How ShopZi handles your personal data.
This Privacy Policy explains what information ShopZi may collect, why it is used, who it may be shared with, how long it may be kept and the rights available to you.
Who we are
ShopZi is an online platform that connects customers with participating local businesses and supports ordering and delivery.
For personal data for which ShopZi determines the purposes and means of processing, the ShopZi operating business acts as the data controller.
Personal data we may collect
The information collected depends on how you use ShopZi.
| Category | Examples |
|---|---|
| Account data | Name, email address, telephone number, login/account identifiers, account preferences and linked social-login identifiers where you choose Google or Facebook sign-in. |
| Address and location data | Delivery address, saved addresses and location information you choose to provide to find nearby stores or support delivery. |
| Order data | Products ordered, stores used, fulfilment method, scheduled time where selected, order value, order number, timestamps, status, substitutions, cancellations, item-level refunds, redeliveries and support/resolution history. |
| Payment-related data | Payment status, transaction references and limited payment metadata received from payment providers. |
| Delivery data | Delivery address, driver assignment, pickup and delivery status, delivery timestamps, tracking information and, where used, QR/code verification or delivery-proof information. |
| Communications | Customer-store order messages, ShopZi support messages, photographs or proof images you upload, voice recordings you send, complaints and other order-related correspondence. |
| Social sign-in data | Where you choose Google or Facebook sign-in, ShopZi may receive an account identifier, name, email address and other basic profile information authorised by that provider. ShopZi does not receive your Google or Facebook password. |
| Technical and security data | IP address, device/browser information, session information, logs, security events and diagnostic data. |
How we use personal data
ShopZi may use personal data for purposes including:
- creating, maintaining and securing customer accounts;
- processing orders and showing order status;
- connecting an order with the relevant local business;
- arranging and supporting delivery;
- processing or recording payments, refunds and disputes;
- responding to questions, complaints and support requests;
- operating customer-store issue messaging, reviewing uploaded evidence and managing replacements, item refunds or redeliveries;
- detecting fraud, abuse, account compromise and other security risks;
- maintaining, troubleshooting and improving the platform;
- complying with legal, regulatory, tax, accounting or law-enforcement obligations where applicable; and
- sending service communications and, where permitted, marketing communications.
Lawful bases for processing
ShopZi must have a lawful basis under applicable UK data-protection law whenever it processes personal data.
Contract
Processing may be necessary to create or manage your account, process an order, provide delivery functionality or take steps you request before entering into a contract.
Legal obligation
Some information may need to be used or retained to meet legal obligations, including accounting, tax, regulatory or lawful disclosure requirements.
Legitimate interests
ShopZi may rely on legitimate interests where appropriate, for example to prevent fraud, protect the platform, investigate abuse, improve services or manage business operations, provided those interests are not overridden by your rights and freedoms.
Consent
Where consent is required, for example for certain optional marketing or non-essential technologies, you can withdraw that consent at any time without affecting processing already carried out lawfully.
Orders, local businesses, Collection and delivery
To fulfil an order, relevant information may need to be shared with each participating business involved in that order and, for Delivery, the delivery personnel involved. A two-store basket may therefore require order information to be processed in relation to both participating businesses.
This may include your name, the products relevant to that business, order details, fulfilment method, scheduled time where selected, delivery address where required, relevant contact information, delivery or collection instructions and order status.
Where an item is unavailable or an order issue is reported, ShopZi may process the affected product, quantity, original order price, proposed replacement, refund or redelivery status so the issue can be resolved and an audit/history of the resolution can be maintained.
Delivery information should only be made available to those who need it for delivery or related operational and support purposes.
Payments
ShopZi may use a third-party payment provider to process payments. The provider may collect and process payment information directly under its own privacy terms.
ShopZi should only retain the payment information needed for operating the platform, reconciling transactions, handling refunds or disputes and meeting legal obligations.
Order communications, service messages and marketing
Customer-store and support communications
ShopZi may process messages exchanged through order-specific customer-store or support channels. Depending on the feature you use, those communications may include text, photographs or proof images and short voice recordings. They may be used to investigate and resolve missing, incorrect, damaged or unavailable products, replacements, refunds, redeliveries, delivery problems, complaints, fraud or misuse.
The relevant participating business can access communications sent to it about its order. ShopZi authorised administrators may access communications where reasonably necessary for support, dispute handling, safety, fraud prevention, platform enforcement or legal compliance. Drivers only receive communications or information relevant to their delivery role where the applicable delivery flow provides it.
