External Privacy Notice

1. INTRODUCTION AND SUMMARY

1.2. Our Role in Processing of Personal Data

This privacy notice contains information about the processing we perform as a data controller.

1.3. The Data Subjects We Process Personal Data About

We process personal data about the categories of data subjects listed below. For further details, please see section 3 (“Our Specific Processing Activities”).

Category A - Customers and individuals acting on behalf of customers

• Private customers of one of the merchants who directly or indirectly (for example via a 3PL or other platform) engage us for the performance of transport services.
• Private customers of Instabee who have ordered a service directly from us. 
• Individuals acting on behalf of a private or corporate customer (e.g. recipient, c/o address holder or contact person). 

Category B – Individuals who otherwise contact or interact with us

• People who visit and use our website, app or any of our other digital channels.
• People  who  come  into  contact  with  us  in  another  way  (e.g.  through  our customer service).

Category C – Individuals who are employed or hired by one of our partners

• Persons who work for, act on behalf of, or are contact persons for merchants, logistics companies or other parties who cooperate with us in the performance of our transport and additional services or in connection with our business in general and thereby come into contact with us in some way.

1.4. Purposes of our Processing of Personal Data

We process your personal data for, inter alia, the purposes listed below. For further details, please see section 3 (“Our Specific Processing Activities”).

• To offer and perform Instabee’s transport and additional services, with the aim of simplifying the e-commerce experience.
• To ensure that those who use our transport services, and our additional services, receive a customized and personally performed service with a satisfying customer experience, in accordance with the customer’s own preferences. This includes presenting and recommending delivery options and relevant additional services, as well as verifying/supplementing information that derives from you as a customer, your customer profile, previous deliveries, the merchant and/or another party.
• To perform our transport and additional services in a safe, transparent, reliable and smooth manner, as well as to ensure that our transport and additional services are performed in an efficient, predictable and optimized way, at the right time, with a low carbon footprint.
• To provide, analyze, follow up, improve, develop and maintain Instabee’s services and offerings, programs, tools, website, app and other digital channels, as well as to analyze, follow up, improve and develop the quality and execution of what we deliver and offer, as well as the user experience and interaction with us.

1.5. Legal Basis, Retention Period and Your Right to Object to our Processing

All personal data processing must have a legal basis. Our legal basis for processing your personal data may be that we need to use your data to fulfill our agreement with you or to fulfill a legal obligation that we are subject to, or that we otherwise have a legitimate interest in processing your data. Information about the legal basis which we rely on for a particular processing activity is set out in section 3 (“Our Specific Processing Activities”).

You have the right to object to certain personal data processing, such as marketing via email. Read more about this in section 2.4 (“Offers and Information via Emails or Text Messages”). Your rights are described in more detail in section 2.5 (“Your Rights”).

We will only process your personal data as long as necessary for the purpose of the processing, read more in section 3 (“Our Specific Processing Activities”), or for as long as you wish to receive information from us. Your personal data may also be deleted when we receive a request from you to delete your personal data, read more in section 2.5 (“Your Rights”).

Please note that we may need to keep information about you for longer than mentioned above, where we are required to do so by law, regulation or government decision (for example, the Swedish Accounting Act requires that accounting information is stored for seven (7) years in addition to the current year), or processing is necessary to establish, enforce or defend a legal claim.

2.1. What is Personal Data and Personal Data Processing?

Personal data is any information that can be directly, or indirectly with other data, linked to a living individual. This means that a wide array of data constitutes personal data such as name, address and other contact details, delivery details and information on a customer matter.

Processing of personal data is any action taken with the personal data, e.g. collection, storage, processing, use for various purposes, alteration or deletion.

2.2. How We Access Your Personal Data

The personal data that we process is in some cases provided to us (directly or indirectly) by the company from which you have ordered an item. Other personal data that we process about you may have been provided by you directly to us in order to facilitate delivery or in connection with you making special delivery choices or purchasing a service directly from us. You may also have provided the information to us in connection with a previous delivery.

