Ordit Rider Privacy Notice
Last updated: 23 October 2026
How Ordit uses your personal data when you apply to ride, or ride, with the Ordit Rider app. This notice is published at https://ordit.co.uk/rider-privacy.
1. Who we are
Ordit International Ltd (company 12020646, registered in England and Wales), 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, is the controller of your data. "Ordit", "we" and "us" mean Ordit International Ltd.
The App Store lists the app under Ordit Hungary Kft, but your agreement and data are with Ordit International Ltd.
To contact us about your data, email support@ordit.co.uk or write to the address above.
2. Who this notice covers
- Applicants: anyone who applies in the app, from verifying their phone number, including people on our waitlist.
- Riders: self-employed couriers who deliver for Ordit using the app, including riders who joined before the app.
- Former riders and applicants: for the data we keep afterwards.
Customers who order through Ordit are covered by our customer privacy policy at https://ordit.co.uk/privacy.
3. What we collect
When you apply
- Identity and contact: full legal name, mobile number (checked with an SMS code), email, home address and postcode.
- Where and when you can work: areas and shifts, and whether you can work in our areas if you live outside them.
- Right to work: the route you choose (eVisa share code; British or Irish passport; UK birth or adoption certificate plus NI number), your share code and date of birth for the share code route, and photos or PDFs of your passport photo page, certificate or NI document if you upload them.
- Vehicle: type. For a motorbike, moped, car or van: make, model, registration, driving licence (front) or CBT, insurance with hire and reward cover, and its expiry date. For a bike: whether you have public liability insurance, and the certificate if you upload it.
- Declarations: that you are 18 or over, have no unspent convictions for violence, dishonesty, sexual offences or serious driving offences, understand you would be self-employed, and that your information is accurate.
- After we approve you: bank account (name on the account, account number, sort code, bank name) and tax details (NI number, UTR if you give it, whether you are VAT registered, VAT number).
- Your agreement: its personalised text (name, address, mobile, email, vehicle), when we received your "I agree", the phone number you signed in with, and the device model, system and app version your phone reported.
What we record about you
- Your application's status, our checks (documents, insurance, right to work), who did them and when, messages we send you, and our decision, including an internal reason if we turn an application down.
- Your right to work check (section 6).
- When you started and stopped riding with us.
When you ride
- Your profile: name, phone number, vehicle type, zone and status.
- Your location while you are online (section 5).
- Your work: deliveries assigned to you; each step you record (arrived, picked up, delivered, failed, could not pick up) with its time and location; notes you type when a delivery fails or an order cannot be picked up; proof of delivery photos with their time and location; when you go online and offline.
- Calls and chat (section 8).
- Your phone: battery level and battery saver, make and model (Android only), system and app version, which permissions the app has when you go online, an install id the app creates, and push tokens.
- Crash and performance reports (section 19).
We do not collect biometric or health data, your contacts or your advertising ID. We do not use your data for advertising, and we do not sell it.
What you must give us. You cannot apply without the four application tasks, or sign the agreement without bank and tax details (the UTR is optional), or go online without sharing your location. Chat, calls and right to work uploads are optional.
4. Where your data comes from
Mostly from you and your phone. Also from:
- Ordit staff (dispatchers and admins): checks, decisions, messages, right to work results, deactivation.
- The Home Office online right to work service, when we check your share code.
- Ordit's ordering platform, which sends us each delivery and its changes.
- Twilio, which tells us how each call went (ringing, answered, length, outcome).
- Apple and Google, which issue your push notification tokens.
- If you rode for us before the app: your earlier records (your Onfleet id, your signed agreement and the right to work documents we hold).
- Restaurants and customers, if they raise a problem about a delivery.
5. Your location
When. Only while you are online: from Go online until Go offline, including when your phone is locked or another app is open. When you go offline, tracking stops. Android shows a notification ("Ordit Rider is online") the whole time; iPhone shows its location indicator.
What. Your position, its accuracy, your speed and direction of travel, the time, and whether you are moving.
How often. About every 10 seconds while you have a delivery; every 30 seconds when you have none; every 60 seconds when you have none and have stayed within about 50 metres for 2 minutes. When your battery is below 20% and not charging, or battery saver is on, the gap doubles, up to 60 seconds. Without signal, your phone holds positions for up to 24 hours and sends them when it can.