ShopZi may send push notifications, emails or other service communications necessary to operate your account or order, such as order confirmations, new message/reply alerts, replacement decisions, status updates, security notices or support responses.
Marketing
Marketing emails, texts or similar electronic messages will only be sent where ShopZi has a lawful basis and applicable electronic-marketing rules allow it. Where consent is required, ShopZi will request it. Where the law permits marketing to existing customers without separate consent, an appropriate opt-out must be provided.
Who we may share data with
ShopZi may share personal data where necessary with categories of recipients such as:
- participating stores, restaurants or other local businesses;
- delivery drivers or delivery-service providers;
- payment processors and fraud-prevention providers;
- identity providers such as Google or Facebook where you choose to use their sign-in service;
- hosting, infrastructure, email, communications, analytics or customer-support providers;
- professional advisers such as accountants, insurers or legal advisers;
- regulators, courts, law-enforcement bodies or other authorities where disclosure is legally required;
- a purchaser, investor or successor where the business or relevant assets are legitimately transferred, subject to applicable safeguards.
Service providers processing data on ShopZi's behalf should only process it under appropriate instructions and safeguards.
International data transfers
Some technology or service providers may process personal data outside the United Kingdom.
Where UK data-protection law requires safeguards for an international transfer, ShopZi will use an appropriate lawful transfer mechanism or rely on another permitted basis.
How long we keep personal data
ShopZi does not keep personal data for longer than reasonably necessary for the purpose for which it was collected, subject to legal, accounting, tax, fraud-prevention, payment, dispute, safety and security requirements.
Retention periods differ by data type. Active account data may be needed while an account remains open, while transaction and order records may need to be retained for longer. Order communications, uploaded proof images, voice messages and issue-resolution records may be retained for a period appropriate to customer support, chargebacks, complaints, fraud prevention and legal claims, then deleted or anonymised when no longer required.
When you request account or data deletion, ShopZi will delete or anonymise personal data where legally permitted. A deletion request does not necessarily require immediate deletion of records that ShopZi or a participating seller must retain for legal, tax, payment, fraud-prevention, dispute or regulatory purposes.
Security
ShopZi uses technical and organisational measures intended to protect personal data against unauthorised access, loss, alteration, disclosure or misuse.
Measures may include access controls, session protections, secure authentication, database controls, logging, encrypted connections and limiting access to information according to need.
No online service can guarantee absolute security. Users should keep account credentials confidential and notify ShopZi if they suspect unauthorised use.
Your data-protection rights
Depending on the circumstances and the lawful basis used, you may have rights including:
- the right to be informed about how your data is used;
- the right to request access to your personal data;
- the right to ask for inaccurate data to be corrected;
- the right to request erasure in circumstances where the law provides that right;
- the right to request restriction of processing in certain circumstances;
- the right to object to certain processing;
- the right to data portability where applicable;
- rights relating to certain solely automated decisions where applicable; and
- the right to withdraw consent where processing relies on consent.
Some rights are not absolute and may not apply to every type of processing.
Instructions for requesting deletion are available on the Data Deletion page. Removing ShopZi from Google or Facebook does not by itself delete your ShopZi account or all data held by ShopZi.
Cookies and similar technologies
ShopZi may use cookies or similar technologies for functions such as sessions, security, preferences and, where implemented, analytics.
Where consent is required for non-essential cookies or similar technologies, those technologies should not be used until the required choice has been obtained.
More information is available in the Cookie Policy .
Children's data
ShopZi is not intended to knowingly collect personal data from children in a way that would require parental consent without having the appropriate process in place.
If ShopZi becomes aware that children's personal data has been collected inappropriately, it should investigate and take appropriate action.
Changes to this Privacy Policy
ShopZi may update this Privacy Policy to reflect changes to the platform, legal requirements, data-processing activities or service providers.
Where a change is significant, ShopZi may provide an additional notice where appropriate.
Contact, rights requests and complaints
To ask a privacy question or exercise a data-protection right, contact ShopZi using the Contact page.
ShopZi may need to verify your identity before responding to a request involving personal data.
You also have the right to complain to the UK Information Commissioner's Office (ICO) if you are concerned about how your personal data has been handled.
Have a privacy question?
Contact ShopZi if you want to ask about your personal data or exercise a data-protection right.