Where you have not provided the personal data to us, we may have received the personal data as follows:

• From another person/party who ordered a service from us or ordered an item from one of our partners.
• From public or external registers/databases.
• From our partners (e.g. couriers/drivers).
• From your computer, phone or other device when using our digital channels (e.g. IP address).
• From parties who manage our payment solutions, analyze suspected fraud and authenticate logins or payments.

We may also create personal data ourselves, such as customer numbers, customer profiles, customer categories and delivery preferences based on the choices you have made in the past.

Our services are not aimed at children and we therefore do not knowingly collect data about children. However, if a child has used our services, it is possible for you as a guardian to contact us at the contact details in section 2.6 below (“Contact Details of the Data Controller”) if you wish to exercise any of the child’s rights.

As part of the performance/development of our services and for marketing purposes, profiling may occur based on the information we have received from you. Profiling involves an automated processing of your personal data to assess certain personal characteristics, for example to analyze or predict your personal preferences. Profiling is done to better provide offers and information tailored to your preferences. You can notify us at any time that you do not wish to take part in this type of offer.

2.3. Recipients of Your Personal Data

In some cases, it is necessary for us to share personal data with other parties, both inside and outside the EU/EEA. We do this to fulfill our commitments to you, the merchant and/or the recipient of parcels that we will deliver or provide, as well as to plan, optimize and develop our services. For example, we may need to share your personal data with other companies within the Instabee Group and the couriers, drivers, logistics partners and other partners involved in the transport of parcels to you. We may also disclose your information to an authority or other party in an investigation of suspected crime or other irregularities, if we are required to disclose information under law, regulation or government order, to establish, enforce or defend legal claims, or if we otherwise have a legitimate interest. See more about this in section 3 (“Our Specific Processing Activities”).

Our IT providers and other partners who handle personal data on our behalf, so-called data processors, always sign agreements with us to ensure a high level of protection of your personal data. In relation to partners outside the EU/EEA, specific safeguards are taken, such as signing agreements that include the standard contractual clauses for data transfers adopted by the European Commission and available on the European Commission’s website.

If you contact us through social media such as Facebook, LinkedIn or Instagram, your personal data will also be collected and processed by these companies in accordance with their respective privacy policies.

If we share your personal data with a recipient who is independently responsible for their processing of your personal data, such as an authority, the recipient is responsible for the legality of their processing.

2.4. Offers and Information via Emails or Text Messages

When you use our services, we require your email address and phone number in order to provide you with information about your delivery. We may contact you by email, text message or phone with important information regarding your delivery or other ordered services.

We may also send you offers and other marketing of our services. If you do not wish to receive offers and marketing via email or text message, you have the option to unsubscribe at any time by contacting us through any of the channels we specify in section 2.6 (“Contact Details of the Data Controller”). You can also unsubscribe from further marketing emails and text messages by following the instructions in the email and text message. Please note that even if you have opted out of receiving marketing emails and/or text messages, we may need to send you important information regarding your delivery or other ordered services.

2.5. Your Rights

You have certain rights in relation to our processing of your personal data. These rights are described at a high level below. If you would like to assert any of these rights, or get more information, please contact us by using the contact details in section 2.6 below:

• Right to be informed – the right to be informed about how we process your personal data. We do this through this privacy notice, other information on our website, and by answering questions from you.
• Right of access (register extract) – the right to request a copy of your personal data if you want to know what information we have about you.
• Right to rectification – the right to have incorrect data rectified and to supplement incomplete data.
• Right to object – a right to object to our personal data processing if it is done based on a balancing of interests or for direct marketing. Regarding direct marketing via email or text message, you can object to this by following the instructions in the respective mail or contact us at the contact details below.
• Right to withdraw consent – a right, in cases where we process your personal data based on your consent, to withdraw your consent at any time.
• Right to erasure – a right to have your personal data erased under certain conditions.
• Right to restrict data processing – a right to demand that the processing of personal data is restricted, e.g. if you oppose the correctness of the data. While the matter is investigated, our access to the data in question is restricted.
• Right to data portability – a right to request that personal data that we process about you in order to fulfill an agreement with you, or based on your consent, be transferred to another data controller. This right is restricted to data that you have submitted to us in a structured, widely used and machine-readable format.