Why. To show dispatch where you are and offer you suitable work; to estimate times and detect arrival; to let restaurants and customers follow their delivery; for safety (if your phone goes quiet while online, dispatch is alerted and the app asks you to open it); and as evidence if a delivery is disputed.
Speed and direction. The app uses your speed to tell whether you are moving. We store speed and direction with each position, but we do not use them to judge how you ride or for any other purpose today.
Who sees it. Dispatchers see your latest position on the dispatch board, and can view your route for a chosen time within the last 30 days. Ordit receives your latest position with each update of a delivery you have started, so the restaurant and customer can follow it.
What we do not do. We do not use your location to score your performance, to set your pay, or to deactivate you automatically. We never track you while you are offline.
How long. Your detailed location history is deleted after 30 days. Some positions are kept with delivery records (section 15): where you were when work was assigned, at each delivery step, and where proof photos were taken. Your latest position is kept until your next one, and where you went online is kept with each online session.
6. Right to work and identity
The law requires us to check that every courier has the right to work in the UK before their first delivery, and to keep evidence of the check.
We arrange the check with you by video call or in person; uploads in the app are only a pre-check. We record who checked, when, the route, the result, any restrictions, any expiry date, and the evidence (the Home Office profile page as a PDF, copies of your documents, or where the copies are kept). Dispatchers and admins can see these.
If your permission has an expiry date, we remind our staff 30 days before. From that date you cannot go online or get new work until we record a follow-up check.
7. Criminal convictions
The application asks you to confirm that you have no unspent convictions for violence, dishonesty, sexual offences or serious driving offences. You must confirm this to submit. We do not ask for details and we do not run criminal record (DBS) checks. Your answer is kept with your application, seen only by Ordit staff who review applications, and used only to decide whether to engage you.
8. Calls and chat
Calls. You can call a delivery's customer from the app, through Twilio. The customer sees Ordit's London 020 number, never yours, and you never see theirs. We do not record calls. For each call we keep the delivery, when it rang, was answered and ended, and the outcome, but no phone number; the number used to connect it is deleted after 1 hour. If a customer calls the 020 number back, they hear a message, and we keep a record without the number for 30 days.
Chat. Chat is between you and Ordit: our dispatchers and admins read and reply to your messages and photos. We record when you have read our messages. A new message can show its first 120 characters on your lock screen.
9. Proof of delivery photos
Photos you take at pickup or delivery are stored with the delivery, with the time and place, and Ordit receives a link to them. Please avoid photographing people or the inside of someone's home.
10. Bank and tax details
We ask for these only after we approve you, so we can pay your invoices. Only Ordit admins can see them; dispatchers see only whether you have completed the task. They are not in your agreement, notifications, logs or crash reports. Every change to your bank details is logged with who made it and when.
11. Why we use your data, and our lawful basis
| Purpose | Data | Lawful basis |
|---|---|---|
| Reviewing your application | application, documents, checks | Steps before a contract (Art 6(1)(b)); legitimate interest in engaging suitable, insured couriers (6(1)(f)) |
| Right to work check and evidence | right to work data and documents | Legal obligation (6(1)(c)) |
| Unspent convictions declaration | the declaration | Legitimate interests (6(1)(f)): customer and public safety; plus the Art 10 condition in section 7 |
| Making and proving the agreement | agreement, signature record | Contract (6(1)(b)); legitimate interest in evidence for legal claims (6(1)(f)) |
| Assigning and tracking deliveries, arrival detection, ETAs | location, work, profile | Contract (6(1)(b)) |
| Letting restaurants and customers follow their delivery | name and initial, vehicle, location, status | Legitimate interests (6(1)(f)): a reliable delivery service; contract (6(1)(b)) |
| Safety alerts when your phone goes quiet while online | location, battery, phone facts | Legitimate interests (6(1)(f)): rider safety and service continuity |
| Proof of delivery and resolving disputes | photos, steps, positions, notes | Legitimate interests (6(1)(f)): evidence for complaints and claims |
| Paying you | bank and tax details | Contract (6(1)(b)); legal obligation for tax records (6(1)(c)) |
| Sign-in, security and stopping SMS abuse | phone, sign-in code log, install id | Legitimate interests (6(1)(f)): protecting accounts and the service |
| Crash reports, app updates, minimum app version | diagnostics, phone facts | Legitimate interests (6(1)(f)): a working, secure app |
| Calls, chat and notifications | call records, chat, push tokens | Contract (6(1)(b)) |
| Account deletion and confirming it by SMS | phone, deletion request | Legal obligation (6(1)(c)) |
| Complying with the law and requests from authorities | as required | Legal obligation (6(1)(c)) |
12. Decisions made by computer
We do not make decisions about you based only on automated processing that have a legal or similarly significant effect. People decide: dispatchers assign deliveries, and dispatchers and admins approve or turn down applications and deactivate riders. Some fixed rules apply automatically:
- You cannot go online without location access set to "Always" (iPhone) or "Allow all the time" (Android), or with an app version older than the minimum we set; the app tells you to update.
