Privacy Policy

GeoRest Ltd. (company no. 515241263), which operates the DelivApp platform and does business under the DelivApp brand ("DelivApp", "GeoRest", "we", "our" or "us"), respects the privacy of every person whose information we process when we provide the DelivApp platform. This Privacy Policy explains what information we collect, why we collect it, who we share it with, how long we keep it and what rights you have.

BY ACCESSING OR USING THE SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ THIS PRIVACY POLICY. WHERE CONSENT IS REQUIRED BY APPLICABLE LAW, WE OR THE RELEVANT CUSTOMER WILL REQUEST IT SEPARATELY. IF YOU CHOOSE NOT TO PROVIDE INFORMATION NEEDED FOR A PARTICULAR SERVICE, THAT SERVICE MAY NOT BE AVAILABLE TO YOU.

You are not required by law to provide us with personal information. However, some Services cannot work without it: for example, we cannot deliver an order without an address, or create an account without a phone number.

1. Who we are and what this policy covers

GeoRest develops and operates DelivApp, an ordering and delivery management platform for restaurants, retailers, delivery companies and marketplaces (each, a “Customer”). The platform may be presented under a Customer’s name, brand, website or mobile application, and may not visibly identify DelivApp at every point of collection. This policy covers the following (together, the “Services”):

• Portal: the web back-office at app.delivapp.com used by Customers and their staff.
• Apps: our mobile applications, including the courier app, published on the Apple App Store and Google Play.
• Ordering channels: ordering websites, mobile ordering apps, self-service kiosks, loyalty experiences and branded applications operated for Customers, including white-label implementations.
• Tracking and feedback pages: web pages that show the status of a delivery and collect feedback on it.
• Website: delivapp.com.

This policy is written for four groups of people. Each section below says which group it applies to where that matters.

A Customer’s ordering channel may also display the Customer’s own privacy notice or policy. The Customer’s notice governs the Customer’s own decisions about the use of personal information. This policy explains GeoRest’s processing activities and does not replace notices that a Customer is required to give when collecting information.

2. Our role: database controller or holder

For much of the personal information processed through the Services, the Customer determines the purposes of processing, while GeoRest processes the information to provide the platform under the Customer’s instructions. Under the Israeli Protection of Privacy Law, 5741-1981 (as amended), the Customer is generally the “database controller” (ba’al shlita bema’agar meida) and GeoRest acts as a “holder” (machzik). For certain information and purposes, GeoRest determines the purposes of processing independently and acts as database controller, as indicated below. The precise allocation of responsibilities may depend on the service and contractual arrangement.

Where the Customer is the database controller, it is generally responsible for establishing the legal grounds for its processing, providing required notices at or before collection, handling applicable consents and deciding whether to conduct marketing. GeoRest assists with requests concerning Customer-controlled information in accordance with the applicable agreement and law. For information GeoRest controls independently, GeoRest is responsible for the corresponding obligations.

We may generate statistical information that has been effectively anonymised and cannot reasonably identify an individual, for example aggregated delivery-performance measurements, and use it to operate, secure and improve the Services. Pseudonymised or otherwise identifiable information remains personal information and is handled accordingly.

3. Information we collect

We collect information that relates to an identified or identifiable person (“personal information”). Technical and usage information may be personal information when it identifies, or can reasonably be linked to, a person. Information that has been irreversibly anonymised so that individuals cannot reasonably be identified is not treated as personal information in this policy.

Depending on the Service and device settings, we may also process IP addresses, device identifiers, application and browser versions, diagnostic records, error logs and advertising identifiers where permitted by applicable platform rules and law. We do not assume that technical identifiers are anonymous merely because a person’s name is absent.

Location of couriers. Subject to device permissions, the courier app collects precise location during an active shift to assign, route and track deliveries, including when the app runs in the background. The app stops transmitting location after the courier ends the shift or signs out. Precise location records are deleted after several days; selected route points describing the main delivery path may be retained with delivery history for operational and dispute-resolution purposes. Depending on the data and its context, retained route points may still constitute personal information. Customers with authorised access may use location and route information to manage delivery operations, subject to applicable law.

