When you use Onyx, you trust us with your personal data. We’re committed to keeping that trust. That starts with helping you understand our privacy practices.
This notice describes the personal data we collect, how it’s used and shared, and your choices regarding this data. We recommend that you read this along with our privacy overview, which highlights key points about our privacy practices.
Last modified: July 23, 2020 Effective date: July 20, 2020
A. The Data We Collect
Data provided by users to Onyx, such as during account creation
Data created during use of our services, such as location, app usage, and device data
Data from other sources, such as Onyx partners and third parties that use Onyx APIs
The following data is collected by or on behalf of Onyx:
1. Data provided by users. This includes:
2. Data created during use of our services. This includes:
3. Data from other sources. This includes:
Onyx collects and uses data to enable reliable and convenient transportation, delivery, and other products and services. We also use the data we collect:
Onyx uses the data it collects for purposes including:
1. Providing services and features. Onyx uses the data we collect to provide, personalize, maintain, and improve our products and services. This includes using the data to:
2. Safety and security. We use personal data to help maintain the safety, security, and integrity of our services and users. This includes:
3. Customer support. Onyx uses the information we collect (including recordings of customer support calls with notice to and the consent of the user) to provide customer support, including to:
4. Research and development. We may use the data we collect for testing, research, analysis, product development, and machine learning to improve the user experience. This helps us to improve and enhance the safety and security of our services, improve our ability to prevent the use of our services for illegal or improper purposes, develop new features and products, and facilitate insurance and finance solutions in connection with our services.
5. Enabling communications between users. For example, a crew member may message or call a client to confirm a pickup location, a client may contact a crew member to retrieve a lost item, or a restaurant or delivery partner may call a delivery recipient with information about their order.
6. Marketing. Onyx may use the data we collect to market our services to our users. This includes sending users communications about Onyx services, features, promotions, sweepstakes, studies, surveys, news, updates, and events.
We may also send communications to our users about products and services offered by Onyx partners. For example, if a user has placed an Onyx Eats order, we may provide recommendations, promotions, or ads about similar food offered by other Onyx partners. Although we may send users communications about Onyx partners’ products and services, we do not sell users’ personal data to, or share it with, such partners or others for purposes of their own direct marketing or advertising, except with users’ consent.
We may use the data we collect to personalize the marketing communications (including advertisements) that we send, including based on user location, past use of Onyx’s services, and user preferences and settings.
We may also send users communications regarding elections, ballots, referenda, and other political and notice processes that relate to our services. For example, Onyx has notified some users by email of ballot measures or pending legislation relating to the availability of Onyx’s services in those users’ areas.
7. Non-marketing communications. Onyx may use the data we collect to generate and provide users with receipts; inform them of changes to our terms, services, or policies; or send other communications that aren’t for the purpose of marketing the services or products of Onyx or its partners.
8. Legal proceedings and requirements. We may use the personal data we collect to investigate or address claims or disputes relating to use of Onyx’s services, or as otherwise allowed by applicable law, or as requested by regulators, government entities, and official inquiries.
9. Automated decision-making
We use personal data to make automated decisions relating to use of our services. This includes:
C. Cookies And Third-Party Technologies
Cookies are small text files that are stored on browsers or devices by websites, apps, online media, and advertisements. Onyx uses cookies and similar technologies for purposes such as:
Please see our Cookie Notice for more information regarding the use of cookies and other technologies described in this section.
Some of Onyx’s products, services, and features require that we share data with other users or at a user’s request. We may also share data with our affiliates, subsidiaries, and partners, for legal reasons or in connection with claims or disputes. Onyx may share the data we collect:
1. With other users
This includes sharing:
2. At the user’s request
This includes sharing data with:
3. With the general public
Questions or comments from users submitted through public forums such as Onyx blogs and Onyx social media pages may be viewable by the public, including any personal data included in the questions or comments submitted by a user.
4. With the Onyx account owner
If a user requests transportation or places an order using an account owned by another party, we may share their order or trip information, including real-time location data, with the owner of that account.
5. With Onyx subsidiaries and affiliates
We share data with our subsidiaries and affiliates to help us provide our services or conduct data processing on our behalf.
