Privacy Policy

Privacy Policy

Last updated: 26 October 2026.

1. Data controller

Data controller: GXN Services (sole proprietorship of Ghassan Shouman), Wildhagen 104, 33619 Bielefeld, Germany. Email: info@cedargo.app. Telephone: +96179079390.

2. Data categories

We may process contact and account data, delivery addresses, order history, COD records, support cases, marketing preferences, delivery confirmation/OTP events, security logs, order reviews and user-generated Discover content.

3. Allergy and health data

Allergy notes are retained only for the relevant order and accessible solely to the relevant vendor and authorized support as necessary. No permanent allergy profile is kept.

4. Purposes

We process data for account operation and verification, orders, vendor/driver coordination, COD and settlements, complaints, fraud prevention, food safety and security. Operational analytics are aggregated where feasible; behavioral personalized offers are not part of the current setup.

5. Lawful grounds

Not all processing depends on consent. We rely on contract performance, proportionate legitimate interests, legal obligations, and consent where required (for example marketing and special-category allergy data).

6. Sharing and visibility

Vendors and drivers receive only order/address details necessary for their roles. Allergy notes are restricted to the relevant vendor and authorized support. In-app calling is preferred where available.

7. Driver location

Driver location is tracked during active assignments for operations, support and safety. Access is restricted. Detailed location points are erased when operational and legal necessity ends.

8. Hosting and international transfers

Data may be processed or stored with providers in Lebanon or elsewhere under appropriate contracts and safeguards. Where GDPR applies, approved international-transfer mechanisms are used as needed.

9. Vendors and processors

We use service providers for hosting, messaging, necessary analytics and support under appropriate processing terms. A list of material processors is available on request at info@cedargo.app.

10. Marketing and notifications

Marketing emails require a separate optional opt-in at registration. Promotional WhatsApp/SMS messages go only to users who opted into that channel. Transactional order alerts are distinguished from marketing, and marketing preferences may be withdrawn at any time.

11. Cookies and SDKs

We use technologies necessary to run the website and app. Non-essential technologies follow applicable consent/notice rules.

12. Data subject requests

Access, correction and erasure requests may be sent in-app, through support or by email, after identity verification. Requests are logged and retention/deletion decisions explained as appropriate, within applicable statutory deadlines.

13. Retention and deletion

Order and invoice records are retained as legally required; unnecessary data is erased once no longer needed. Health incident records follow a legally justified retention schedule.

14. Security and incidents

An incident team (administration and technical lead) contains, investigates, logs and assesses any legally required supervisory-authority or individual notifications within applicable deadlines.

15. Minors

The platform is intended for people who can enter into a binding contract. Minor accounts are not permitted without parental consent where required by law.

16. Updates and contact

This policy is published in Arabic and English with its latest-update date. Contact: info@cedargo.app / +96179079390.