Please note that some of the above rights may only be invoked in certain situations.

If you have any complaints about how we process your personal data, or would like further information, please contact us via the contact details below. Furthermore, you always have the right to lodge a complaint about how we process your personal data to any EU data protection authority, e.g. in the country where you reside. Below is a selection of the data protection authorities you can turn to:

Sweden's Supervisory Authority: 

---

Integritetsskyddsmyndigheten (IMY)

www.imy.se

Denmark's Supervisory Authority: 

---

Datatilsynet

www.datatilsynet.dk

Finland's Supervisory Authority: 

---

Tietosuojavaltuutetun toimisto // Dataombudsmannens byrå

www.tietosuoja.fi/en

Belgium's Supervisory Authority: 

---

Autorité de protection des données // Gegevens-beschermings-autoriteit

www.dataprotectionauthority.be

Netherlands's Supervisory Authority: 

---

Autoriteit Persoonsgegevens

www.autoriteitpersoonsgegevens.nl

Germany's Supervisory Authority: 

---

Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit

www.bfdi.bund.de

Norway's Supervisory Authority: 

---

Datatilsynet

https://www.datatilsynet.no/en/

2.6. Contact Details of the Data Controller

If not specifically indicated or communicated otherwise, Instabee Group AB (in Sweden) is the data controller in respect of the processing of personal data described in this privacy notice.

In the tables below you will find the contact details of Instabee Group AB and the other local companies within the Instabee Group, as well as to our Group Data Protection Officer (DPO). If you are unsure which company that is the data controller, you can always contact Instabee Group AB for further assistance.

Instabee Group AB, Org. No: 559396-6236, Hälsingegatan 40, 113 43 Stockholm, Sweden
Contact details for DPO: dpo@Instabee.com - dpo@budbee.com - dpo@instabox.com

Instabee Group AB, Org. No: 559396-6236, Hälsingegatan 40, 113 43 Stockholm, Sweden

Contact details for DPO: dpo@Instabee.com

 

Sweden

---

• Budbee Group AB, Org. No: 559322-4255, Hälsingegatan 40, 113 43 Stockholm, Sweden
• Instabox Group AB, Org. No: 559247-1568
• Budbee Sweden AB, Org. No: 559322-4255
• Instabox Sweden AB,Org. No: 556831-5393

Denmark

---

• Budbee Denmark ApS, Org. No: 39 77 23 61, Ehlersvej 11, 2900 Hellerup, Denmark
• Instabox Denmark ApS, Org. No: 40 85 07 32

Finland

---

• Budbee Oy, Org. No: 2923782-9, Perhonkatu 6,00100 Helsinki, Finland

 

Belgium

---

• Budbee Belgium B.V., Org. No: 768.864.263, Lange Lozanastraat 142, Antwerp 2018, Belgium
• Instabox Belgium B.V., Org. No: 0774717620

Netherlands

---

• Budbee Netherlands B.V., Org. No: 74690280, Johan Huizingalaan 763A1066 VH Amsterdam, Netherlands

Germany

---

• Budbee Germany GmbH, Org. No: HRB 233721, Postdamer Platz 10, 10785 Berlin
• Instabox Germany GmbH, Org. No: HRB 231413 B

Norway

---

• Instabox Norway AS, Org. No: 923 459 758

(A) Processing in connection with the performance of the transport service

Purpose: 

• Offer and perform an efficient, optimized, smooth, reliable, safe and accurate transport service, with a low carbon footprint, and with the latest technology.
• Ensure that those who use our transport service receive a customized and personal service with great customer experience in accordance with their own preferences.
• Recommend delivery options and verify or supplement information from merchants and the customer/ the person acting on behalf of the customer.
• Recommend additional services or features, such as Budbee Plus membership, downloading the Instabee-Budbee app, purchasing specific time slots for delivery, changing the day or delivery method (for example, switching from home delivery to delivery to box).
• Communication with, and report to, customer and/or the person acting on behalf of the customer and others involved in the transport of order status and selectable delivery options, as well as the associated interactions between the customer, us and the driver responsible for delivering the parcel.
• Verify identity, verify legal age (for receiving certain parcels), confirm that the correct recipient receives the parcel.
• Document the completion, or attempted completion, of the delivery or return of parcels and document that parcels have been delivered to the correct address.

