Rider Privacy Policy

In short

We collect the information needed to verify your identity and right to provide delivery services, route and pay you for Deliveries, keep customers and the public safe, and meet our legal obligations (including tax reporting). We only track your precise location while you are online in the Rider App or actively completing a Delivery, not at other times. You have rights under GDPR to access, correct, delete, or export your data, and to a human review of any fully automated decision that significantly affects you, such as an automated account deactivation.

1. Who is responsible for your data

EthniHub Oy, Business ID 3477743-2, registered in Finland, is the data controller for the personal data described in this Policy. Data protection queries can be directed to privacy@ethnihub.fi.

2. Information we collect

Identity & Onboarding Data

Full name, date of birth, personal identity code or equivalent tax identifier, profile photograph, phone number, email address, national ID/passport or residence permit, driving licence (where applicable), and right-to-work verification records.

Financial Data

IBAN or bank account details for payouts, VAT/business ID or light-entrepreneur (kevytyrittäjä) invoicing details where applicable, and transaction and earnings history.

Location Data

Real-time GPS location while you are online and available for Deliveries, and route data while a Delivery is in progress. We do not collect your location while the Rider App is closed or you are marked offline.

Device & Usage Data

Device identifiers, operating system and app version, IP address, crash and diagnostic logs, and push-notification tokens.

Performance & Communications Data

Delivery completion times, ratings and feedback from Customers and Merchants, in-app messages exchanged with Customers, Merchants, or EthniHub Support, and records of support interactions.

Background Check Data

Where required by law or by EthniHub's onboarding criteria, criminal record extracts or equivalent checks, processed only to the extent permitted under Finnish law.

3. Legal bases for processing

We process your personal data on the following legal bases under GDPR Article 6:

• Performance of a contract (Art. 6(1)(b)): onboarding, Delivery assignment, payouts, and support.
• Legal obligation (Art. 6(1)(c)): tax reporting (including reporting obligations for platform economy income under the DAC7 framework), right-to-work verification, and accounting records.
• Legitimate interests (Art. 6(1)(f)): platform safety, fraud prevention, service quality, and dispute resolution, balanced against your rights and freedoms.
• Consent (Art. 6(1)(a)): optional marketing communications and any processing not covered by the bases above; you may withdraw consent at any time without affecting the lawfulness of prior processing.

4. How we use your information

We use your data to:

• verify your identity and eligibility to provide delivery services;
• assign, route, and track Deliveries;
• calculate and process payouts;
• communicate with you about your account and Deliveries;
• investigate complaints, accidents, or policy violations;
• maintain safety and prevent fraud;
• comply with tax, employment, and consumer-protection obligations; and
• improve the Rider App.

5. Automated decision-making and algorithmic management

Certain features of the Rider App, including Delivery offer allocation and performance-based account status, rely on automated processing. Where a decision produced solely by automated means has a significant effect on you (for example, automated account deactivation), you have the right to obtain human intervention, to express your point of view, and to contest the decision. Request a review by contacting rider@ethnihub.fi.

This right applies regardless of any future national legislation implementing EU Directive 2024/2831 on platform work, which introduces additional algorithmic-transparency obligations that will be reflected in this Policy once implemented in Finland.

6. Who we share your information with

• Customers, limited to your first name, profile photo, and live location, shown only while a Delivery is in progress.
• Merchants, limited to the information needed to complete a pickup.
• Payment and payout processors (including Stripe and Paytrail) to process your earnings.
• Background-check and identity-verification providers, where applicable.
• Tax and regulatory authorities, including the Finnish Tax Administration (Verohallinto), where required by law.
• Professional advisers, insurers, and law enforcement, where necessary to establish, exercise, or defend legal claims, or as required by law.

We do not sell your personal data.

7. International transfers

Where data is transferred outside the European Economic Area (for example, to a sub-processor), we rely on the European Commission's Standard Contractual Clauses or another valid transfer mechanism recognised under GDPR Chapter V.

8. Data retention

We retain onboarding, financial, and tax-relevant records for the periods required under Finnish accounting and tax law (generally six years from the end of the relevant accounting period), Delivery and location history for as long as needed for payout accuracy and dispute resolution, and other personal data for no longer than necessary for the purposes described in this Policy, after which it is deleted or anonymised.

9. Your rights

Under GDPR, you have the right to:

• access your personal data;
• request rectification of inaccurate data;
• request erasure (“right to be forgotten”), subject to our legal retention obligations;
• request restriction of processing;
• receive your data in a portable format;
• object to processing based on legitimate interests;
• withdraw consent at any time; and
• lodge a complaint with the Office of the Data Protection Ombudsman (tietosuoja.fi).

To exercise these rights, contact privacy@ethnihub.fi.

10. Security

We apply technical and organisational measures, including encryption of financial and identity data, access controls, and audit logging, appropriate to the sensitivity of the data described in this Policy.

11. Children

The Rider App is not directed at individuals under 18. We do not knowingly collect data from minors.

12. Changes to this policy

We may update this Policy from time to time. Material changes will be notified in-app or by email at least 30 days before taking effect, except where a shorter period is required to comply with law.

13. Contact