Privacy Policy

Nippybot Limited ("Nippybot", "we", "us" or "our") respects the privacy of individuals who use, interact with or are affected by our technology and services.

This Privacy Policy explains how we collect, use, disclose, store, secure and otherwise process personal information in connection with our website, mobile applications, Merchant Portal, administrative systems, autonomous delivery robots and associated services.

This Policy applies to:

customers using Nippybot's ordering and delivery services;

merchants and their authorised representatives;

business customers and commercial partners;

visitors to our website and users of our mobile applications;

individuals contacting our support team;

pedestrians, visitors and other members of the public whose personal data may be processed by our robots or operational systems.

We process personal data in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 ("PECR"), as amended.

This Policy should be read alongside our Terms and Conditions and Refund, Cancellation and Delivery Policy.

The principal organisation responsible for determining the purposes and means of processing personal data in connection with Nippybot's consumer Platform and independently operated robotic delivery services is:

Nippybot generally acts as a data controller in relation to customer accounts, Platform operations, payment administration, delivery management, Robot telemetry and its own safety monitoring.

Independent Merchants may act as separate controllers of personal data that they receive for the purpose of fulfilling customer purchases, complying with their legal obligations and managing their business operations.

In certain commercial deployments, Nippybot may process personal data on behalf of a Business Customer as a data processor. Such arrangements must be governed by appropriate contractual data protection terms.

Where Nippybot and another organisation jointly determine processing purposes and means, their respective responsibilities will be documented as required by applicable law.

Depending on the nature of your interaction with Nippybot, we may process the following categories of information.

Nippybot uses Stripe to facilitate payment processing.

Payment information may include transaction identifiers, payment status, payment method details, billing information and fraud-prevention information.

Full payment card details are intended to be handled through Stripe's secure payment infrastructure rather than stored directly within Nippybot's application databases.

The precise payment data accessible to Nippybot depends on the implemented Stripe integration.

We may process:

We may process technical information such as device type, operating system, application version, IP address, session information, diagnostic logs, authentication events and security-related metadata.

We may process emails, support messages, complaints, feedback, incident reports and records of communications relating to our Services.

We may process business contact details, company information, authorised representatives' identities, Merchant onboarding records, bank account details where required, settlement information and compliance documentation.

We may process:

Not all robotic telemetry constitutes personal data. However, telemetry may become personal data where it relates to an identified or identifiable individual.

Nippybot's autonomous delivery robots may use cameras, depth sensors and other environmental perception technologies to support navigation, obstacle detection, safety monitoring and remote operational assistance.

Live camera feeds may incidentally capture images of pedestrians, customers, cyclists, vehicles, staff and other individuals in the Robot's operating environment.

Nippybot does not routinely record and retain live camera footage during ordinary delivery operations.

Authorised operators may view live camera feeds where necessary for operational monitoring, navigation assistance, safety intervention or incident response.

Where necessary and lawful, relevant visual information may be recorded or preserved in connection with a safety incident, suspected criminal activity, equipment damage, insurance investigation, legal claim or other justified event.

Any incident-related recording must be limited to what is necessary and proportionate for the relevant purpose.

Nippybot will not use live camera systems for unrelated surveillance of members of the public.

Nippybot will not use facial recognition or biometric identification to identify members of the public unless a separate lawful assessment, appropriate safeguards and updated privacy disclosures have been completed.

Nippybot will apply appropriate technical and organisational measures to restrict access to visual data and prevent unauthorised disclosure.

Where reasonably practicable, Nippybot will use visible notices, Robot identification, website disclosures and other appropriate methods to inform individuals about camera-equipped Robots.

Individuals who believe their personal data has been captured may contact service@nippybot.com to exercise applicable rights.

The use of live viewing without routine recording does not eliminate Nippybot's obligations under data protection law.

Nippybot processes personal information only where an appropriate lawful basis applies.

Where we rely on legitimate interests, we will assess whether the processing is necessary and whether those interests are overridden by the rights and freedoms of affected individuals.

Where consent is required, we will obtain it through an appropriate mechanism and allow withdrawal as required by law.

We will not treat device permission as automatically constituting UK GDPR consent for every subsequent use of location information.

We may use personal information to:

establish and maintain accounts;

process Orders and payments;

transmit Order information to the relevant Merchant;

assign, dispatch and monitor delivery Robots;

provide estimated arrival times and collection notifications;

authenticate authorised recipients;

administer refunds and complaints;

manage Merchant settlements;

investigate safety incidents and operational failures;

detect fraud, misuse and security threats;

maintain and improve our technology;

comply with legal and regulatory obligations;

establish, exercise or defend legal claims;

provide marketing communications where permitted.

We will not process personal information for purposes incompatible with those originally disclosed unless permitted by applicable law.

Nippybot uses location-related information to determine delivery eligibility, calculate routes, dispatch Robots and facilitate delivery collection.

Customers may be asked to enter a delivery destination or permit device location access.

Where device location access is optional, Customers may decline permission and manually enter an eligible destination where the application supports that functionality.

Robot positioning data may be processed independently of a Customer's device location settings.

Nippybot may maintain historical delivery records where necessary for support, security, operational accountability, accounting or legal compliance.

Location information will not be sold to third parties for unrelated advertising purposes.

Access to detailed location records will be limited according to operational need and appropriate security controls.

Nippybot's Robots may make automated operational decisions relating to navigation, obstacle avoidance, route selection, speed adjustment and stopping.

Such decisions are intended to support safe robotic movement and delivery operations.

Automated navigation decisions do not necessarily constitute automated decision-making producing legal or similarly significant effects concerning an identifiable individual within the meaning of Article 22 of the UK GDPR.

Where Nippybot introduces solely automated decisions about individuals that fall within applicable Article 22 restrictions, it will identify an appropriate legal basis, provide required information and implement applicable safeguards.

