RA DELIVERY PRIVACY POLICY

1. DATA CONTROLLER

2. PLATFORM AND SERVICES

RA Delivery operates a marketplace and delivery platform that may include:

• customer ordering and delivery services;
• restaurant, shop and merchant onboarding;
• courier onboarding and courier operations;
• fleet onboarding and fleet management;
• order tracking, support, refunds and incident handling;
• account management, privacy settings and data export/delete requests;
• CRM, partner acquisition and operational communications;
• websites and mobile applications under the RA Delivery brand.

3. CATEGORIES OF PERSONAL DATA WE PROCESS

Depending on how you use RA Delivery, we may process the following categories of personal data.

3.1 Account and identity data

• name and surname;
• email address;
• phone number;
• password or authentication data;
• Google account identity data if you use Google login, such as name, email address and Google account identifier;
• account status, role, language preference, consent status and security events.

3.2 Contact and delivery data

• delivery addresses;
• map pin coordinates;
• address notes, floor/apartment/intercom details and delivery instructions;
• saved address book entries;
• contact preferences.

3.3 Order, payment and refund data

• order details, products, prices, fees, tips, delivery mode and order status;
• merchant, courier and fleet assignment information;
• payment method status, such as cash on delivery, sandbox/card status or payment provider status;
• refund requests, refund status, refund reason and internal review details;
• invoice and accounting references.

RA Delivery does not intend to store full card numbers. If card payments are enabled, card details should be processed by a payment service provider and RA Delivery should receive only payment status, transaction identifiers or tokenized references.

3.4 Support and communication data

• support tickets;
• emails and messages sent to or from RA Delivery;
• incident reports;
• customer, courier, merchant or fleet communications related to orders, onboarding, support, disputes or operational issues;
• call notes or recordings only if such functionality is activated and you are informed where required.

3.5 Location and technical data

• approximate location derived from your address or map pin;
• customer location only when needed to select a delivery point or show nearby services and only if you allow it;
• courier location only while the courier is online, on shift, assigned to an active delivery or using courier operational features;
• IP address, device type, operating system, browser, app version, identifiers, logs, crash data and security events;
• routing, ETA and delivery progress information.

3.6 Merchant, restaurant, courier and fleet onboarding data

For merchants, restaurants, shops, fleets, couriers and applicants, we may process:

• business name, trade name, company data, CUI/VAT or registration number;
• business address, operating location and map pin;
• contact person details;
• cuisine/category, operating hours, delivery model, menu information and onboarding status;
• courier city, vehicle type, availability, fleet assignment and operational status;
• documents or document-status placeholders if document verification is activated;
• bank, billing or invoice information if required for payments, accounting or onboarding;
• internal review notes, approval status, CRM lead data and source/UTM attribution.

3.7 Consent, privacy and security records

• consent versions and timestamps;
• privacy/cookie preferences;
• marketing opt-in or opt-out;
• data export/delete requests;
• audit logs;
• fraud, abuse and account-protection events.

3.8 Cookies and similar technologies

We may use cookies, local storage, device identifiers and similar technologies for login, security, language preference, analytics, service improvement and marketing where permitted. A separate Cookie Policy or cookie settings page may provide more detailed choices.

4. HOW WE COLLECT PERSONAL DATA

We collect personal data:

• directly from you when you create an account, place an order, complete onboarding, contact support, submit a form or update your profile;
• from your device or browser when you use the website or app;
• from couriers, merchants, fleets or support teams when they process an order or incident;
• from Google if you choose Google login;
• from payment, email, CRM, maps, hosting, analytics, fraud-prevention or technical service providers;
• from public or official sources where necessary for business verification, fraud prevention or legal compliance.

5. PURPOSES AND LEGAL BASES

We process personal data only where we have a lawful basis under applicable data protection law, including the GDPR where applicable.

5.1 Contractual necessity

We process data to:

• create and manage your account;
• allow you to place and receive orders;
• communicate the order to the selected merchant;
• assign or support a courier or fleet;
• show order status, route, ETA and delivery updates;
• provide customer, merchant, courier and fleet support;
• process cancellations, refunds or incidents;
• provide merchant, courier and fleet tools;
• send transactional communications related to your account, order or application.

5.2 Legal obligation

We process data to:

• comply with accounting, tax, consumer protection and legal recordkeeping obligations;
• respond to lawful requests from courts, authorities or regulators;
• handle legal claims, disputes, fraud investigations and compliance records;
• manage privacy rights requests such as access, export, deletion or restriction.

