Privacy Policy

1. Who we are

1. Curb Network is a trading name of [Company legal name] Ltd, a company registered in England and Wales under company number [Company number], with its registered office at [Registered address] (Curb, we, us).
2. Curb operates a network of digital advertising screens carried on delivery riders' bags across London. We are the controller of the personal data described in this policy, which means we decide how and why it is used.
3. We are registered with the Information Commissioner's Office (ICO) under registration number [ICO registration number].
4. Our data protection lead is [Name or role of data protection lead]. You can contact them at hello@curbnetwork.com or by post at [Registered address], marked "Data protection". [Confirm whether a Data Protection Officer must be formally appointed under Article 37 UK GDPR, given the regular and systematic monitoring of rider location.]

2. Who this policy covers

This policy explains how we handle personal data about:

• website visitors, meaning anyone who browses our website or submits a form on it;
• people who work for brands, agencies and other businesses that enquire about, book or manage campaigns with us (advertisers and agencies);
• independent couriers who apply to join, or take part in, the Curb rider programme and carry a Curb screen bag (riders);
• members of the public who may see our screens in the street; and
• the people we deal with at companies that supply services to us (suppliers and partners).

If you are a rider, please also read our Rider Programme Terms. We may give you more specific privacy information when you join. [Consider a separate rider privacy notice provided at onboarding.]

3. Information we collect

Website visitors

• The information you give us through forms on the site, such as your name, company, job title, email address, phone number and the content of your message. If you join the rider waitlist we also ask for your mobile number, the kind of vehicle you ride and the London areas you usually ride in. Our website forms (the media pack request and the rider waitlist) are collected for us by Netlify Forms.
• Technical and usage information, such as your IP address, browser and device type, pages viewed, referring site and the date and time of your visit. Our hosting provider, Netlify, processes this request data to deliver the site and keep it secure. Our website forms set no cookies of their own. Any cookies the site uses are explained in our Cookie Policy, and non-essential analytics only runs if you consent.

Advertisers and agency contacts

• Name, job title, employer, business email address, phone number and business address.
• Records of our communications, meetings, proposals, insertion orders and campaign approvals.
• Billing contact details and payment information for your organisation.
• Log-in and usage data when you use our advertiser dashboard, where you can view plays by zone.

Riders and rider applicants

• Your name, email address, phone number, postal address and date of birth.
• Eligibility information: evidence that you are over 18, [evidence of your right to work in the UK], [your driving licence and vehicle insurance details if you ride a motorised vehicle], and confirmation that you work as an independent courier. [Confirm which checks are carried out.]
• Payment and tax information: bank account details, [Unique Taxpayer Reference or National Insurance number, if needed for tax reporting], invoices or payment statements, and payment history.
• Equipment records showing which screen bag was issued to you (identified by its screen ID), when it was issued and returned, its condition, and any reported loss, theft or damage.
• Location and telemetry data from your screen bag while it is switched on and active, as described in the next section.
• Reports of accidents, injuries, theft or damage involving the equipment. These may include information about your health if you are injured.
• Messages, support requests and feedback you send us.

Members of the public near our screens

• Our screen bags display adverts. They have no cameras, no facial recognition and no sensors that capture passers-by, so they collect no personal data about people nearby.
• We model audience sizes and impressions from the location and time of each play [name any third-party footfall, traffic or population dataset used in the model, and confirm it is aggregated]. These estimates describe groups of people, not individuals, and cannot be used to identify anyone.

Suppliers and partners

Business contact details of the people we deal with, and records of our communications and contracts.

Special category data

We do not intentionally collect special category data (such as health information, ethnicity or religious beliefs), except health information in an incident report where a rider has been injured, or where you choose to tell us about a disability so we can make adjustments. We handle this with extra care, as described in the table below.

4. Rider location data

This section explains in more detail how we handle location data from the screen bags. [A data protection impact assessment (DPIA) and a legitimate interests assessment for rider location data should be completed before launch; confirm.]

1. Each Curb screen bag contains a GPS unit. It records location only while the bag is switched on and active (that is, while it is showing adverts). When you switch the bag off, or it is in standby, it does not record or send your location. [Confirm the hardware behaviour, including any low-frequency "find my bag" location ping when the bag is off, and describe it here if it exists.]
2. While the bag is active we collect its latitude and longitude, speed and heading, timestamp, screen ID, battery level, screen status and connectivity data, recorded approximately every [X seconds]. We also generate proof-of-play logs, which record which advert played, on which screen, when and where.
3. We use this data for:
   1. showing the right advert in the right place (for example, only inside a borough an advertiser has chosen, known as geo-fencing);
   2. producing proof-of-play and campaign delivery reports;
   3. checking whether riders meet the qualifying conditions for the weekly rider fee;
   4. monitoring whether equipment is working and diagnosing faults;
   5. locating equipment that is reported lost or stolen; and
   6. investigating incidents, complaints or suspected misuse, and defending legal claims.
4. We do not use your location data to monitor or manage the delivery work you do for any delivery platform, and we do not share it with delivery platforms or sell it to third parties. We do not collect location data when the bag is switched off.
5. Only authorised Curb staff and our technology providers can see identifiable location data, on a need-to-know basis. Advertisers receive aggregated reports (for example, total plays and impressions by area and time), can view plays by zone in our advertiser dashboard, and may see maps of screen activity. None of this identifies any rider. [Confirm that any route-level maps shown to advertisers are aggregated or delayed so an individual rider cannot be followed or identified.]
6. You decide when the bag is switched on. You can switch it off at any time, for example on a break or when you finish a shift, and location collection will stop.