Nippybot may use operational telemetry to identify faults, investigate incidents and improve reliability.

Nippybot may share personal information with the following recipients where necessary and lawful.

Merchants may receive customer and Order information necessary to prepare, fulfil and manage purchases.

Stripe and relevant financial service providers may receive information required for payment processing, fraud prevention, refunds and compliance.

Authorised hosting, software, communications, analytics, security and support providers may process information on our behalf under appropriate contractual arrangements.

Relevant information may be shared with Business Customers or site operators where necessary for agreed logistics services, safety, access management or contractual administration.

Information may be disclosed to legal advisers, accountants, auditors and insurers where necessary for legitimate business, legal or insurance purposes.

Information may be disclosed to law enforcement, regulators, courts or other competent authorities where required by law or otherwise lawfully justified.

Information may be disclosed in connection with a proposed merger, acquisition, financing or business restructuring, subject to applicable confidentiality and data protection requirements.

Nippybot will not disclose personal information indiscriminately or sell customer personal data to third-party data brokers.

Nippybot primarily provides Services within the United Kingdom.

Some technology providers may process personal information outside the United Kingdom.

Where personal data is transferred internationally, Nippybot will apply an appropriate transfer mechanism, such as an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another legally recognised safeguard.

Additional transfer assessments and safeguards will be implemented where required.

Information about relevant transfer safeguards may be requested through our privacy contact.

Nippybot retains personal information only for as long as reasonably necessary for the purposes for which it was collected, including legal, accounting, regulatory, security and dispute-resolution requirements.

Retention periods are determined by the nature of the information, applicable legal requirements, operational necessity and potential claims.

Account information may be retained while the account remains active and for a justified period following closure.

Transaction and financial records may be retained for applicable statutory accounting and tax periods.

Routine live Robot camera feeds are not ordinarily retained.

Incident-related recordings, where created, will be retained only for a documented and justified period, which may be extended where necessary for an active investigation, insurance matter or legal claim.

Operational telemetry will be retained according to documented business and safety requirements.

When retention is no longer necessary, information will be deleted, anonymised or otherwise handled in accordance with applicable law.

Nippybot will maintain an internal retention schedule specifying the applicable periods for each relevant category of personal data.

Nippybot will implement appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, alteration, disclosure or destruction.

Such measures may include:

No internet-connected service can guarantee absolute security.

Nippybot will investigate suspected personal data breaches and make notifications to regulators or affected individuals where required by law.

Our website and applications may use cookies, local storage, software development kits and similar technologies.

These technologies may support authentication, security, preferences, performance measurement and analytics.

Strictly necessary technologies may be used where legally permitted without consent.

Non-essential cookies and similar technologies requiring consent under PECR will not be activated until valid consent has been obtained.

Users will be provided with appropriate choices to accept, reject or manage non-essential technologies.

A separate Cookie Policy or cookie preferences interface will identify the actual technologies deployed, their purposes, providers and applicable retention periods.

Nippybot may send operational communications relating to Orders, payments, deliveries, security and account administration.

Operational communications are distinct from optional marketing communications.

Marketing emails, messages or notifications will be sent only where a lawful basis exists and applicable electronic marketing rules are satisfied.

Users may withdraw marketing consent or opt out using the relevant communication controls.

Opting out of marketing does not prevent necessary transactional or service communications.

Nippybot does not intentionally solicit personal information from children in circumstances where doing so would be unlawful.

Where children may access the Services, Nippybot will implement appropriate age-related safeguards and comply with applicable UK data protection requirements.

Where parental authorisation is required by law, appropriate consent or verification arrangements will be implemented.

Nippybot will consider the ICO Children's Code where its online services are likely to be accessed by children.

Parents or guardians may contact service@nippybot.com regarding concerns about children's personal information.

Subject to applicable law, individuals may have the right to:

request access to their personal data;

request correction of inaccurate information;

request erasure in qualifying circumstances;

request restriction of processing;

object to certain processing;

request data portability where applicable;

withdraw consent where processing is based on consent;

challenge certain qualifying automated decisions;

complain to the Information Commissioner's Office.

Requests may be submitted to service@nippybot.com.

Nippybot may request reasonable information to verify identity before disclosing personal information.

We will respond without undue delay and ordinarily within one month, subject to lawful extensions.

Certain rights are subject to statutory exemptions and limitations.

Where a request concerns incident footage containing other individuals, Nippybot may apply appropriate redaction or other lawful protections.

Individuals do not need to be registered Customers to have rights concerning personal data processed by Nippybot.

Where an identifiable individual appears in live camera footage or incident-related recordings, applicable data protection protections may apply.

Individuals may contact Nippybot to request information about relevant processing.

To assist with locating a particular incident record, Nippybot may request an approximate date, time, location and description of the relevant circumstances.

Requests will be assessed in accordance with applicable law, including the rights and freedoms of other individuals.

The Platform may contain links to Merchant websites, payment services, app stores or other third-party services.

Those organisations may operate their own privacy policies and independently determine how they process personal information.

Nippybot is not responsible for independent third-party privacy practices merely because a link is available through the Platform.

This does not exclude any responsibility Nippybot has for selecting and overseeing processors or for its own processing activities.

Nippybot may update this Policy to reflect changes in its technology, services, legal obligations or processing activities.

Material changes will be communicated where required by law.

The current version will be made available through our website and applicable mobile applications.

Where a new processing purpose requires consent or another specific legal step, Nippybot will complete that step before undertaking the processing.

Individuals may raise privacy concerns directly with Nippybot using service@nippybot.com.

They may also complain to the UK Information Commissioner's Office.

Individuals are not required to obtain Nippybot's permission before contacting the ICO.

End of Privacy Policy.