5.3 Legitimate interests

We process data where necessary for our legitimate interests, provided that your rights and freedoms do not override those interests, including:

• security, fraud prevention and abuse detection;
• platform integrity and account protection;
• service improvement and operational analytics;
• routing, dispatch, incident handling and support quality;
• merchant, courier and fleet onboarding and business development;
• internal reporting, audit logs and business continuity;
• preventing misuse of promotions, refunds, support or delivery workflows.

5.4 Consent

We rely on consent where required, including for:

• optional marketing communications;
• certain cookies or tracking technologies;
• precise location access where required by the device or law;
• optional public reviews, photos or user-generated content if such features are enabled;
• optional partner marketing or third-party sharing where applicable.

You may withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

6. USEFUL INFORMATION FOR CUSTOMERS

If you are a customer, we may process your data to:

• create and secure your account;
• show restaurants, shops, offers and delivery options;
• save delivery addresses and instructions;
• process orders, tips, scheduled delivery, cutlery choices and allergy/instruction notes;
• communicate your order to the merchant and courier;
• track delivery progress and ETA;
• provide receipts, support, refunds and complaints handling;
• prevent fraud, account misuse and payment or refund abuse;
• send transactional notifications;
• send marketing only where permitted or with consent.

Your order-related data may be shared with the merchant and courier only to the extent necessary to prepare and deliver your order and handle incidents.

If you add allergy notes or health-related instructions, you should include only information necessary for the merchant to understand your request. RA Delivery is not a medical provider and cannot guarantee that a merchant will be able to meet all allergy-related requests. Merchants remain responsible for the accuracy of their menu, ingredients and allergen information.

7. USEFUL INFORMATION FOR COURIERS

If you are a courier or courier applicant, we may process your data to:

• manage your courier account and application;
• verify onboarding status and eligibility;
• assign orders and show delivery instructions;
• display your location to RA Delivery, the customer, merchant or fleet during active operations where necessary;
• calculate delivery status, route, ETA and operational activity;
• handle incidents, support, disputes, performance issues and fraud prevention;
• manage courier approval, suspension, support and operational communications;
• process earnings, payments or accounting references if such features are enabled.

Courier location data is processed only while you are online, on shift, assigned to an active delivery or using courier operational features that require location. Background location should be used only where necessary for courier delivery functionality and only if enabled in the Courier app with appropriate permissions.

8. USEFUL INFORMATION FOR MERCHANTS, RESTAURANTS AND SHOPS

If you represent a merchant, restaurant, shop or partner, we may process your data to:

• receive and review your application;
• create and manage your merchant account;
• verify business, contact and location information;
• configure menu, products, operating hours and delivery model;
• manage orders, incidents, customer support and refunds;
• show your store to customers where approved and live;
• provide CRM, onboarding and operational communications;
• manage payouts, invoices, accounting or tax records where applicable.

9. USEFUL INFORMATION FOR FLEETS

If you represent or operate a fleet, we may process your data to:

• receive and review your fleet application;
• manage fleet account and business details;
• associate couriers, vehicles and operating areas;
• track active deliveries, incidents and support requests;
• manage fleet approval, suspension and operational communications;
• process payout, invoice or accounting references where applicable.

10. USEFUL INFORMATION FOR PROSPECTS AND WEBSITE VISITORS

If you contact us, submit a form, visit the website or express interest in RA Delivery, we may process your data to:

• respond to your request;
• manage business, merchant, courier or fleet leads;
• record the source of your request, such as direct, referral, campaign, Glovo/Bolt lead, Google or another channel;
• send follow-up communications about the services you requested or similar services where allowed by law;
• improve the website, forms and onboarding flows.

11. WHO RECEIVES YOUR PERSONAL DATA

We may share personal data with the following categories of recipients where necessary:

11.1 Order recipients

• merchants/restaurants/shops selected by the customer;
• couriers and fleets involved in delivery;
• customer support and incident management teams.

11.2 Service providers

• hosting, database, infrastructure and security providers;
• email and communications providers;
• CRM providers, such as EspoCRM or equivalent tools;
• map, routing, geocoding and address providers;
• payment service providers if card or online payments are enabled;
• analytics, crash reporting, logging and monitoring providers;
• fraud-prevention and abuse-detection providers;
• professional advisers, accountants, lawyers and auditors.

11.3 Public authorities and legal recipients

We may disclose data where required or permitted by law, including to courts, regulators, tax authorities, law enforcement or other competent authorities.

