid inquiry or order, or to another organization for the purposes of investigating a breach of an agreement or contravention of law or detecting, suppressing or preventing fraud, or as otherwise required or permitted by applicable law or legal process.

Your data may also be used or disclosed where necessary or desirable for the establishment, exercise or defense of legal claims and to investigate or prevent actual or suspected loss or harm to persons or property. If our business enters into a joint venture with, purchases or is sold to or merged with another business entity, your data may be disclosed or transferred to the target company, our new business partners or owners or their advisors provided that the information disclosed continues to be used for the purposes permitted by this Privacy Statement.

Where your data gets sent

JET Group and its subsidiaries operate, and process personal data globally. This may result in processing of your Personal Data in countries, including the United States, whose data protection laws may differ from those where you live. If you are in the European Economic Area (EEA), Canada, Israel, and the United Kingdom, please be aware that we may process and/or transfer your Personal Data outside of these aforementioned countries. This may include transferring Personal Data to or accessing it from other jurisdictions, including jurisdictions that may not provide a level of protection equivalent to your local data protection laws (“Non-Adequate Country”). When we transfer Personal Data outside these countries, we adhere to applicable and appropriate safeguards and transfer mechanisms, including:

Standard Contractual Clauses (SCCs);

The EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF.

An intra-group transfer agreement;

Contracting with Data Privacy Framework Agreement certified companies in the United States, if applicable.

Your rights

You can exercise your Data Subject Rights provided by applicable data protection laws, which include:

• The right of access to and to be informed about your Personal Data processed by us (Right of Access).
• The right to rectify incorrect or incomplete Personal Data we have stored about you (Right to Rectify).
• The right to request the erasure of your Personal Data from our systems, unless we have another legal ground not to delete the data in terms of applicable laws (Right to Erasure).
• The right to object to certain use of your Personal Data if such data is processed for other purposes than necessary for the purposes set out in this Statement or for compliance with a legal obligation (Right to Object).
• The right to request us to restrict the processing of your Personal Data (Right to Restriction of Processing).
• You have the right to receive your personal data processed in accordance with this Statement in a machine-readable format, so that you can store this data in a database of yours or of a third party (Right to data portability).
• You have the right to lodge a complaint with the relevant supervisory authority if you consider that processing of your personal data is infringed (Right to lodge a complaint).

Security

JET Group takes personal data protection very seriously and we therefore use appropriate technical and organisational measures to keep the Personal Data we collect about you secure at all times. These measures protect your Personal Data from unauthorised access and unlawful processing, accidental loss, destruction and damage.

How to contact us

If you have any questions or concerns about this Statement and/or our privacy practices, or if you would like to exercise your Personal Data Rights or submit a concern or complaint, please contact the relevant entity below:

Courier App Support/Questions Email:

For the UK & Ireland: [email protected]

For Austria: [email protected]

For Slovakia: [email protected]

Data Protection Officer (DPO):

For the UK & Ireland: [email protected]

For Austria, Slovakia & Israel: [email protected]

For Global: [email protected]

For Canada: [email protected]

Updates to this Privacy Statement

We may update this Privacy Statement from time to time in response to changing legal, technical or business developments. Your continued use of the Courier Platform after any change of our Statement will constitute your acceptance of the revised terms of this Statement.

We encourage you to periodically review this Statement for the latest information on our privacy practices. When we update our Privacy Statement, we will take appropriate measures to inform you, consistent with the significance of the changes we make. Where required by applicable data protection law, we will obtain your consent to any material changes to this Statement.

This Privacy Statement was last updated on June 1, 2026