Categories of personal data:

• Name and contact information such as phone number, email address, address (including coordinates), venue access code and floor number, including information from previous deliveries.
• Additional information to determine the delivery destination, e.g. house description.
• Delivery preferences, such as the time and date of delivery.
• Identification  information  (e.g.  social  security  number,  signature,  or  electronic signature such as Bank ID).
• Information about the contents of the parcel (if provided to us, e.g. if it contains dangerous or extra sensitive content, has a high value, etc.).
• Information of Budbee Plus membership and selected additional services.
• Documentation  for  completion,  or  attempted  completion,  of  delivery/return  (e.g. photo of the parcel outside the door).
• Any other additional information you may provide to us.

Legal basis:

Performance of a contract: The processing may in some cases be necessary to fulfil a contract that you have entered into with us, or to act at your request before such contract is entered into. This legal basis only applies when you have ordered the transport service directly from us (not through any merchant).

Balancing of interests: We have a legitimate and compelling interest to process your personal data to perform the transport service, proving that it was performed, as well as for planning and scheduling the transport services so that they can be performed efficiently, with high precision, in accordance with our customers’ preferences. This legal basis also applies if you have ordered the transport service from someone other than Instabee, such as a merchant, or if you are not our customer but act on our customer’s behalf. It also applies to processing that is not strictly necessary to determine the address to which the parcel is to be delivered but which is nevertheless justified in order to perform the transport service in an efficient, optimized and customized manner.

(B) Processing  in  connection  with  your  other  interactions  with  us  (e.g.  purchasing additional services, contacting our customer service, using our app and web, etc.)

1; Processing in connection with you making a purchase with us

Purpose: 

• To deliver and charge for the service you ordered (e.g. delivery within a specific time slot, change of day or delivery method, a Budbee Plus membership or that you purchase the entire transport service directly from us).

Categories of personal data:

• Name and contact details (email and telephone number).
• The type of service you buy and the price.
• Preferences in relation to the delivery method, day or time slots for delivery (if such services have been purchased).
• Payment details (e.g. credit card number).

Legal basis:

Performance of contract: The personal data processing is necessary to fulfil our obligations in the contract with you (i.e. delivery and charge for the service you order).

2. Processing in connection with registration and updating of your customer profile

Purpose:

If you use an Instabee app, we’ll store your customer profile. The information is saved for as long as you keep your account with us (until you actively delete your account). The purposes for the processing are:

• To enable an easier performance of the transport service and avoid that you are required to provide the same information on several occasions (for future deliveries).
• Recommend additional services that we think you may be interested in.

Categories of personal data:

• The categories of personal data we collect to perform the transport service.
• Your contact details and delivery preferences.
• Information on how to find the address, that you previously have provided to us either when you have chosen Instabee as the delivery method through a merchant or when you have ordered services directly from us.
• The (additional) information we receive from drivers e.g. correction of incorrect address, the venue access code, floor number, etc.
• Your previous delivery information.

Legal basis: 

Performance of contract: The personal data processing is necessary to fulfil our obligations in the terms of service that apply to the Instabee app and which you agree to in connection with the registration.

3. Processing in connection with your Budbee Plus membership

Purpose:

• To offer and provide you with the benefits included in the membership.

Categories of personal data:

• Name and contract details. 

Legal basis: 

Performance of contract: The personal data processing is necessary to fulfil our obligations in the membership terms applicable to Budbee Plus at any given time and which you agree to in connection with the registration or subsequent updating of the membership terms.

