Drive & Go — Privacy Notice
For users of the app
Effective from 5 October 2026 · Version 1.0.2
This notice explains what personal data we process when you use the Drive & Go app: why and for how long, who we share it with, and what rights you have. In this notice, "GDPR" means the European Union's General Data Protection Regulation (Regulation (EU) 2016/679). This notice is also available in Hungarian (Adatkezelési tájékoztató).
1. Who processes your data?
Controller: Jonatan Korlátolt Felelősségű Társaság (Jonatan Kft.), the operator of the Drive & Go service
- registered office and postal address: Tulipán utca 23., 2011 Budakalász, Hungary
- company registration number: Cg. 13-09-239456 (registered by the Company Registry Court of the Budapest Környéki Törvényszék)
- tax number: 26793656-2-13
- e-mail: support@drivengo.hu
We have not appointed a data protection officer. For data protection questions, you can reach us at the e-mail address above.
2. In short
- We process the data needed for ordering (account, phone number, licence plate, billing details, order, payment, location during an active order) to perform our contract with you — without it you cannot order.
- We collect usage statistics and error reports from your phone only with your consent. If you do not consent, the app and ordering work exactly the same, and you can withdraw your consent at any time.
- We do not sell your data. The Partner (the shop you order from) sees only what is needed to hand over your order.
3. What data, why, on what legal basis, for how long?
| Data | Purpose | Legal basis | How long we keep it | |
|---|---|---|---|---|
| A | Account: e-mail address, name (if you give it, or if Apple or Google passes it on), sign-in identifier | your account and signing in | performance of a contract — GDPR Art. 6(1)(b) | until the account is deleted |
| B | Phone number | so that the Partner can contact you about your order | performance of a contract — GDPR Art. 6(1)(b) | until the account is deleted |
| C | Licence plate and country code, saved vehicles | identification at handover | performance of a contract — GDPR Art. 6(1)(b) | saved vehicle: until you delete it, at the latest until the account is deleted; plate recorded on an order: as row D |
| D | Order: the Partner, the Products, the amounts, times and statuses, the licence plate, your note to the Partner | performing the order, accounting, handling complaints and disputes | performance of a contract — GDPR Art. 6(1)(b); legal obligation — GDPR Art. 6(1)(c) | order data: 5 years after the order; accounting documents: 8 years |
| E | Location while browsing: if you have allowed location access, your current location | to show nearby Partners by distance | at your request, before entering into a contract — GDPR Art. 6(1)(b) | not saved to your account; it may remain in the server log together with the request (row M) |
| F | Location during an active order (from the Partner's acceptance until handover): while the app is open, the Partner sees on a map where you are; if you have given "Always" permission, in the background we only detect that you have arrived at the pickup point; we calculate your expected arrival time from your location and show it to the Partner; if you drive away from the pickup zone, the Partner is alerted and the order may close automatically | organising the handover | performance of a contract — GDPR Art. 6(1)(b) | location saved with the order: at most 30 days after the order is closed, or, if there is a complaint or dispute, until it is closed |
| G | "I'm here" button: every press is logged | preventing misuse and, in a dispute, proving that you arrived | legitimate interest — GDPR Art. 6(1)(f): filtering out false arrival signals and resolving disputes | as row D |
| H | Payment: payment identifier, payment result, refunds; your card, if you save it. Your card details are handled by Stripe; we do not see them. | payment, refunds, making your next payment easier | performance of a contract — GDPR Art. 6(1)(b); legal obligation — GDPR Art. 6(1)(c) | payment data: as row D; saved card: until you delete it; when you delete your account, we also delete it at Stripe within 30 days at the latest |
| I | Billing details: full name, country, postcode, city, address; for a company invoice, the company name and tax number | issuing the invoice; we save them in your account for your next order | legal obligation — GDPR Art. 6(1)(c) (the invoice); performance of a contract — GDPR Art. 6(1)(b) (saving) | in the account: until you change them, at the latest until the account is deleted; on an issued invoice: 8 years; recorded on the order: as row D |
| J | Customer service: complaints, refund requests, correspondence | handling complaints | legal obligation — GDPR Art. 6(1)(c) | the complaint and our answer: 3 years |
| K | Notifications: identifiers for notifications and Live Activities, the app's language | order notifications | performance of a contract — GDPR Art. 6(1)(b) | while your phone's identifier is valid, at the latest until the account is deleted |
| L | Ratings: stars and — if you write one — a written comment on the service and the Product | monitoring the quality of Partners | legitimate interest — GDPR Art. 6(1)(f): enforcing quality requirements | until the account is deleted; on deletion the written comment is deleted, the stars remain without your personal data |
| M | Security and error logs on the server: the time and URL of the request (when browsing, this may include your location), your IP address, your account's internal identifier and error details — without your name and the content of your order | security, stable operation | legitimate interest — GDPR Art. 6(1)(f): security and operability of the service | at most 90 days |
| N | Usage statistics and error reports from your phone: which screens you view and for how long, which buttons you press (for example cart, payment, favourite), what you search for, how you answer permission requests, and the app's crash and error reports, which may contain the steps before the error — including requests sent to the server and, when browsing, your location. We link the usage statistics to your account's internal identifier (the error reports we do not), but not to your name, e-mail address, phone number or address, and we do not combine them with these. | improving the service and fixing its errors | consent — GDPR Art. 6(1)(a); section 155(4) of Hungarian Act C of 2003 on Electronic Communications | raw data for 90 days, after that only in aggregate form, not linkable to your account |
| O | Proof of your consent: time, version of the text, your choice | to be able to prove consent | legal obligation — GDPR Art. 6(1)(c), Art. 7(1) | as long as we process data based on the consent, then for 5 years |
Aggregate statistics: from requests that reach the server anyway (for example search, cart, starting a payment), we may also produce aggregate counts without any user identifier. This is not personal data.
