Privacy policy

Last updated: 19 September 2026

This page explains what Gozzy collects about you, why, who else sees it, how long we keep it, and what you can ask us to do with it. It covers everyone who uses Gozzy: people who order food, drivers and people applying to drive, and restaurants and their staff.

Who we are

Gozzy is run by GOZZY LTD, a company registered in England and Wales (company number 17456685), registered office 7 Baring Street, Plymouth, England, PL4 8NF. We are the data controller for the information described here. You can reach us at [email protected].

If you order food

What we collect

• Your account: name, email address, phone number and password (kept only as a secure hash, never as the password itself). If you sign in with “Continue with Google”, Google gives us your name and email address.
• Your delivery addresses, and any notes you leave for the driver.
• Your location, only while the app is open and only if you allow it. Used to show restaurants near you and to work out the delivery fee. We do not track you in the background.
• Your orders and payments: what you ordered, from where, when, and how you paid. Card details go straight to Stripe; we never see your full card number.
• The door code and delivery photos. Each delivery has a short code you give the driver. If you choose “Leave at the door”, the driver photographs where they left your food.
• Messages you send your driver or our support team, and any photos you attach.
• Reviews, ratings and feedback you give us, and the restaurants you save as favourites.
• Your profile photo, if you add one.
• Notifications we send you, and a code that lets us reach your phone with them.
• How checkout went: which steps you reached, so we can find where orders get stuck.
• Technical data: your IP address and basic information about your device, which our servers and our security provider see when you connect.

Why, and on what legal basis

• To take and deliver your order and run your account - because it is needed for our contract with you.
• To keep Gozzy safe and working - preventing fraud and abuse, settling disputes about deliveries and refunds, fixing faults and improving the service - because we have a legitimate interest in doing so, weighed against your rights.
• To keep accounting records - because the law requires it.
• Offers, and your location - only with your consent, which you can withdraw at any time.

Offers

We only send you offers from restaurants if you turn on Offers & deals - in the app under Notifications, or in your account on the website. It stays off until you turn it on. When it is on, you get at most three offers in any ten hours, chosen partly by the restaurants you have ordered from or saved. You can turn it off at any time. We do not send marketing emails or text messages.

If you drive with Gozzy

What we collect

• Your application and account: name, contact details, home address, date of birth, next of kin, your vehicle and its registration, insurance and MOT documents, and a photo of your ID.
• Checks: your right to work in the UK (how it was checked, the document type and number, your share code and the expiry date) and, where we ask for one, the level, number and date of your DBS certificate - not what the certificate says.
• To pay you, and for tax: bank details, National Insurance number, UTR, and your earnings and statements.
• While you are working: your location while you are online and during deliveries, the delivery photos you take, your shifts and deliveries, your messages, and any complaints about a delivery.

Why, and on what legal basis

• To decide on your application, offer you deliveries, pay you and work with you - needed for our contract with you.
• Right-to-work checks and tax records - required by law.
• Safety, preventing fraud and settling disputes about deliveries - our legitimate interests. Information about DBS checks is handled under the conditions set by the Data Protection Act 2018.

Deliveries are offered to drivers automatically, based on distance and who is available. If an insurance, MOT or right-to-work document you gave us expires, your account is paused automatically until you upload a new one. You can always ask a person to look again at a decision about you: write to [email protected].

If you run a restaurant on Gozzy

We collect the names, email addresses and phone numbers of the owner and the staff who use the Gozzy panel, the details we need to pay the restaurant, and the messages between the restaurant and us. This is needed for our contract with the restaurant, and for our legitimate interest in running the platform.