5. How we use your data and our lawful bases

Under UK data protection law we must have a lawful basis for each way we use personal data. Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms. You can ask us for more information about that assessment.

If you do not provide information we need to enter into or perform a contract with you (for example, bank details to pay a rider), we may not be able to work with you.

6. Marketing

1. We may send business contacts information about our services, new locations and industry insight. Every marketing email includes an unsubscribe link, and you can opt out at any time by emailing hello@curbnetwork.com.
2. We will only send marketing to individuals (rather than business addresses) where PECR allows, usually with your consent.
3. If you opt out, we keep your email address on a suppression list so we do not contact you again.
4. We never sell your data or share it with third parties for their own marketing.

7. Who we share data with

1. Service providers (processors) who act on our instructions under a written contract, including:
   1. Netlify, Inc. (USA), which hosts our website and collects submissions from our website forms;
   2. providers of email and customer relationship management [name providers];
   3. providers of website analytics [name provider, e.g. a privacy-focused analytics tool];
   4. providers of screen management, telemetry and fleet software [name provider];
   5. providers of mobile connectivity for the screen bags [name SIM or network provider];
   6. providers of cloud storage and data processing [name provider]; and
   7. providers of accounting and payment services [name providers].
2. Advertisers and agencies, who receive aggregated campaign reports, proof-of-play summaries and audience estimates, and can view plays by zone in our advertiser dashboard. None of this identifies riders or members of the public.
3. Professional advisers and insurers, such as lawyers, accountants, auditors and our insurers, where needed to run our business or handle a claim.
4. Authorities, such as the police, HMRC or a regulator, where we are required by law or where it is necessary to prevent or detect crime (for example, the theft of a screen bag).
5. A buyer or investor, if we sell, merge or restructure all or part of our business, in which case personal data may be transferred to the new owner under appropriate confidentiality terms.

We do not share rider data with any delivery platform unless required by law or you ask us to.

8. International transfers

1. We aim to store personal data in the United Kingdom or the European Economic Area. [Confirm data hosting locations for each provider.]
2. Our website host, Netlify, Inc., is based in the United States. Personal data you send through our website forms, and request data such as your IP address, is transferred to Netlify in the USA. We protect this transfer with [confirm safeguard: the UK Extension to the EU-US Data Privacy Framework, if Netlify is certified under it, or the ICO's International Data Transfer Agreement or Addendum].
3. Other service providers may also process data outside the UK. Where they do, we make sure the transfer is protected by one of the safeguards set out in UK data protection law, such as:
   1. a country the UK has recognised as providing an adequate level of protection (including the UK Extension to the EU-US Data Privacy Framework, where the recipient is certified);
   2. the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the ICO; or
   3. another lawful transfer mechanism.
4. You can ask us for more information about the safeguards we use.

9. How long we keep data

We keep personal data only for as long as we need it for the purposes above, including to meet legal, accounting and reporting requirements. When it is no longer needed we delete it or anonymise it. The periods below are our current standard periods. [All retention periods to be confirmed.]

10. How we protect your data

We use appropriate technical and organisational measures to protect personal data, including encryption in transit [and at rest], access controls limited to staff who need access, multi-factor authentication on our systems, and contractual obligations on our service providers. Location data from screen bags is sent over encrypted connections. If a personal data breach occurs, we will act promptly and notify the ICO and affected individuals where the law requires.

11. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you (access);
• ask us to correct inaccurate or incomplete data (rectification);
• ask us to delete your data in certain circumstances (erasure);
• ask us to limit how we use your data in certain circumstances (restriction);
• object to our use of your data where we rely on legitimate interests, and object at any time to direct marketing (objection);
• ask for data you gave us, where we process it by automated means on the basis of consent or contract, in a structured, machine-readable format (portability);
• withdraw your consent at any time where we rely on consent, which does not affect processing before you withdrew it; and
• not be subject to solely automated decisions that have legal or similarly significant effects. We do not currently make such decisions. [Confirm, including for any automated check of the weekly fee qualifying conditions or deactivation.]

To exercise any of these rights, email hello@curbnetwork.com. We may need to verify your identity. We will respond within one month, which may be extended by up to two further months for complex or numerous requests, in which case we will tell you. There is usually no fee. Some rights are not absolute and we will explain if an exemption applies.

12. Children

Our website and services are intended for adults. We do not knowingly collect personal data from anyone under 18. Riders must be at least 18. If you believe we hold data about a child, please contact us and we will delete it.

13. Complaints

If you have a concern about how we use your data, please contact us first at hello@curbnetwork.com so we can try to put things right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

14. Changes to this policy

We may update this policy from time to time. The date at the top of the page shows when it was last changed. If we make significant changes that affect riders or other people we have a relationship with, we will tell them directly before the change takes effect.

15. Contact us

For any question about this policy or your personal data, contact our data protection lead at hello@curbnetwork.com, or write to [Company legal name] Ltd, [Registered address], marked "Data protection".