- If your right to work expiry date passes, you cannot go online or get new work until a follow-up check (section 6).
- If your postcode is outside our areas, your application is marked out of area for our staff, unless you confirm you can work in our areas.
- Limits on sign-in codes can make you wait before asking for another.
- Applications are deleted after a period without activity (section 15).
To have a person look at any of these, email support@ordit.co.uk.
13. Who we share your data with
- Restaurants and customers, through Ordit: your first name and last initial, vehicle type, location from when you start a delivery, its status and times, and estimated times. Ordit also receives your phone number, failure notes and links to proof photos.
- Service providers that process data for us under contract:
| Provider | What they do for us | Where |
|---|---|---|
| Supabase | Database, sign-in, file storage, server functions | Stored in London |
| Twilio | Calls (not recorded), sign-in codes and other texts | US |
| Expo | Push notifications and app updates | US |
| Apple, Google | Delivering notifications and the lock-screen delivery card | US |
| Sentry | Crash and performance reports | Stored in the EU (Germany) |
| Maps in the app and on the dispatch site | US | |
| Vercel | Hosting the dispatch site and the account deletion page | Global network |
- Google, through the Maps SDK in the app: your IP address, phone details, an identifier, map interactions and crash data, which Google also uses to improve its own services.
- Insurers, if needed for an accident or claim involving a delivery.
- HMRC, the Home Office, the police and other authorities, when the law requires or allows it, or for someone's safety.
- Professional advisers, and a buyer if our business is sold.
14. Transfers outside the UK
Some providers are in the US, or support us from there. We rely on UK adequacy regulations (EU and EEA), the UK Extension to the EU-US Data Privacy Framework for certified providers, or the ICO's International Data Transfer Agreement or UK Addendum. Ask us for a copy of the safeguards.
15. How long we keep your data
| Data | How long |
|---|---|
| Application in draft, or waiting for your changes, with no activity | Reminder after 60 days; deleted 30 days later |
| Application waiting for our decision | Until we decide |
| Agreement offer | Expires after 30 days (we can make a new one) |
| Approved application not finished (bank, tax, agreement) | Closed 90 days after approval, then deleted 90 days later |
| Application turned down, withdrawn or expired | Deleted 90 days after it closed |
| A rider's application answers and documents | 2 years after you stop riding |
| Right to work record and evidence | 2 years after you stop riding |
| Signed agreement, signature record, dates you rode | 6 years after you stop riding |
| Bank and tax details | 6 years after you stop riding, or when you delete your account |
| Profile (name, phone, vehicle) | While you ride; made anonymous 6 years after you stop. If we invited you and you never signed in, 90 days after the latest invite |
| Detailed location history | 30 days |
| Chat | Until you delete your account, or 6 years after you stop riding |
| Deliveries, their steps, times and positions, notes, proof photos, call records, online sessions | No fixed end date yet; without your name after deletion |
| Push tokens | Turned off at sign-out; deleted when you delete your account |
| Lock-screen delivery card data | 30 days after the card ends |
| Sign-in code log (number, time, outcome) | 30 days |
| Crash and performance reports | Until Sentry's retention period ends |
| Backups | Until Supabase's backup retention period ends |
We may keep data longer if a legal claim needs it.
16. Delete your account
You can delete your Ordit Rider account, and the data that goes with it, in any of these ways.
In the Ordit Rider app
- Riders: tap Menu (top left), then Account, then Delete account. Read what is deleted and kept, then tap Delete account.
- Applicants: on your application screen, tap the person icon (Account), then Delete account, then Delete account again to confirm.