Who we share it with

• The restaurant you ordered from: your first name, your order and your notes.
• Your driver: your first name, delivery address and phone number, until the order is delivered.
• Companies that provide services to us. They may use your data only to do that work for us:
  • Stripe - card payments.
  • Google - maps, address search and delivery routes (your delivery address is sent to work out the route and the fee); notifications to your phone through Firebase (a code for your phone and the text of the notification); sign-in, if you choose “Continue with Google”; and translating messages sent to our support team.
  • DeepL - translating messages sent to our support team.
  • Cloudflare - protects and delivers our website, and sees IP addresses.
  • One.com - sends our emails.
  • A UK text-message gateway - sends our text messages about orders and receives your replies.
  • Telegram - our staff receive work alerts there, which can include a driver applicant's name, phone number and vehicle, and text-message replies sent to us.
  • postcodes.io - looks up UK postcodes; only the postcode is sent.
• The police, HMRC or other authorities, when the law requires it.
• A buyer, if Gozzy or its business is ever sold - and only under this same policy.

We do not sell your data, we do not use advertising trackers, and we do not share your data with advertisers.

Outside the UK

Some of these companies process data outside the UK, for example in the European Economic Area or the United States. Where that happens, the transfer is covered by UK adequacy regulations (such as those for the EEA, and the UK-US Data Bridge) or by the contract terms approved for transfers out of the UK.

Deleting your account

You can delete your account from Profile → Delete account in the app, or from this page without the app. Your name, contact details, addresses, photo, reviews and notifications are removed.

Past orders are kept with your details stripped out. UK tax law requires businesses to keep sales records for six years, and each order is also a record for the restaurant and the driver who were paid for it.

How long we keep things

Two different rules apply, and they do not conflict. Anything that identifies you is kept only as long as we need it. The figures from a sale are kept as long as HMRC requires, because they are accounting records.

• Delivery photos taken by drivers: 7 days.
• Where the driver's phone was during a delivery: 90 days, then deleted. We keep it that long only so we can settle a dispute about whether a delivery arrived. After that the map of the journey is gone; the delivery's times and distance stay, because they are figures, not a record of anybody's movements.
• Chat with your driver: 6 months, then deleted.
• Messages between us and a restaurant: 1 year, then deleted.
• Your order history: 1 year. After that the order leaves your account and we strip everything personal from it - your address, your notes to the driver, the door PIN. What stays is the date, the items and the amounts, with nothing that points to you.
• Those stripped figures: 7 years, then deleted for good. Six years is what HMRC requires; the seventh covers the fact that the clock starts at the end of the accounting year, not on the day you ordered.
• Photos you send to our support team: 30 days.
• Drivers' earnings statements: 3 years.
• Driver documents and checks: while you drive with us, and afterwards only as long as the law requires (for a right-to-work check, two years after you stop).
• Everything else in your account - addresses, profile photo, reviews, favourites and notifications: until you delete your account.

Cookies and storage

The website keeps your sign-in, your basket and your settings in your browser, and the app keeps them on your phone. Gozzy needs them to work, and we do not use them to follow you around other sites. Cloudflare may set a small security cookie to tell people from bots. We do not use advertising or analytics cookies.

Children

Gozzy is for people aged 18 and over. We do not knowingly collect data about children. If you think a child has an account, tell us and we will delete it.

Keeping it safe

Everything you send us travels encrypted. Passwords are kept only as secure hashes. Our staff see only what they need for their job, and our main server is in the UK.

Your rights

Under UK GDPR you can ask us for a copy of your data, ask us to correct it or delete it, ask us to limit how we use it, object to how we use it (including to offers, at any time), and ask for the data you gave us in a common format, for you or for another company. Where we rely on your consent, you can withdraw it at any time. Write to [email protected] and we will answer within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would like the chance to put it right first.

Changes to this policy

When we change this policy, we update the date at the top. If a change affects you in a big way, we tell you in the app before it applies.

Terms and conditions

Questions? [email protected]

GOZZY LTD · Registered in England and Wales, company number 17456685 · Registered office: 7 Baring Street, Plymouth, England, PL4 8NF

Proudly Crafted in Plymouth · United Kingdom