Privacy Policy

1. Introduction and Data Controller

This Privacy Policy explains how PickIt ("we," "our," or "us") collects, uses, processes, and protects your personal information when you use our litter-picking community mobile application and website (collectively, the "Service").

We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

2.1 Personal Information

• Account Information: Username, email address
• Contact Information: When you contact us for support
• Device Information: Device type, operating system, app version

2.2 Location Data

Precise Location Data: We collect GPS coordinates when you:

• Record cleanup routes
• Mark litter collection points
• Participate in community challenges

Legal Basis: Consent (you can withdraw consent at any time through app settings)

Purpose: To track environmental impact, enable route recording, and provide location-based community features.

2.3 User-Generated Content

• Photos: Before/after cleanup photos you choose to upload
• Route Data: Paths, duration, and distance of cleanup activities

2.4 Usage Analytics

• App usage patterns and feature interaction
• Performance metrics and crash reports
• Anonymous aggregated statistics

3. How We Use Your Information

3.1 Primary Purposes

• Service Provision: Enable core app functionality and route tracking
• Environmental Impact: Calculate and display your cleanup statistics

3.2 Secondary Purposes

• Service Improvement: Analyze usage to enhance app functionality
• Communication: Send important service updates and notifications
• Safety: Prevent fraud and ensure community safety

3.3 Legal Bases for Processing

• Consent: Location data, marketing communications
• Contract Performance: Providing core app services
• Legitimate Interest: Service improvement, fraud prevention
• Legal Obligation: Compliance with applicable laws

4. Data Sharing and Third Parties

4.1 We Share Data With:

• Local Councils: Anonymous aggregated cleanup statistics (with consent)
• Service Providers: Cloud hosting, analytics, customer support
• Community Members: Public leaderboards and achievements (anonymized)

4.2 We Never Share:

• Precise location data with third parties without explicit consent
• Personal information for marketing purposes
• Individual route data with councils or other organizations

4.3 Third-Party Services

• Google Maps: For map display and route visualization
• Cloud Storage: AWS/Google Cloud for data storage and processing

5. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

5.1 How to Exercise Your Rights

• In-App: Use the privacy settings in the app
• Email: Contact privacy@pickit.app
• Website: Use our account deletion page

Response Time: We will respond to your request within 30 days (may be extended to 60 days for complex requests).

6. Data Retention

6.1 Retention Periods

• Account Data: Until account deletion or 3 years of inactivity
• Location Data: 2 years from collection, or until consent withdrawal
• Usage Analytics: 26 months (anonymized after 14 months)
• Support Communications: 3 years for customer service purposes

6.2 Anonymization

After retention periods, data is either deleted or anonymized for statistical purposes. Anonymized data cannot be linked back to you and is not considered personal data.

7. Data Security

7.1 Technical Measures

• Encryption: Data encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Role-based access with multi-factor authentication
• Regular Audits: Security assessments and penetration testing
• Incident Response: 24/7 monitoring and breach response procedures

7.2 Organizational Measures

• Staff training on data protection principles
• Privacy by design in all new features
• Regular policy reviews and updates

8. International Transfers

Your data is primarily processed within the UK. When we use international service providers, we ensure adequate protection through:

• UK GDPR adequacy decisions
• Standard Contractual Clauses (SCCs)
• Binding Corporate Rules where applicable

9. Children's Privacy

Our service is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

For users aged 13-18, parental consent may be required depending on local laws.

10. Changes to This Policy

We may update this Privacy Policy periodically. We will:

• Notify you of material changes via email or app notification
• Post the updated policy on our website
• Update the "Last updated" date
• Provide a summary of changes for significant updates

11. Contact Information and Complaints

11.1 Contact Us

11.2 Regulatory Authority

If you believe we have not handled your personal data in accordance with this policy, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):