This privacy notice tells you how we look after your information when you visit our website or use our mobile app. It explains the information we collect about you, what we use it for and who we share it with. It also explains your rights and what to do if you have any concerns.
We sometimes need to make changes to this notice, to reflect changes in the way we do business or updates in the law. We will notify you of any important changes before they take effect.
SmashCo Ltd (company number: 12634504) is the data controller for your information and our registered office is at 82 St John Street, London, EC1M 4JN.
We are registered with the Information Commissioner’s Office (ICO), the regulator responsible for ensuring we follow the law when we use your information, under number A8887464.
Being a data controller means we decide what information to collect and what it is used for.
We are on a mission to make healthier food more affordable for young people. We partner with different businesses (such as restaurants, takeaways, food brands and supermarkets) to agree a discount on their products. Anyone aged 13-24 can use our mobile app to download a discount code for the product they want to buy. Follow our instructions on how to redeem your discount code (as these change from product to product) – and go get some healthy food!
We verify your age using Yoti. Simply take a selfie and get your results. If you aren’t aged 13-24, you can’t access our discounts – sorry!
For anyone under 18, we are especially careful with how we use your information.
You should know that an adult who has parental responsibility for you (that might be your mum or dad, but it could also be another adult who looks after you, who we call the responsible adult) can ask about your information.
You have the same legal rights to your information as adults do.
We collect your personal information when you interact with us or use our services, such as when you use our App to generate a discount code. We also look at how visitors use our app, to help us improve our services and optimise customer experience.
We collect:
We sometimes aggregate the personal data we collect to identify trends. We always make sure aggregated data is anonymised so that it is no longer possible to identify the individuals to which it relates.
• To set up new accounts and verify your age
• To provide account support and respond to questions
• To deactivate accounts
• To check our business partners are paying us correctly To understand which types of vouchers and discounts our users use the most
• To understand how you interact with our app and website
• To send marketing and raise awareness of our business
• To develop and improve our business
• To keep our app and website secure
• To ask for feedback
• To send you important updates (such as changes to our legal terms)
• To set up new accounts and verify your age using YOTI technology. YOTI age estimation is not facial recognition and does not identify you in any way
• To allow you to take a photo for your profile picture - so our brand partners know you are the account holder
• These pictures are held securely and are only ever used for the purposes above
Where you have indicated you would like to receive marketing emails from SmashCo, we use MailChimp to deliver and monitor those emails. Their digital tools let us see whether a recipient has clicked any of the links in our email, which help us understand what content that individual might find interesting and allow us to personalise the content of future emails.
Pixels (which are a similar technology to cookies) within those emails enable us to see:
• if the email was opened
• where the device opening the email was located (based on the device’s IP address)
• the type of email service (e.g. Outlook) that was used
• if the email (or its content) were shared on social media
• if the email was flagged as spam
SmashCo employees or other workers who have contracts containing confidentiality and data protection obligations.
Businesses whose products we discount and businesses where those discounts can be used. We always have a contract with our business partners which contain confidentiality and data protection obligations.
Other organisations we use to help us provide our website and app
- our age verification provider, Yoti
- hosting and server provider
- internal IT systems
- email delivery support
- website and application support and maintenance
- website and application usage analysis
- marketing and advertising campaigns
We ensure these organisations only have access to the information required to provide the support we use them for and have contracts which contain confidentiality and data protection obligations.
- our professional advisers (such as our accountants or legal advisors)
- regulatory authorities (such as HMRC)
- any actual or potential buyer of our business
- responsible adult for users under the age of 18
If SmashCo were asked to provide your information in response to a court order or legal request (e.g. from the police), we would get legal advice before sharing any information and carefully consider the impact on your rights when providing a response.
We must show we have a lawful basis to collect and use your information. The lawful basis SmashCo rely on to use your personal data are:
• Fulfilling our contract with you – where we need to use your personal data to set up your account and let you use discount codes
• Good reason (known as legitimate interest) – where we have a good reason to use your information, if we’re sure you would expect this and your rights won’t be affected. Some of our legitimate interests are - to promote and improve our services, to secure discounts from our business partners, to protect our app and website, to defend legal claims, to understand how our services are used
• Legal obligation – where we need to use your information to comply with the law
• Consent – where you have given us permission to use your information for a specific reason (such as marketing and for non-essential cookies)
Lawful bases are permitted reasons for which an organisation can use personal data. There are six permitted reasons under UK law.
• We keep the information held in your account for as long as the account is active, plus 6 years once deactivated.
Where you sign up to receive marketing
• We keep your personal data until you unsubscribe.
• We use cookies and pixels on our website. The longest duration of our cookies is 2 years.
Anonymous data means it is not possible to identify an individual from the information (the information is no longer personal data). We keep anonymous information forever.
• To set up new accounts and verify your age
• To provide account support and respond to questions
• To deactivate accounts
• To check our business partners are paying us correctly To understand which types of vouchers and discounts our users use the most
• To understand how you interact with our app and website
• To send marketing and raise awareness of our business
• To develop and improve our business
• To keep our app and website secure
• To ask for feedback
• To send you important updates (such as changes to our legal terms)
You have specific legal rights in relation to your personal data
Access (get a copy of): You must be told if your personal data is being used and you can ask for a copy of your personal data as well as information about how we are using it to make sure we are abiding by the law
Correct: You can ask us to correct your personal data if it is inaccurate or incomplete. We might need to verify the new information before we make any changes.
Delete: You can ask us to delete or remove your personal data if there is no good reason for us to continuing holding it or if you have asked us to stop using it (see below). If we think there is a good reason to keep the information you have asked us to delete (e.g. to comply with regulatory requirements), we will let you know and explain our decision.
.png)
Restrict (stop or limit): You can ask us to restrict how we use your personal data and temporarily limit the way we use it (e.g. whilst you check that the personal data we hold for you is correct)
.png)
Object (say no): You can tell us you want us to stop using your personal data. We will always stop if you ask us to stop sending you marketing communications but in other cases, we decide whether we will continue. If we think there is a good reason for us to keep using the information, we will let you know and explain our decision.
.png)
Transfer: You can ask us to send you or another organisation an electronic copy of your personal data
.png)
Complaints: If you are unhappy with the way we collect and use your personal data, you can complain to the ICO but we hope that we can help first.
If you wish to make any of the rights requests listed above for yourself or on behalf of a young person, you can reach us at: help@smashco.co.uk
Adults and children have the same rights, but adults can also act on behalf of the children they have parental responsibility for.
We don’t charge you anything to exercise (use) your rights, although we are sometimes allowed to – if this happens, we’ll let you know first.
We do lots of different things to make sure that your information is safe:
• making sure that the link between your phone or device and our servers is secure so that no-one can ‘listen in’ on us
• using strong passwords on all our systems
• only allowing a small group of people to access our systems
• entering into agreements with our staff and supply chain which require them to keep your information safe and not share it with anyone
• having a plan in place to deal with what happens if your information is accessed by someone who shouldn’t have access to it or if your information is lost or changed in any way
If you notice anything strange on your account (or believe your account has been used by someone without your permission) please let us know by emailing us at help@smashco.co.uk