4. Do you have to provide the data?
Your phone number, licence plate and country code, and billing details (section 3, rows B, C and I) are a condition of ordering: without them you cannot order. Consent to usage statistics (row N) is voluntary; if you do not give it, the app and ordering work exactly the same. You can browse and order without allowing location access; in that case you use the "I'm here" button when you arrive.
5. Who receives your data?
5.1. The Partner you order from: the content of the order and your note, your name and phone number, your licence plate, your billing details (for the receipt or invoice for the Product), during an active order your location on a map and your expected arrival time (section 3, row F), and the star rating you gave for that order (the Partner's interface currently shows only whether you rated). The Partner does not receive the text of your rating; on the Partner's profile, the average of the stars appears without your name. The Partner is responsible for this data as an independent controller and may use it only to hand over your order and for the receipt or invoice for the Product.
5.2. Stripe, to process the payment (section 6).
5.3. Authorities, if the law requires us to disclose data.
5.4. Our processors (section 6).
6. Processors and transfers
6.1. Our processors. These companies process your data on our behalf and on our instructions:
| Processor | What we use it for | Where it processes the data |
|---|---|---|
| Supabase Pte. Ltd. (Singapore) | database and sign-in: the app's data is stored here | in the European Union (Frankfurt); the provider may also access it from outside the EEA |
| Render Services, Inc. (USA) | running our server, the server log (section 3, row M) | also in the USA |
| Stripe Payments Europe, Limited (Ireland) | payments, saved cards, refunds and payment receipts | also in the USA (Stripe, LLC) |
| 650 Industries, Inc. (Expo, USA) | delivering notifications (the text of the notification, for example the Partner's name and the expected time, the order and notification identifiers) and updating the app (your phone's random identifier and IP address) | USA |
| Functional Software, Inc. (Sentry, USA) | error reports: from your phone only with your consent (row N), from the server when an error occurs (row M) | in the European Union and the USA |
| Mapbox, Inc. (USA) | during an active order, calculating your expected arrival time from your location and the Partner's location, without your name or order identifier | USA |
| Google Cloud EMEA Limited (Ireland) | customer service e-mail (support@drivengo.hu) | also outside the EEA (Google LLC, USA) |
The data export and sign-in related e-mails (for example password reset) are delivered to you by an e-mail delivery provider.
6.2. Other providers that receive data while the app works. Apple (Apple Distribution International Limited, Ireland) provides Sign in with Apple, the delivery of notifications and Live Activities — a Live Activity shows the order status, the expected time, the Partner's name and your licence plate — and the map (Apple Maps). If the app offers Google sign-in and you choose it, Google (Google Ireland Limited) receives data for signing in. They process this under their own privacy terms.
6.3. Transfers outside the EEA. For those processors listed in 6.1 that are outside the EEA or also transfer data there, your data is protected by the European Commission's adequacy decision on the EU–US Data Privacy Framework (Implementing Decision (EU) 2023/1795) where the receiving US company participates in the Framework, and otherwise by the standard contractual clauses (SCCs) adopted by the European Commission. For Supabase, the standard contractual clauses apply. You can request a copy of the safeguards at support@drivengo.hu.
7. Your rights
7.1. You can ask for access to your data, for it to be rectified or erased, or for its processing to be restricted, and you can ask for the data you provided in a machine-readable format (data portability).
7.2. RIGHT TO OBJECT. You can object at any time, on grounds relating to your particular situation, to processing based on legitimate interest (section 3, rows G, L and M). We then stop processing the data, unless there are compelling legitimate grounds that override your interests, rights and freedoms, or the data is needed to establish, exercise or defend legal claims.
7.3. You can withdraw your consent at any time — consent to usage statistics by writing to support@drivengo.hu, and location and notification permissions in your phone's (iOS) Settings. Withdrawal does not affect the lawfulness of earlier processing.
7.4. We answer your request within one month; where justified, this can be extended by two further months, in which case we tell you within one month. You can submit requests to support@drivengo.hu. In the app, you can request a copy of your data under Profile → Export my data, and delete your account under Profile → Delete account. Section 3, rows D, F, G, H, I, J, L and M explain what is kept after deletion and for how long.
7.5. Automated decision-making — including profiling — that produces legal effects concerning you or similarly significantly affects you does not take place.
8. Complaints and remedies
8.1. You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (NAIH): Falk Miksa utca 9–11., 1055 Budapest; postal address: Pf. 9., 1363 Budapest; e-mail: ugyfelszolgalat@naih.hu (according to NAIH, proceedings cannot be started by e-mail); phone: +36 1 391 1400; website: naih.hu.
8.2. You can also go to court; you may bring the case before the regional court (törvényszék) for your place of residence or stay.
9. Data security
We transmit data over encrypted connections, limit access by role, and do not store payment card details — Stripe handles them.
10. Children
Only persons aged 18 or over may use the Drive & Go app.
11. Changes to this notice
We tell you in the app when this notice changes. If we wanted to use data for a purpose other than the one it was collected for, we would tell you about it, with the related information, in advance.
12. Cookies and data stored on your phone
The app does not use browser cookies. We store the following on your phone:
- data needed for the app to work: your sign-in, the content of your cart, your licence plate, your settings, the identifiers needed for an active order and for location sharing, and the identifier needed for notifications. Without these, signing in, the cart, ordering and notifications would not work;
- data for usage statistics: a random identifier, events not yet sent, and your consent choice (section 3, rows N and O). We use the identifier and the events only with your consent.
The Drive & Go legal and support web pages do not use cookies and do not track visitors; the hosting provider serving the website may log visitors' IP addresses for security purposes.