Who we are (controller)
The data controller for the personal information described in this policy is Par & Par Limited, a company registered in Gibraltar with company number 111345. ZipCart is a business name of Par & Par Limited and is the storefront you order from; neither ZipCart nor Fast Commerce is itself a legal entity.
Par & Par Limited
8 Crutchetts Ramp
GX11 1AA
Gibraltar
Telephone: +350 200 60234
Information we collect
We collect information you provide when you create an account or place an order, including your name, phone number, email address, delivery addresses, order details and payment-related information.
How we use information
We use this information to operate ZipCart, process and deliver orders, communicate about orders and accounts, improve the service, prevent misuse, and send promotional communications when you have consented to them.
Blocking and fraud prevention
If we have to stop someone using ZipCart — for example because of abuse or threats towards our staff, fraud or chargebacks, refund abuse or unpaid orders — we keep a record of that decision. We do not keep the phone number itself: we keep a one-way code made from it with a secret key, which lets us recognise the same number if it is used to sign in or order again, even from a new account. A block has no set end date: it lasts until we lift it, or until an end date chosen for that block passes. Any staff note about the reason is deleted when the block ends, and the code is removed 18 months after the block ends; after that, the record shows only who placed and lifted the block, when and why. We rely on our legitimate interest in protecting our staff, customers and business, and you can ask us about, or object to, a block by writing to privacy@zipcart.delivery.
Location data
For customers, ZipCart uses delivery addresses and may request device location to help select an address, determine delivery coverage and estimate delivery times. It is not shared with third parties for advertising.
For drivers, ZipCart receives location while location sharing is enabled for delivery work. The latest position is stored in ZipCart's database and mirrored to Firebase. During an active delivery, the assigned customer's app can display that live position. It is also used for dispatch and operational maps. That latest position and the live-map entry are cleared when the driver goes offline and has no active assignment. ZipCart also keeps an internal history of the positions recorded during delivery work, so that authorised staff can investigate incidents and review delivery activity. That history is kept for 90 days from the time each position is recorded, and is then deleted.
Delivery-proof photographs
A driver may take a photograph as evidence of a delivery attempt or completed delivery. ZipCart stores these photographs in private Cloudflare R2 storage and gives authorised order, vendor and operational views time-limited access. Delivery photos are kept for 90 days as proof of delivery, and longer only if needed for a dispute or legal claim.
Who receives data
We do not sell personal data. We share it only where that is needed to provide and protect the service, with the companies listed below. Some of them handle it only on our instructions. Others also decide for themselves how they use part of it: for that part they are “independent controllers”, and their own privacy policies apply. Each of those is explained after the list.
- Stripe — payment processing (card, Apple Pay, Google Pay); card details are entered in Stripe's own payment form, and we do not store card numbers.
- Clerk — sign-in and account management.
- Twilio — one-time passcodes sent by SMS, or by WhatsApp where that option is offered.
- Google — Google sign-in, address suggestions, maps and reverse geocoding, and Android notification delivery. Google receives the account information you choose to share when signing in, the address text entered for suggestions, the coordinates submitted for geocoding, and Android device push tokens and notification content.
- Google Fonts — the fonts used by the zipcart.delivery website.
- Firebase — the assigned driver's live position during an active delivery.
- Algolia — product-search queries and search results.
- Expo — push-notification delivery, using a device push token and the notification content.
- Apple — Sign in with Apple, and iPhone notification delivery: your device push token and the title, body and data of notifications reach your iPhone through Apple.
- Cloudflare — storage and delivery of product images, purchase-order and goods-in attachments, and delivery-proof photos.
- Sentry — crash reporting and error diagnostics; known sensitive fields are removed before diagnostic events are sent.
- Resend — transactional email, such as order confirmations and receipts, using the recipient's email address and the message content.
- Neon — database hosting for account, order, delivery, support, wallet, staff, location and notification-token records.
- Hetzner — our server hosting in Europe. Our application servers run there, so the orders, accounts, addresses and messages the service handles pass through and are held on that infrastructure.
- Shopify — when an order comes from a connected Shopify store, that store's commerce platform and the source of the imported order details, which can include customer contact, delivery and order information.
