Privacy notice
This notice explains what personal data VG Delivered collects when you use our website and mobile apps, why we use it, who we share it with and what your rights are under the UK GDPR and the Data Protection Act 2018.
Last updated:
1. Who we are
The data controller is VG Delivered Ltd (trading as VG Delivered), a company registered in Scotland under company number SC835775 , with its registered office at 2F1, 13 Lochrin Terrace, Edinburgh EH3 9QL, United Kingdom .
Questions about this notice or your data: info@vgdelivered.com. We have not appointed a statutory Data Protection Officer; the e-mail address above reaches the person responsible for data protection.
2. What personal data we collect
| Category | Examples | Who it concerns |
|---|---|---|
| Account data | Name, e-mail address, password (hashed), phone number, role, saved delivery addresses, favourite restaurants | Customers, riders, restaurant staff |
| Order data | Items ordered, special instructions and allergy notes you type in, order type, delivery address and coordinates, table number, prices, coupon codes, order status history, reviews you leave | Customers (including guest checkouts) |
| Payment data | Payment status, Stripe payment-intent and customer identifiers, last four digits and card brand as reported by Stripe. We never see or store full card numbers. | Customers |
| Precise location (customers) | Your device location, only when you choose "use my location" or allow the app to find restaurants near you. It is used while you are using the app and is not tracked in the background. | Customers |
| Precise location (riders) | Your live location, including in the background, only while you have set yourself as available or have an active delivery. This is used to assign deliveries, show customers and restaurants where their order is and calculate earnings. | Riders |
| Proof of delivery | Photos taken by the rider at hand-over, delivery timestamps and location at hand-over | Riders, customers |
| Device & push data | Push notification tokens (Expo), device platform and app version, so we can send order updates | App users |
| Communications | Rider applications, help requests and e-mails you send us | Anyone contacting us |
| Technical data | IP address, browser/device type, pages requested, error logs, security logs (for example failed login attempts) | All visitors |
We do not knowingly collect special category data. Any allergy or dietary information you add to an order is stored as free text with that order so the kitchen can act on it; please only share what is necessary.
3. Why we use your data and our legal bases
| Purpose | Legal basis (UK GDPR Art. 6) |
|---|---|
| Taking, preparing, delivering and confirming your order; sending order status e-mails and push notifications | Performance of a contract (Art. 6(1)(b)) |
| Processing payments and refunds through Stripe; preventing fraud | Contract (6(1)(b)) and legitimate interests (6(1)(f)) in preventing fraud |
| Finding restaurants that deliver to you and calculating delivery fees from your location | Contract (6(1)(b)); for device location, your consent given via the device permission (6(1)(a)) |
| Dispatching deliveries to riders, tracking live deliveries and paying rider earnings | Contract with the rider (6(1)(b)) and legitimate interests (6(1)(f)) in operating a safe, reliable delivery service |
| Keeping proof-of-delivery photos to resolve disputes about missing or damaged orders | Legitimate interests (6(1)(f)) |
| Keeping accounts secure, logging errors, rate-limiting abuse and protecting against bots (Cloudflare Turnstile) | Legitimate interests (6(1)(f)) |
| Keeping financial records of orders and payouts | Legal obligation (6(1)(c)) — tax and company law |
| Responding to rider applications and support requests | Steps prior to a contract (6(1)(b)) and legitimate interests (6(1)(f)) |
| Publishing the reviews you choose to leave (first name and rating) | Consent (6(1)(a)) — you can ask us to remove a review at any time |
We do not use your data for automated decision-making with legal or similarly significant effects, and we do not sell personal data or use it for third-party advertising.
4. Who we share data with
We share personal data only with the parties needed to fulfil your order or run the service:
- The restaurant you order from — your name, phone number, order contents and (for delivery) your address, so they can prepare and hand over your order.
- The rider delivering your order — your name, phone number, delivery address and instructions, for the duration of the delivery.
- Stripe Payments UK Ltd / Stripe Payments Europe Ltd — payment processing and payouts to restaurants and riders (Stripe Connect). Stripe is an independent controller for the card data it processes; see Stripe's privacy policy.
- Shipday Inc. — delivery dispatch and tracking software used for some deliveries (order and delivery address, rider location).
- Expo (650 Industries, Inc.) — delivery of push notifications to the mobile apps (push tokens and notification content).
- Google LLC (Google Maps Platform) — address autocomplete and geocoding on the website and in the apps (the address or coordinates you enter, your IP address).
- OpenStreetMap Foundation (Nominatim) — fallback address lookup when Google Maps is unavailable (the address or coordinates you enter).
- Cloudflare, Inc. (Turnstile) — bot protection on sign-up and application forms (IP address, browser signals).
- Our hosting and e-mail providers — DigitalOcean, LLC hosts the platform and database; transactional e-mails are sent through our e-mail provider.
- Professional advisers and authorities — where required by law, to enforce our terms or to protect rights, property or safety.
Some of these providers process data outside the UK (for example in the United States). Where that happens we rely on the UK International Data Transfer Agreement / Addendum or the UK adequacy regulations for the EEA, together with the provider's own safeguards.
5. How long we keep data
- Account data: for as long as your account exists. You can delete your account at any time from the app or at Delete my account; we then remove or anonymise your profile within 30 days.
- Orders, payments and payouts: 6 years after the end of the financial year in which the order was placed, to meet HMRC and company-law record-keeping duties. Order records are kept in anonymised form after you delete your account.
- Proof-of-delivery photos: 120 days after delivery, or longer only while a dispute about that order is open.
- Rider location history: live positions are overwritten continuously; per-delivery route points are kept with the delivery record for the same period as the order.
- Server, security and error logs: 14 days.
- Push tokens: until you log out, uninstall the app or the token becomes invalid.
- Rider applications and support e-mails: 12 months after our last contact, unless you join us as a rider.
6. Your rights
Under the UK GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected (you can edit your details in your account);
- have your data erased where there is no longer a legal reason to keep it;
- restrict or object to processing based on our legitimate interests;
- receive the data you provided to us in a portable format;
- withdraw consent at any time where we rely on it (for example by turning off location or notification permissions on your device), without affecting processing before withdrawal.
To exercise any of these rights, e-mail info@vgdelivered.com. We will respond within one month. We may ask you to confirm your identity first.
You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would appreciate the chance to resolve your concern first.
7. Cookies and similar technologies
The website only uses strictly necessary first-party cookies (your session, CSRF protection and "remember me"). Third-party services we embed — Stripe, Google Maps and Cloudflare Turnstile — may set their own functional cookies when you use those features. We do not use analytics or advertising cookies. Full details are in our cookie notice.
8. Security
Data is transmitted over HTTPS, passwords are stored as salted hashes, and access to production systems is limited to staff who need it. No system is completely secure; if we become aware of a breach that is likely to affect your rights we will notify you and the ICO as required by law.
9. Children
Our services are intended for people aged 18 and over (16 and over for customer accounts). We do not knowingly collect data from children under 16. If you believe a child has given us personal data, please contact us and we will delete it.
10. Changes to this notice
We may update this notice when our services or the law change. The date at the top shows the latest version; significant changes will be announced in the app or by e-mail to account holders.
11. Contact
VG Delivered Ltd
(VG Delivered)
2F1, 13 Lochrin Terrace, Edinburgh EH3 9QL, United Kingdom
info@vgdelivered.com