4. How we collect information

• From you, when you register, place an order, fill in a form, contact support or use the Services.
• Automatically, from your device while you use the Services, including through cookies and similar technologies.
• From the Customer, for example when a Customer adds its staff or couriers to the Portal or imports its customer list.
• From third parties connected by the Customer, such as point-of-sale systems, third-party ordering platforms and delivery companies that send orders into the Services or report on their status.
• From sign-in and payment providers, such as Apple, Google or Facebook when you use them to sign in, and payment processors when they confirm a payment.

5. How we use information

Depending on our role under section 2, we process information for the following purposes:

• To provide the Services: receive and process orders, assign and route deliveries, show delivery status and run the Customer's loyalty program.
• To create and manage accounts, and to verify identity, including by sending one-time codes by SMS.
• To bill Customers, collect payments and issue invoices and receipts.
• To send service messages, such as order confirmations, delivery updates, push notifications and account notices.
• To send marketing messages on behalf of a Customer, where the Customer has obtained the consent required by law (see section 8).
• To provide support and respond to your requests.
• To maintain the security of the Services, and to detect and prevent fraud and misuse.
• To analyse service performance and improve the platform, including routing and delivery-estimation tools; where feasible, we use anonymised or aggregated information, and any processing of identifiable Customer-controlled information remains subject to the applicable instructions and legal requirements.
• To comply with law, enforce our agreements and defend legal claims.

For Customer-controlled information, GeoRest processes data to supply, support, secure and maintain the agreed Services, in accordance with the Customer’s instructions and applicable law. GeoRest may also process limited personal information as an independent controller where necessary for its own account administration, legal compliance, the establishment or defence of legal claims, and security or fraud-prevention activities for which it determines the purposes. Such independent processing is limited to what is lawful, necessary and proportionate.

6. Sharing information with third parties

We do not sell personal information. We disclose information where needed to provide the Services, under Customer instructions where applicable, or for the purposes identified below.

With the Customer. Customer-authorised personnel may access end-customer orders and contact details, and the activity and location of couriers associated with that Customer, according to their permissions and the relevant Service.

With service providers. We use vendors to support the Services, including the categories below. Their access is limited to the services they provide and is subject to applicable contractual, confidentiality and security requirements. Some vendors may operate in other countries (section 13):

A current list of relevant service providers or subprocessors may be requested by Customers, subject to legitimate security and confidentiality considerations.

With integrations selected by a Customer. When a Customer enables a delivery company, POS, marketplace, loyalty provider, payment provider or third-party ordering integration, we may transfer the necessary order or account details to that recipient. Depending on the arrangement, the recipient may be the Customer’s processor, GeoRest’s subprocessor or an independent controller. The Customer is responsible for its own integration choices and the notices or permissions those choices require; GeoRest remains responsible for its own legal obligations.

In other cases:

• to comply with law, a court order or a request of a competent authority;
• to enforce our agreements and investigate violations;
• to detect, prevent or address fraud, security or technical issues;
• to protect the rights, property or safety of GeoRest, our users or the public;
• to our affiliated companies, which must process it in line with this policy;
• in connection with a merger, acquisition, financing or transfer of assets, subject to appropriate safeguards and applicable law;
• with your explicit consent.

7. Payment information

Cards and digital wallets. Card and digital-wallet payments are processed by third-party payment providers. GeoRest does not receive or store complete payment card numbers (PAN) or card security codes (CVV). We may receive and store payment tokens, card brand, last four digits, expiry date and payment confirmations provided by the payment processor, where needed for payment administration and authorised repeat charges.

Bank account details (business users). If a business Customer provides bank details for billing or payment collection, we may store the bank name or number, branch number and account number and share the necessary details with the relevant collection or payment provider. These records are protected by encryption at rest and access controls.

Payment records. We keep records of charges, refunds, invoices and receipts as required by tax and accounting law (see section 9).

8. Marketing messages

Messages from a Customer. Customers may use the Services to conduct SMS, email and push campaigns. The Customer controls the audience, content, timing and purpose of its campaigns and is responsible for complying with section 30A of the Israeli Communications Law (Telecommunications and Broadcasting), 5742-1982, and any other applicable rules, including obtaining consent where required and honouring opt-out requests. GeoRest provides the technical delivery functionality on the Customer’s behalf.

Messages from us. GeoRest may communicate with business users and visitors about DelivApp products and updates where permitted by applicable law and where any required consent or other condition has been satisfied.