6. With Onyx service providers and business partners
Onyx provides data to vendors, consultants, marketing partners, research firms, and other service providers or business partners. These include:
7. For legal reasons or in the event of a dispute
Onyx may share users’ personal data if we believe it’s required by applicable law, regulation, operating license or agreement, legal process or governmental request, or where the disclosure is otherwise appropriate due to safety or similar concerns. This includes sharing personal data with law enforcement officials, public health officials, other government authorities, airports (if required by the airport authorities as a condition of operating on airport property), or other third parties as necessary to enforce our Terms of Service, user agreements, or other policies; to protect Onyx’s rights or property or the rights, safety, or property of others; or in the event of a claim or dispute relating to the use of our services. If you use another person’s credit card, we may be required by law to share your personal data, including trip or order information, with the owner of that credit card.
Please see Onyx’s Guidelines for Law Enforcement Authorities for more information.
This also includes sharing personal data with others in connection with, or during negotiations of, any merger, sale of company assets, consolidation or restructuring, financing, or acquisition of all or a portion of our business by or into another company.
8. With consent
Onyx may share a user’s personal data other than as described in this notice if we notify the user and they consent to the sharing.
Onyx retains user profile, transaction, and other personal data for as long as a user maintains their Onyx account.
Onyx may retain certain user data after receiving an account deletion request if necessary, such as to comply with legal requirements.
Onyx retains user profile, transaction, and other information for as long as a user maintains their Onyx account. For crew and delivery partners, Onyx also retains vehicle and background check information (to the extent permitted by law) for as long as they maintain their Onyx account.
Clients and delivery recipients may request deletion of their account at any time through the Settings > Privacy menus in the Onyx app, or through Onyx’s Help Center. Following such requests, Onyx deletes the data that it is not required to retain for purposes of regulatory, tax, insurance, litigation, or other legal requirements. For example, Onyx retains location, device, and usage data for these purposes for a minimum of 7 years; while it retains such data, it may also use it for purposes of safety, security, fraud prevention and detection, and research and development. In certain circumstances, Onyx may be unable to delete a user’s account, such as if there’s an outstanding credit on the account or an unresolved claim or dispute. Upon resolution of the issue preventing deletion, Onyx will delete the account as described above.
Onyx may also retain certain information if necessary for purposes of safety, security, and fraud prevention. For example, if Onyx deactivates a user’s account because of unsafe behavior or security incidents, Onyx may retain certain information about that account to prevent that user from opening a new Onyx account in the future.
We only collect and use personal data where we have lawful grounds to do so. These include processing user personal data to provide requested services and features, for purposes of Onyx’s legitimate interests or those of other parties, to fulfill our legal obligations, or based on consent.
We collect and use personal data only where we have one or more lawful grounds for doing so. Such grounds may vary depending on where our users are located, but generally include processing personal data:
a. To provide requested services and features
In order to provide our services, we must collect and use certain personal data. This includes:
b. For purposes of the legitimate interests of Onyx or other parties
This includes using personal data to maintain and enhance our users’ safety and security. For example, we use personal data to prevent use of our services by users who have engaged in inappropriate or dangerous behavior, such as by retaining data of banned users to prevent their use of Onyx’s apps. We also use usage data to prevent matching of clients and crew for whom there is higher risk of conflict (for instance, because they have been the subject of prior complaints from other users).
This also includes purposes such as combating fraud; improving our services, direct marketing, research, and development; and enforcing Onyx’s Terms of Service.
In addition, it includes using personal data to the extent necessary for the interests of other people or the general public, such as in connection with legal or insurance claims, and to protect the rights and safety of others.
c. To fulfill Onyx’s legal obligations
For example, Onyx is subject to laws and regulations in many cities and countries that require it to collect and retain data about our users’ trips, and to provide copies of such data to the government or other authorities. We collect and use personal data to comply with such laws.
Onyx may also share data with law enforcement regarding criminal acts or threats to public safety, or requests by third parties pursuant to legal processes. For more information about such sharing, please see Onyx’s Guidelines for Law Enforcement Authorities – United States, Guidelines for Law Enforcement Authorities – Outside the US, and Guidelines for Third Party Data Requests and Service of Legal Documents.
d. With consent
Onyx may collect and use personal data based on the user’s consent. For example, we may collect personal data through voluntary surveys. Responses to such surveys are collected on the basis of consent and will be deleted once no longer necessary for the purposes collected.
A user who has provided consent to a collection or use of their personal data can revoke it at any time. However, the user will not be able to use any service or feature that requires collection or use of that personal data.
Onyx enables users to access and control the data that Onyx collects, including through:
A. Privacy settings
Settings menus in the Onyx app for clients give them the ability to set or update their location-sharing preferences and their preferences for receiving mobile notifications from Onyx. Information about these settings, how to set or change these settings, and the effect of turning off these settings is described below.
