Français · English

DAVAD Privacy Policy (Europe)

Effective: 2026-08-25 · Version 1.1 (EU) · Applies to users in the EU, the EEA, the United Kingdom, and Switzerland · Version française

1. Data controller

Gomiamm, société par actions simplifiée à associé unique au capital de 1 000 euros, immatriculée au RCS de Paris sous le numéro 106 670 201, dont le siège social est situé 66 avenue des Champs-Élysées, 75008 Paris, France, is the controller ("responsable du traitement") of the personal data processed through the DAVAD consumer app (food delivery and VTC ride booking), the DAVAD Livreur courier app, the DAVAD Chauffeur VTC driver app, the DAVAD Pro partner portal, and gomiamm.com (the "Services") for users in Europe.

For any question about this policy or about how we handle your data, contact privacy@gomiamm.com.

2. Personal data we collect

From all users

• Account data — email address, password (stored hashed), name, phone number, preferred language.
• Device and log data — IP address, device model, operating-system version, app version, language, time zone, crash reports, and timestamps of in-app actions.
• Communications — messages you send to support and in-order chat between customers and drivers.

From customers

• Order data — restaurant chosen, items, quantities, prices, tips, special instructions.
• Delivery address — street address, city, postal code, and (if you tap "Use current location") coordinates — see Section 6.
• Payment data — processed by our PCI-DSS payment provider; we receive only the last four digits, brand, and expiry of your card, never the full number or CVC.
• Ratings and reviews you leave for restaurants and drivers.

From passengers booking a ride (VTC)

• Journey data — pickup address and coordinates, destination address and coordinates, any intermediate stops you add, the vehicle category you choose, and the estimated distance and duration.
• Timestamps of the ride — when it was requested, when a driver was assigned, when the driver arrived, when the ride started, and when it completed or was cancelled (with the cancellation reason).
• Fare data — the quoted fare, any tip, and the currency. Payment itself is handled by our PCI-DSS payment provider on the same terms as above: we never receive your full card number or CVC.
• Safety PIN — a short code generated for each ride so you can confirm you are entering the right vehicle.
• Ratings you leave for the driver.

Your journey history is personal data about your movements. We treat it accordingly: it is disclosed to the assigned driver for the ride they are performing, and otherwise used only for the purposes in Section 4.

From delivery drivers and couriers

• Identity and eligibility — date of birth, address, and identity / right-to-work documents where legally required to operate as a delivery partner.
• Vehicle information — type, registration, insurance proof, and expiry dates.
• Real-time location while online, including in the background — see Section 6.
• Earnings and payouts — completed deliveries, ratings, payout amounts, and the payment details you enter for payouts.

From VTC drivers

A VTC driver is an independent professional, so we process the data that French law requires us to hold before a driver may carry passengers through the platform:

• Professional licence — VTC card ("carte professionnelle VTC") number and expiry date, and proof of registration in the register of VTC operators (REVTC).
• Business identity — SIRET / SIREN and Kbis, and the business name and address, which we verify against the INSEE Sirene register. Where applicable, the VAT number and VAT status.
• Driving entitlement and insurance — driving licence (including that it has been held for the minimum period required), professional liability insurance (RC Pro) and vehicle insurance, with their expiry dates.
• Vehicle — make, model, year, colour, registration plate, and the resulting vehicle category.
• Real-time location while online, including in the background — see Section 6.
• Ride and earnings history — completed rides, ratings, fares, platform fee, net earnings, tips, and the payout details you provide.

Identity and eligibility documents are used to verify that you may lawfully drive, and to satisfy our own legal obligations as an intermediary. They are not used for any other purpose.

From restaurant partners

• Business information — legal name, trading name, VAT / company registration number, business address, contact details, cuisine type, hours.
• Contract data — signature, signatory name and role, IP address and timestamp captured when the partner signs the Gomiamm Restaurant Partner Agreement.
• Payout details provided through the partner dashboard.