Opting out. Marketing communications will include or be accompanied by an applicable means of opting out. You may also contact the sending Customer or support@delivapp.com. Device settings may allow you to disable push notifications. Operational messages (such as authentication codes, order confirmations and delivery notices) are distinct from marketing, although they remain subject to applicable communications and privacy laws.

9. How long we keep information

We retain personal information for the period reasonably necessary for the relevant Services, the Customer’s instructions and agreement where applicable, and requirements such as security, accounting, legal compliance and dispute resolution. Actual periods vary by category, system and purpose. The following describes our current retention practices.

We handle requests to delete information in accordance with section 11 and applicable legal and contractual requirements. Data contained in backups may remain until the applicable backup rotation or expiry in accordance with our internal backup policy. Information that has been effectively anonymised may be used and retained for statistical purposes.

10. Security

We use organisational and technical safeguards appropriate to the nature of the information and our legal obligations, including encryption in transit, encryption at rest in our principal database infrastructure, role-based access controls, monitoring, backups, security updates and testing. No system can guarantee absolute security.

If a security incident involves personal information, GeoRest will investigate and respond under its incident-response procedures, cooperate with the relevant Customer and provide notifications to regulators or affected people where required by applicable law and according to the parties’ respective legal roles.

Electronic processing and transmission involve inherent security risks. Nothing in this Privacy Policy excludes or limits duties, remedies or liabilities that cannot lawfully be excluded or limited. Any contractual allocation or limitation of liability is governed by the applicable agreement, to the extent permitted by law.

11. Your rights

Subject to applicable law and the circumstances, individuals may have rights to:

• access the personal information about you held in a database (section 13 of the law);
• ask to correct or delete information that is incorrect, incomplete, unclear or out of date (section 14);
• ask to be removed from a database used for direct mailing, or to be not contacted with direct mailing (section 17F).

To submit a privacy request concerning GeoRest-controlled information, write to support@delivapp.com with the subject “Privacy request”. We may reasonably verify your identity and will handle requests within applicable statutory timeframes. Privacy rights are not unlimited and may be subject to lawful exceptions.

If your request relates to information controlled by a Customer, we may direct the request to that Customer or pass it to the appropriate contact and assist with the response where required by law or contract. You can also contact that Customer directly. We will not independently delete or change Customer-controlled records where doing so would conflict with the controller’s lawful instructions or another legal duty.

If you believe your rights have been infringed, you may file a complaint with the Privacy Protection Authority at the Israeli Ministry of Justice.

12. Cookies and similar technologies

We and our service providers may use cookies, local storage and similar technologies for authentication, shopping carts, preferences, security, performance measurement and analytics. Depending on the ordering channel, the Customer or a third-party service may also use such technologies under its own notice. Some identifiers and cookie-derived information may constitute personal information.

You can manage or delete cookies through your browser or device settings. On the DelivApp Website, you can also manage consent for optional cookies through the available cookie consent and preferences controls. Disabling certain cookies may affect some Services. Further information is available in our Cookies Policy: https://delivapp.com/cookies.

13. International transfers

Our principal cloud hosting and database infrastructure is located in Frankfurt, Germany. Other vendors, support services and Customer-selected integrations may process or access information in Israel or other countries. When personal information is transferred outside Israel, we take measures consistent with the Israeli Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001, and other applicable legal requirements, including appropriate contractual and organisational safeguards.

14. Children

The Portal and courier app are intended for persons authorised by the relevant business or delivery organisation. Our Services are not specifically directed at children. Customer-operated ordering channels are offered to the audience determined by the relevant Customer, who is responsible for applicable notices and parental consent requirements. If we become aware of processing of a child’s information contrary to applicable law, we will address the matter and, where appropriate, coordinate with the relevant Customer.

15. Changes to this policy

We may revise this policy from time to time. We will publish an updated version with its effective date and, where required by law or appropriate in view of the changes, provide additional notice through the Services or other available contact channels. Changes will not retroactively authorise processing that requires a separate legal basis or consent. Material changes will take effect as stated in the relevant notice, subject to applicable law.

16. Contact us

GeoRest Ltd. (DelivApp) | Company no. 515241263 | Keren Kayemet le-Israel 5, Rishon LeZion 7528403, Israel

General privacy requests: support@delivapp.com. Data Protection Officer: Michael Parshin (info@delivapp.com). We aim to respond within the periods required by applicable law.