11.4 Business transfer

If RA Delivery or part of its business is reorganized, transferred, sold or merged, personal data may be transferred as part of that transaction, subject to appropriate legal safeguards.

We do not sell your personal data.

12. INTERNATIONAL TRANSFERS

Some service providers may process data outside Romania, the European Union or the European Economic Area. Where this happens, we use appropriate safeguards required by applicable law, such as adequacy decisions, Standard Contractual Clauses, data processing agreements and technical/organizational security measures.

13. AUTOMATED DECISION-MAKING AND PROFILING

RA Delivery may use rules, filters, fraud signals, location, order history, operational status and platform activity to:

• show relevant restaurants or offers;
• calculate ETA, routing and availability;
• prevent fraud and abuse;
• prioritize support or operational workflows;
• support dispatch, delivery or onboarding decisions.

RA Delivery does not intend to make decisions based solely on automated processing that produce legal or similarly significant effects without appropriate safeguards. Where a decision significantly affects you, you may contact us to request human review where required by law.

14. ARTIFICIAL INTELLIGENCE

RA Delivery may use AI-assisted tools for support, internal operations, content review, fraud detection, routing support or administrative assistance. Where you interact with an AI-powered support tool, we will indicate this where appropriate and allow escalation to a human agent for complex or sensitive issues.

We do not intend to use your personal data to train third-party AI models unless we clearly inform you and have a lawful basis to do so.

15. MARKETING AND COMMUNICATIONS

We may send:

• transactional messages about your account, orders, onboarding, security, support, refunds or policy updates;
• operational communications to couriers, merchants and fleets;
• marketing communications only where permitted by law or with your consent.

You can unsubscribe from marketing emails using the unsubscribe link or by contacting [email protected]. Disabling push notifications may also stop order-status notifications, depending on your device settings.

16. SECURITY MEASURES

We use technical and organizational measures designed to protect personal data against unauthorized access, alteration, disclosure, loss or destruction. These may include:

• access controls and role-based permissions;
• encryption in transit where applicable;
• secure authentication and session controls;
• audit logs and monitoring;
• backups and recovery procedures;
• vulnerability review and security testing;
• data minimization and retention controls;
• contractual safeguards with service providers.

No system is completely secure. If you believe your account or data has been compromised, contact us immediately at [email protected] or [email protected].

17. DATA RETENTION

We keep personal data only as long as necessary for the purposes described in this policy, unless a longer period is required or permitted by law.

The following table provides general retention guidance. Specific periods may vary depending on legal obligations, disputes, fraud prevention, tax/accounting rules, contractual obligations or technical limitations.

18. DATA EXPORT AND DELETION

You may request a copy of your personal data or request deletion/anonymization of your account by contacting [email protected] or [email protected], or by using privacy tools available in the website or app.

When you request deletion:

• data not required for legal, accounting, fraud-prevention, dispute or security purposes will be deleted or anonymized;
• order, invoice, ledger or legal records may be retained in limited or anonymized form where required;
• we may retain audit records showing that a deletion request was processed;
• if deletion cannot be completed immediately, we will record the status and explain the retained categories where required.

19. YOUR RIGHTS

Subject to applicable law, you may have the following rights:

• access to your personal data;
• rectification of inaccurate or incomplete data;
• erasure of personal data where applicable;
• restriction of processing;
• portability of data provided by you;
• objection to processing based on legitimate interests;
• withdrawal of consent;
• objection to direct marketing;
• objection to certain profiling;
• complaint to a supervisory authority.

To exercise your rights, contact:

We may need to verify your identity before responding to a request. This protects your account and prevents disclosure of your data to unauthorized persons.

20. SUPERVISORY AUTHORITY

You may lodge a complaint with the Romanian supervisory authority:

21. CHILDREN

RA Delivery is not intended for children under 18. We do not knowingly allow children under 18 to create accounts or use services intended for adults. If we learn that a child has provided personal data without proper authorization, we will take appropriate steps to delete or restrict the data.

22. THIRD-PARTY LINKS AND SERVICES

The platform may include links or integrations with third-party services such as maps, payment providers, Google login, app stores, merchant websites or support tools. Those services may process your data according to their own privacy policies. RA Delivery is not responsible for third-party processing that is not carried out on our instructions.

23. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. If we make material changes, we will notify users through the website, app, email or other appropriate means. The date at the top of this policy shows when it was last updated.

24. CONTACT