3. Legal bases for processing (Article 6 GDPR)

• Performance of a contract (Art. 6(1)(b)) — creating and authenticating your account, taking and delivering your orders, processing payments and payouts.
• Compliance with a legal obligation (Art. 6(1)(c)) — tax, accounting, and consumer-protection record-keeping.
• Legitimate interests (Art. 6(1)(f)) — securing the Services, preventing fraud and abuse, and improving the Services through aggregated, de-identified analytics, balanced against your rights and freedoms.
• Consent (Art. 6(1)(a)) — optional marketing communications, non-essential cookies, and access to device features such as precise location. You may withdraw consent at any time without affecting prior processing.

4. Why we process your data

• Create and authenticate accounts.
• Match customers with nearby drivers and dispatch orders to restaurants.
• Match passengers with nearby VTC drivers, quote the fare, and dispatch the ride.
• Calculate ETAs, share live driver location with the customer or passenger during a delivery or ride, and confirm correct delivery or drop-off.
• Verify that a VTC driver holds a valid VTC card, REVTC registration, insurance, and business registration before carrying passengers.
• Process payments to restaurants and payouts to drivers.
• Issue ride receipts and invoices, and report platform earnings to the tax authorities — see Section 11.
• Detect and prevent fraud, abuse, and unsafe behaviour.
• Comply with tax, consumer-protection, passenger-transport, and food-safety obligations.
• Send order updates and, with your consent, marketing communications.

5. Recipients and processors

We disclose personal data only to the recipients below, each acting as a processor under a data-processing agreement (Art. 28 GDPR) unless stated otherwise, and only as necessary for the stated purpose.

We do not sell your personal data and we do not share precise location with advertisers.

6. Location data

• Customer and passenger app — foreground only. Used when you tap Use current location to set a delivery address or a ride pickup point. No background collection.
• Driver and courier apps — continuous while you are online, including in the background. This is the most significant collection we carry out, so we describe it precisely:
  • When it starts. Only when you place yourself online in the app. Going online asks for the foreground location permission and then for the "Always" (background) permission. Nothing is collected before you go online, and nothing is collected if you decline the foreground permission.
  • What happens while you are online. Your device sends its position roughly every 3 seconds — latitude, longitude, heading, and speed — and it keeps sending while the app is in the background and while the screen is locked. On Android this runs as a foreground service with a permanent notification ("DAVAD Chauffeur VTC — en ligne"); on iOS the system displays the blue background-location indicator. If you grant the foreground permission but refuse the "Always" permission, collection continues only while the app is on screen.
  • Why. To offer you the rides and deliveries nearest to you (a driver whose position has gone stale is removed from dispatch), to let the passenger or customer follow the approaching vehicle in real time, to compute ETAs and fares, and to resolve disputes about what actually happened during a job.
  • When it stops. The moment you go offline, and on sign-out. Both stop the background task itself, not merely the display — after that your device sends nothing at all. A stale online state is also cleared automatically by a server-side job. You can additionally revoke the permission at any time in your device settings, which stops collection immediately and takes you out of dispatch.
  • What we do not do. We do not track drivers or couriers while they are offline, we do not collect location when the app is not running and you are offline, and we never share precise location with advertisers.
• Retention. Per-second pings are kept for the duration of the active delivery or ride; an aggregated route is kept for up to 90 days for dispute resolution and passenger-safety investigations, then the per-second points are deleted.

7. Camera and photos

The apps and partner portal access the camera or photo library only for explicit upload flows: driver onboarding documents (where applicable) and the restaurant partner's drawn signature. We do not access your camera or photos outside these flows.

8. Push notifications

If you grant the notification permission, we register a push token (via Expo Push to Apple APNs / Google FCM) to deliver order updates and account or dispute notices. You can disable notifications at any time in your device settings; legally required operational notices will still be sent by email.

9. International data transfers

Some of our processors (for example our hosting and payment providers) operate infrastructure outside the European Economic Area, including in the United States. Where personal data is transferred outside the EEA (or the UK), we rely on the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) — and, for the UK, the UK International Data Transfer Addendum — together with any additional safeguards required, to ensure an adequate level of protection. You may request a copy of the relevant safeguards by emailing privacy@gomiamm.com.