- If you are offline, the app sends the request when you are back online. Keep the app open.
On the web, if you no longer have the app
Go to https://dispatch.ordit.co.uk/delete-account.
- Enter the UK mobile number you use with Ordit Rider and tap Send code.
- If the number has an account, we text it a code. The code works for 10 minutes. You can ask for a new one after a minute, up to 3 an hour.
- Enter the code and tap Delete my account.
By email
Write to support@ordit.co.uk from any address, giving the mobile number on your account. We will check it is you, for example by texting that number, before we delete anything.
What happens next
- At once: you are signed out on every phone and can no longer use the account. A rider is taken offline, and notifications stop.
- Applicants: your application, answers, documents, any right to work check, bank and tax details and notification tokens are deleted straight away. Your sign-in account is deleted within a few hours, once your files are gone.
- Riders: if you are holding deliveries (assigned to you and not yet finished), dispatch is asked to take them back. You do not need to finish them. We delete your data as soon as none are left with you, and within 30 days at the latest: on day 30 any delivery you had not picked up is taken back automatically, and one you had picked up stays on your anonymous record. We then delete your sign-in account, application answers and documents, bank and tax details, notification tokens, phone details, chat (with its photos), location history and latest position, and the place you were when work was assigned. Your profile is made anonymous: your name is replaced and your phone number removed.
- When it is done, we text your number: "Your Ordit Rider account has been deleted."
What we keep, and why
| Kept | Why | How long |
|---|---|---|
| Your deliveries: steps, times, positions, notes, proof photos, call records, online session times | Disputes, complaints and business records; linked only to an anonymous record | No fixed end date yet; without your name after deletion |
| Your signed agreement and its signature record, including the details in it (name, address, phone, email) and the dates you rode | Evidence for legal claims | 6 years after you stopped riding |
| Your right to work record and evidence | The law requires it | 2 years after you stopped riding |
| Your phone number on the deletion request | To complete the request and text you | 30 days after the deletion is done; a one-way code made from it stays to stop abuse |
| Sign-in code log (number, time, outcome) | Stopping text message abuse | 30 days |
| Records of payments to you | Our accounting system, as tax law requires | 6 years from the end of the accounting period they relate to, or longer if tax law requires |
| Crash reports and backups | They expire on their own | Until the retention periods in section 15 end |
If you never became a rider, we keep only the deletion request, the sign-in code log, and crash reports and backups until they expire. You can apply again later.
17. Your rights
You can ask us to:
- give you a copy of your data;
- correct it (to fix a detail in your application after approval, tap Help in the app and we reopen the task);
- delete it (section 16);
- restrict how we use it, or object to uses based on our legitimate interests;
- give you data you provided in a reusable format.
Email support@ordit.co.uk. You can view and share your signed agreement from your account in the app. We reply within one month and may ask you to prove who you are. Some rights have limits, for example we must keep right to work records.
18. Complaints
Please tell us first at support@ordit.co.uk. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, 0303 123 1113.
19. Your phone: permissions, notifications and storage
Permissions. Location (always, only used while online); camera and photos (proof of delivery, chat, documents); files (PDF documents when you apply); microphone (calls only); notifications; and, on Android, an optional battery exemption so tracking is not stopped. You can change these in your phone settings, but some are needed to work.
Notifications. New deliveries (on iPhone, Time Sensitive, so they can break through Focus), messages from Ordit and application updates. During a delivery, a lock-screen card shows the restaurant and drop-off names and your next step. Anyone who can see your lock screen can see these.
On your phone. The app stores your sign-in, unsent actions, recent positions (up to 24 hours) and application drafts. Bank, tax and right to work drafts are kept in the phone's secure storage until we have them. Drafts are cleared when you submit, sign out or delete your account.
Built-in services. Sentry (crash and performance reports, including which screens you open, linked to your account id), the Google Maps SDK (section 13), Expo (notifications and app updates, with a random install id) and Twilio (calls and call quality). There is no advertising, and no tracking across other companies' apps or websites.
20. Age
You must be 18 or over to apply or ride. We do not knowingly collect data from anyone under 18.
21. Changes to this notice
If we change this notice in a way that matters, we tell you in the app or by text before the change applies. The date at the top of https://ordit.co.uk/rider-privacy shows the latest version.