4. Processing in connection with your use of our app/web/digital channels

Purpose:

• To evaluate and improve our services.
• To offer you relevant content.
• We also use cookies. Read about how we use cookies and what choices you can make in our Cookie Policy.

Categories of personal data:

• How you use our app/web/digital channels (choices, clicks, popular pages and offers).
• Information you provide during your use, such as feedback and comments.

Legal basis:

Balancing of interests: We have a legitimate and compelling interest in processing your personal data to evaluate and improve our services and offer you relevant content.

5. Processing in connection with your contact with us (e.g. through our customer service)

Purpose:

• Communicate with you and administer your matter when contacting us e.g. through our customer service, email forms and/or social media accounts.
• Analyse calls and chats to improve our communication.

Categories of personal data:

• Name and those contact details you provide to us, or which are needed to handle your question (e.g. name, address, phone number and email address).
• Matter information (e.g. requests, complaints, order and order details, purchase and transaction history, payment information and other information that you provide in your contact with us or have provided in the context of another process).
• Recorded conversations between you and the driver or Instabee’s customer service

Legal basis:

Performance of contract: Fulfil the contract with you and otherwise administer obligations arising from the contract.

Balancing of interests: We have a legitimate and compelling interest in processing your personal data to communicate with you, provide information to you, analyse calls and the use of our communication functions, as well as develop, test and improve our services and technical platforms.

Legal obligation: In some cases, we have a legal obligation to process personal data that you submit to us (e.g. under consumer law or for accounting purposes).

(C) Processing for marketing purposes

We show ads, advertising banners and may offer you discount coupons. We register if you select or click on any of these (see more in the section “Processing in connection with your use of our app/web/digital channels” above).

• Advertising banners and ads. The advertising banners and ads we present in the app and on our website are selected by a third party and we have excluded the ability to customize the ads based on your profile.
• Discount coupon offers. You may receive a discount coupon offer if you have selected pick-up from a specific pick-up point. Thus, the offers are not based on what you ordered or received, shown interest in, or similar (only on the geographical location of the pick-up point).
• Other marketing. We may send you newsletters and/or other marketing of our services, e.g. by email and SMS.
• Analysis of which groups that use our services. We may analyse where, and among which type of individuals, our services are popular/less popular (e.g. the use of our services is high in region X, among women and men between age Y and Z).

Purpose: 

• To show you discount coupons that you can use at our partners.
• To analyse and identify suitable target groups to whom we target advertising.
• To send you offers.

Categories of personal data:

• Name and contact details.
• The delivery point you have chosen to pick up your parcel.
• Information about your use of Instabee’s services (popular add-on services and merchants etc.).
• Cookies we use, read more in our Cookie Policy.

Legal basis:

Balancing of interests: We have a legitimate and justified interest in processing your data to create an offer we think you might be interested in.

(D) Processing in connection with the evaluation of accomplished transport services and analyses with the purpose to develop our services

Purpose:

• Ensure and improve the quality of our services in general and for educational purposes.
• Collect, manage and investigate comments, feedback and incident reports submitted to us.
• Compilation of statistics, reports, KPIs regarding the use and performance of our services.
• Analyse and evaluate insights and trends.
• Evaluate, improve and develop Instabee’s services and offerings in general, review historical development and performance, and changed behaviour and demand in relation to Instabee’s services and offerings.

Categories of personal data:

• Recorded calls between customer and driver or traffic management.
• Information in comments, feedback and incident reports from e.g. the customer.
• Contact information: e.g. name, address.
• Popular merchants and/or product and service categories.
• Demographic data, such as gender, age and family situation, were collected from public sources.
• Frequency and use of transport services and other services, such as apps, websites, emails, etc.

Legal basis:

Balancing of Interests: We have a legitimate and justified interest in processing your data to administer, evaluate and develop our services.

(E) Processing of data when you are employed or hired by one of our partners

Purpose:

Administer our contractual relationship and/or perform the transport services.

Categories of personal data:

• Name and contact details.
• Employer.

Legal basis:

Balancing of interests: We have a legitimate and compelling interest in processing your data in order to administer our contractual relationship and/or perform the transport services.