10. Data retention

• Account data and order history: kept while your account is active and for the period required by applicable tax and accounting law (generally up to 10 years for invoicing records in France) — after which the data is deleted or anonymised.
• Driver location: per-second points up to 90 days; aggregated route summaries retained for dispute resolution.
• Ride history and receipts: kept for the period required by French tax and accounting law (generally 10 years for invoicing records), because a receipt issued in the driver's name is an accounting document for that driver as well as for us.
• VTC eligibility documents (VTC card, REVTC, insurance, licence, Kbis): kept while you are an active driver and for the retention period required to evidence that we verified your eligibility, then deleted.
• DAC7 reporting records: kept for the period required by the reporting rules (see Section 11).
• Restaurant contracts: kept for the term of the agreement and for the legally required retention period after termination.
• Marketing-consent records: kept for 3 years from the last contact.

11. Receipts, invoicing, and tax reporting

Receipts issued in the driver's name. For VTC rides, Gomiamm acts as a transparent intermediary: the transport contract is between you and the driver, and we issue the receipt in the name and on behalf of the driver. The receipt therefore carries the driver's business identity — business name, address, SIRET, and VAT number where the driver has one — alongside the fare and the journey. This disclosure of the driver's professional data to the passenger is required for the receipt to be a valid invoice; it is processed under Article 6(1)(c) GDPR (legal obligation). Where the driver benefits from the French VAT exemption for small businesses, the receipt states "TVA non applicable, art. 293 B du CGI" and shows no VAT amount.

Turnover tracking. Because we hold the turnover a driver earns through the platform, we monitor it against the French VAT-exemption thresholds and inform the driver when a threshold is crossed, and we date that change. We do this to comply with our own obligations as a platform (Art. 283 bis of the French tax code) and under Article 6(1)(c) GDPR. We do not give tax advice.

DAC7 reporting. As a digital platform, we are required under Council Directive (EU) 2021/514 ("DAC7"), as transposed into French law, to report certain information about sellers and service providers who earn through the platform. For drivers and restaurant partners, this means reporting identity and business-identification data (name, address, date of birth or business registration number, VAT number where held), the financial account used for payouts, and the consideration paid and fees charged in each reporting period. We report this to the French tax administration, which may exchange it with the tax authority of your Member State of residence. We also provide each driver with their own annual DAC7 summary before 31 January. This processing is a legal obligation under Article 6(1)(c) GDPR; you cannot object to it, but your rights of access and rectification apply to the data we report.

12. Your rights

Under the GDPR (and, in the UK, the UK GDPR) you have the right to:

• Access your personal data and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten"), subject to our legal retention obligations.
• Restrict or object to processing, including processing based on legitimate interests and any direct marketing.
• Data portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time where processing is based on consent.
• Not be subject to a decision based solely on automated processing producing legal or similarly significant effects.
• Define instructions on the fate of your personal data after your death (Article 85 of the French Data Protection Act).

To exercise any of these rights, email privacy@gomiamm.com. We respond within one month, extendable by two further months for complex requests (Art. 12(3) GDPR).

13. Children

The Services are intended for adults (18+) and are not directed to children. We do not knowingly collect data from minors; where consent is the legal basis, we observe the minimum digital-consent age set by your country (15 in France under the French Data Protection Act).

14. Security

We protect personal data with TLS in transit, encryption at rest, role-based access controls, audit logging, and least-privilege service credentials. If a personal-data breach is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours and, where required, inform you (Arts. 33–34 GDPR).

15. Cookies and similar technologies

We and our service providers use cookies, SDKs, and similar technologies to operate the Services. Strictly necessary cookies keep you signed in, remember your cart, and secure the apps — these cannot be switched off. Preference cookies remember your language and settings (for example, the language selector on gomiamm.com). Analytics cookies help us improve the Services.

In accordance with the ePrivacy Directive (2002/58/EC, as transposed) and CNIL guidance, we place non-essential cookies only after you have given consent, and you can withdraw that consent at any time through your browser or device settings or by resetting your mobile advertising identifier. Blocking strictly necessary cookies may break parts of the Services. We do not use cookies for cross-context behavioural advertising.

16. Changes to this policy

We may update this policy from time to time. The version and effective date at the top reflect the most recent change. Material changes will be communicated through the apps and, where we have your email, by email at least 30 days before they take effect.

17. Contact

Gomiamm
Privacy inquiries: privacy@gomiamm.com
Legal notices: legal@gomiamm.com
Registered office: 66 Avenue des Champs-Élysées, 75008 Paris, France