Legal document

Privacy Policy

DEGO DELIVERY

Last updated: July 8, 2026

1. Data controller

In compliance with Regulation (EU) 2016/679 (General Data Protection Regulation -- GDPR), Organic Law 3/2018 and other applicable Spanish legislation, we inform you that the data controller responsible for the personal data collected through the "DeGo" mobile application is:

  • DEGO DELIVERY SL
  • CIF: B26795872
  • Registered office: Calle Músico Martínez Valls 3, Ontinyent, Valencia, Spain
  • Email: contacto@degodelivery.com

DEGO DELIVERY SL guarantees that personal data processing is carried out in a lawful, fair, transparent and appropriate manner in accordance with the purposes described in this policy.

2. Personal data we process

Depending on the type of user (customer, restaurant or rider), DeGo may process the following categories of data:

Customers and restaurants:

  • Identification data (name).
  • Contact data (email address, phone number).
  • Access credentials (password stored in encrypted/hashed form).
  • Delivery or establishment address.
  • Order data and purchase history.
  • Communications made through the platform.

Riders:

In addition to the above:

  • Precise geolocation data during active deliveries.
  • Operational data related to order logistics management.

Geolocation is only activated when a delivery is assigned and is automatically deactivated upon completion. No continuous tracking is performed outside of these situations.

Technical data:

  • Internal user identifier.
  • Device token for push notifications.
  • IP address.
  • Technical and diagnostic data (errors, crashes, performance).

Payments:

DeGo does not store complete bank card data. Payment processing is carried out directly through specialised service providers.

Advertising and attribution data (only with consent):

  • Device advertising identifier (IDFA on iOS / GAID on Android).
  • Campaign attribution data (install source, campaign, click).
  • App usage events (for example: sign-up, add to cart, checkout start and purchase) used to measure the effectiveness of our campaigns.

This data is only collected if the user has given their consent in the app and, on iOS, has granted the system tracking permission (ATT). If the user does not consent, neither the advertising identifier is collected nor is advertising measurement performed.

3. Purpose of processing

Personal data is processed for the following purposes:

  • Account registration and authentication management.
  • Order management and delivery coordination.
  • Operational communication regarding order status.
  • Customer support.
  • Fraud prevention and misuse detection.
  • Technical improvement, performance analysis and service optimisation.
  • Compliance with legal obligations in tax, accounting and security matters.
  • Marketing and advertising measurement (only with consent): measuring the effectiveness of our campaigns and attributing installs and orders to their source (social media, paid ads, promotional links and QR codes), as well as directing the user to the correct content within the app.

In the case of riders, location data is used exclusively for the logistics management of active deliveries.

4. Legal basis for processing

The processing is based on:

  • Performance of a contract (art. 6.1.b GDPR): provision of the delivery service.
  • Compliance with legal obligations (art. 6.1.c GDPR).
  • User consent (art. 6.1.a GDPR) for optional features or analytics where required, as well as for advanced analytics, advertising measurement, the use of the advertising identifier and cross-app tracking. On iOS devices, the App Tracking Transparency (ATT) system authorisation is additionally required. The user may withdraw this consent at any time from the app's privacy settings.
  • Legitimate interest (art. 6.1.f GDPR) for:
    • Ensuring the security of the platform.
    • Preventing fraud.
    • Protecting users and riders.
    • Improving the service offered.

In relation to the legitimate interest, DeGo has carried out the corresponding balancing test in accordance with the GDPR.

The user may withdraw their consent at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5. Automated decisions and profiling

DeGo may use automated systems for order assignment, route optimisation or analysis of application usage.

However, no automated decisions that produce significant legal effects on the user based exclusively on the automated processing of personal data are made, in accordance with article 22 of the GDPR.

Should such systems with significant impact be implemented in the future, users will be duly informed and their corresponding rights will be guaranteed.

6. Third-party services and recipients

For the proper functioning of the service, DeGo may rely on providers acting as data processors, such as:

  • Payment service providers (e.g. Stripe).
  • Cloud infrastructure and hosting providers.
  • Push notification and messaging services.
  • Maps and geocoding services (Google Maps, Google Places).
  • Technical analytics and error monitoring services.
  • Tax or accounting advisors when necessary.
  • Public authorities when a legal obligation exists.
  • Meta Platforms (Facebook/Instagram): measurement, attribution and optimisation of our advertising campaigns (only with consent).
  • Linkrunner: campaign attribution, deep links and install measurement (only with consent).
  • Google Firebase: usage analytics and detection of technical errors/crashes.

All providers are subject to contracts that guarantee confidentiality and GDPR compliance.

DeGo does not sell or commercialise personal data.

7. Tracking, advertising and App Tracking Transparency (ATT)

DeGo does not track or collect the advertising identifier without your explicit consent, which we request through an in-app notice. On iOS devices, the system's App Tracking Transparency (ATT) dialog is also shown; if you do not grant permission, the advertising identifier (IDFA) is not used.

With your consent, we share the advertising identifier and certain usage events with Meta and Linkrunner for the sole purpose of measuring the effectiveness of our ads and attributing campaigns. This data is not sold or used to create profiles with legal effects.

You can withdraw your consent at any time from Privacy settings within the app; from that moment, collection for advertising purposes stops.

8. International transfers

Some technology providers may be located outside the European Economic Area. In such cases, DeGo ensures that transfers are carried out in accordance with valid mechanisms provided for in the GDPR, such as standard contractual clauses or other appropriate safeguards. In particular, providers such as Meta (United States) and Linkrunner may process data outside the EEA, in which case standard contractual clauses or other appropriate safeguards under the GDPR apply.

9. Data retention

Data will be retained for the time necessary to fulfil the purposes described.

  • Inactive accounts: maximum 24 months from the last activity.
  • Tax and accounting data: in accordance with Spanish legislation (up to 6 years).

Data necessary for the defence against potential legal liabilities may be retained in a blocked state during the applicable limitation periods.

Once the corresponding periods have elapsed, data will be securely deleted or anonymised.

10. User rights

Users may exercise the following rights:

  • Access
  • Rectification
  • Erasure
  • Restriction of processing
  • Objection
  • Portability

Requests may be sent to: contacto@degodelivery.com indicating the right you wish to exercise and the email address associated with your account.

DeGo may request additional information to verify the identity of the requester before processing the request.

If you consider that your rights have not been adequately addressed, you may file a complaint with the Spanish Data Protection Agency (AEPD) -- www.aepd.es

11. Information security

DeGo implements appropriate technical and organisational measures to ensure the confidentiality, integrity and availability of data, including:

  • Encryption of communications.
  • Secure storage of credentials.
  • Access controls.
  • Security monitoring.

However, no system is completely infallible.

12. Minors

The application is not intended for individuals under 18 years of age. If the collection of data from a minor without legal authorisation is detected, it will be immediately deleted.

13. Amendments

DeGo Delivery SL may modify this Privacy Policy to adapt it to regulatory changes or service improvements. In the event of substantial modifications, users will be informed through appropriate means.