- Anthropic — catalogue and purchasing assistance using product details, product and warehouse images, supplier documents and contact details, and vendor notes; customer accounts and customer orders are not sent to it.
We also share delivery details with the driver assigned to your order.
These companies handle part of your data on our instructions, or on a store's, and decide what happens to another part themselves:
Stripe processes your payment on our instructions, but it is also an independent controller of your card details, name, email address, billing address, device information and order details: it decides for itself to use them to detect and prevent fraud (including training its fraud-detection models), to manage financial and security risk, to meet its own legal obligations such as anti-money-laundering checks, and to improve its products, under Stripe's own privacy policy (https://stripe.com/privacy).
Clerk runs sign-in for ZipCart. It decides for itself how it uses your account details — your name, phone number and email address — as an independent controller under Clerk's own privacy policy (https://clerk.com/legal/privacy), not only on our instructions. The role and account references we attach to your sign-in so that our systems recognise you are different: Clerk handles those only on our instructions.
Twilio sends the one-time passcodes. It sends each passcode on our instructions, but it is also an independent controller of your phone number and the passcode message: it decides for itself to use them for its own purposes, including preventing abuse of its network, developing and improving its products, and business analytics, under Twilio's own privacy notice (https://www.twilio.com/en-us/legal/privacy).
Google delivers Android notifications on our instructions. For Google sign-in and Google Maps it is an independent controller: if you choose Google sign-in, Google checks your Google Account and shares your name and email address with us; when you search for or pin a delivery address, the text you type and the pin's coordinates reach Google Maps, as does your device's IP address when a Google map is shown, and Google may use and keep them to provide and improve its own products, under Google's Privacy Policy (https://policies.google.com/privacy).
When you visit the zipcart.delivery website, your browser loads its fonts from Google Fonts, which receives your IP address, browser details and the address of the page. Google is an independent controller of that request data; it says it uses it only to deliver the fonts and to keep the service secure, under Google's Privacy Policy (https://policies.google.com/privacy).
Expo delivers push notifications on our instructions. Its terms also make it an independent controller when it uses that data in aggregated or de-identified form to improve its own products, under Expo's own privacy policy (https://expo.dev/privacy).
If you choose Sign in with Apple, Apple checks your Apple Account to sign you in and to prevent fraud, and it is an independent controller of that account information under Apple's Privacy Policy (https://www.apple.com/legal/privacy/). Apple also delivers iPhone notifications. Its terms do not say whether it handles your device push token and the notification content only on our instructions, so we treat Apple as an independent controller of that data as well.
Resend sends our emails on our instructions, but it is also an independent controller of their delivery records — your email address as the recipient, and the sending logs: it decides for itself to use them to prevent fraud and abuse and to run its service, under Resend's own privacy policy (https://resend.com/legal/privacy-policy).
Shopify holds a connected store's orders on that store's instructions. Where the store has Shopify's cross-store features switched on, Shopify is also an independent controller of the customer's name, contact details, address, order details and device information: it decides for itself to use them for analytics, personalisation and advertising across Shopify stores, under Shopify's own privacy policy (https://www.shopify.com/legal/privacy/consumers).
Retention and your rights
We keep personal data for as long as it is needed for the purpose it was collected for, and for as long afterwards as we are required to keep it to settle disputes and refunds and to meet our accounting, tax and other legal obligations. Where we no longer need data for those purposes, we delete it or remove the details that identify you.
Account information is retained while an account is active. Order and delivery records are kept for 6 years as accounting records. The specific delivery-proof period is stated above. You may ask to access, correct or delete your personal data; legal and operational retention requirements may limit what can be deleted immediately. You also have the right to complain to the Gibraltar Regulatory Authority, which supervises data protection in Gibraltar.
Minimum age
ZipCart is only for people aged 18 or over, and we do not knowingly collect personal information about anyone younger.
Governing law
This policy is governed by the laws of Gibraltar.
Contact
We publish two email addresses and they are not interchangeable. For privacy questions and data-protection requests — access, correction, deletion, portability, or withdrawal of consent — email privacy@zipcart.delivery, which is the address monitored for those requests. For anything else, email info@zipcart.delivery.