Location data
Onyx uses clients’ device location services to make it easier to get a ride whenever they need one. Location data helps improve our services, including pickups, navigation, and customer support. Clients may enable or disallow Onyx to collect location data from their mobile devices through the Settings > Privacy menus in the Onyx app. Clients and delivery recipients can enable or disallow such collections through the settings on their mobile device.
Share Live Location (clients)
Clients who have enabled Onyx to collect location data from their mobile device may also enable Onyx to share their location with their crew member from the time the ride is requested to the start of the trip. This can help improve pickups for both crew and clients, particularly in crowded areas. Clients may enable or disable this feature through the Settings > Privacy menus in the Onyx app.
Emergency Data Sharing (clients)
Clients who have enabled Onyx to collect location data from their mobile device may also enable the Emergency Data Sharing feature that shares data with emergency police, fire, and ambulance services. Such data includes approximate location at the time the emergency call was placed; the car’s make, model, color, and license plate information; the client’s name and phone number; pickup and dropoff locations; and the crew member’s name. Clients may enable or disable this feature through the Settings > Privacy menus or the Safety Center in the Onyx app.
Notifications: account and trip updates
Onyx provides users with trip status notifications and updates related to activity on their account. These notifications are a necessary part of using the Onyx app and cannot be disabled. However, users may choose the method by which they receive these notifications through the Settings > Privacy menus in the Onyx app.
Notifications: discounts and news
Users may enable Onyx to send push notifications about discounts and news from Onyx. Push notifications may be enabled or disabled through the Settings > Privacy menus in the Onyx app.
Communications from restaurant partners
Delivery recipients who have opted in to communications from restaurant partners may stop sharing their data with each restaurant partner in their Onyx Eats account settings.
B. Device permissions
Most mobile device platforms (iOS, Android, etc.) have defined certain types of device data that apps cannot access without the device owner’s permission, and these platforms have different methods for how that permission can be obtained. iOS devices notify users the first time the Onyx app requests permission to access certain types of data and gives users the option to grant or refuse permission. Android devices notify users of the permissions that the Onyx app seeks before their first use of the app, and use of the app constitutes a grant of such permission.
C. Ratings look-up
After every trip, crew and clients are able to rate each other on a scale from 1 to 5. An average of those ratings is associated with a user’s account and is displayed to other users for whom they provide or receive services. For example, client ratings are available to crew from whom they request transportation, and crew member ratings are available to their clients.
This 2-way system holds everyone accountable for their behavior. Accountability helps create a respectful, safe environment for crew and clients. Clients can see their average rating in the main menu of the Onyx app. Crew can see their average rating after tapping their profile photo in the Onyx Driver app. Delivery partners are also rated by delivery recipients and restaurant partners. Click here for more information.
D. Marketing opt-outs
Users may opt out of receiving promotional emails from Onyx here. Users may also opt out of receiving emails and other messages from Onyx by following the unsubscribe instructions in those messages. We may still send users who have opted out non-promotional communications, such as receipts for rides or information about their account.
E. User data requests
Onyx provides users with a variety of ways to learn about, control, and submit questions and comments about Onyx’s handling of their data. To make a request, please go here.
Accessing data: Users can ask for an explanation of the data we collect from them and how we use it.
Receiving data: Users can ask for a copy of data that Onyx collects from them with their consent or as necessary to provide our services.
Changing or updating data: Users can edit the name, phone number, email address, payment method, and photo associated with their account through the Settings menu in Onyx’s apps or crew member portal. They may also ask that Onyx change or update their data, including if they believe such data is inaccurate or incomplete.
Deleting data: Users may request deletion of their account at any time through the Settings > Privacy menus in the Onyx app, or through Onyx’s website (clients and delivery recipients here; crew and delivery partners here).
Objections, restrictions, and complaints: Users may request that we stop using all or some of their personal data, or that we limit our use of their data. Onyx may continue to process data after such objection or request to the extent required or permitted by law.
In addition, depending on their location, users may have the right to file a complaint relating to Onyx’s handling of their personal data with the data protection authority in their country. For example, users in the European Union and South America may submit such requests to the data protection authorities in the country in which they live.
We may occasionally update this notice. Use of our services after an update constitutes consent to the updated notice to the extent permitted by law.
We may occasionally update this notice. If we make significant changes, we will notify users in advance of the changes through the Onyx apps or through other means, such as email. We encourage users to periodically review this notice for the latest information on our privacy practices. After such notice, use of our services by users in countries outside the European Union will be understood as consent to the updates to the extent permitted by law.
See our FAQ for more information.