Privacy Policy

Effective date: 2 September 2026

1. Introduction

Minto Delivery (“Minto”, “we”, “us”, or “our”) operates a food ordering and delivery platform. Our services include the customer mobile application, restaurant partner application, delivery partner application, admin tools used to operate the platform, and our marketing website and registration forms (together, the “Services”).

This Privacy Policy explains how we collect, use, disclose, store, and otherwise process personal data when you use the Services, and the rights you have under the applicable laws.

By creating an account, submitting a registration form, or using the Services, you acknowledge that you have read this Privacy Policy. Where consent is required for a specific activity, we will ask for that consent separately and clearly.

Our Terms & Conditions govern your use of the Services. If there is a conflict between those Terms and this Privacy Policy on a privacy topic, this Privacy Policy prevails for that topic.

2. Data controller

The Minto Delivery data controller is responsible for personal data processed in connection with the Services

If we appoint a Data Protection Officer (DPO) as required or appropriate under the applicable laws, we will publish the DPO’s contact details here or notify you through the Services.

3. Whose data we process

We may process personal data relating to:

Customers who browse, register, place orders, track deliveries, rate orders, or contact support.
Restaurant partners and their authorised representatives or staff who manage menus, accept orders, or communicate through the restaurant app.
Delivery partners who apply, onboard, accept delivery jobs, navigate to pick-up and drop-off locations, or receive payouts.
Website visitors and applicants who use our marketing site or submit interest/registration forms.
Other individuals whose details you provide (for example, an alternate delivery recipient or emergency contact), where you confirm you have authority to share that information.

4. Categories of personal data

Depending on how you use the Services, we may process the following categories of personal data:

4.1 Account and contact information

Name, display name, phone number, email address, password or authentication credentials, profile photo (if provided), preferred language, and account settings.

4.2 Delivery and location information

Delivery addresses, landmarks, pin locations, and—when you grant permission or when needed to fulfil an order—precise or approximate location data from your device (for example, to show nearby restaurants, assign a delivery partner, or complete a delivery).

4.3 Order and transaction information

Order contents and special instructions, restaurant and delivery partner identifiers associated with an order, timestamps, order status history, fees, tips (if offered), promotions applied, and related receipts or invoices.

4.4 Payment-related information

Payment method type, transaction references, billing status, refund records, and payout or bank account details for partners where required for settlement. Card numbers and similar sensitive payment credentials are typically collected and processed by authorised payment service providers; we receive confirmation and limited payment metadata rather than full card data.

4.5 Communications, ratings, and support

In-app messages related to an order, ratings and reviews, photos you submit with feedback (if any), customer support tickets, and related attachments.

4.6 Partner onboarding and compliance information

For restaurant and delivery partners: business name, tax or registration identifiers, contact person details, menu and operating information, vehicle and licence details, identity documents for verification where required, bank or payout details, and other information reasonably needed for onboarding, safety, and legal compliance.

4.7 Admin and security logs

Access logs, permission changes, and audit records generated when authorised staff use admin tools to maintain the platform.

5. How we collect data

We collect personal data from:

You directly — when you register, update your profile, place or manage orders, apply as a partner, upload documents, contact support, or otherwise submit information.
Your use of the Services — when the apps or website generate technical, location, transaction, and usage data as described above.
Other users and partners — for example, when a restaurant confirms an order, a delivery partner reports delivery status, or a customer leaves a rating.
Service providers and integrations — such as payment processors, mapping and messaging providers, cloud hosting, analytics tools, and identity or fraud-prevention vendors, where they share limited data needed to run the Services.
Public or official sources — where permitted by law and relevant to partner verification or compliance.

6. Purposes and lawful bases

We process personal data only when we have a lawful basis. The main purposes and bases are summarised below.

6.1 Performance of a contract

We process data as necessary to:

Create and manage accounts across customer, restaurant, and delivery apps.
Receive, route, fulfil, and track orders.
Process payments, refunds, tips, and partner payouts.
Provide customer and partner support related to your use of the Services.
Communicate transactional notices (order updates, security alerts, account messages).

6.2 Consent

Where required, we rely on your consent for activities such as:

Marketing communications you opt into.
Optional precise location access beyond what is strictly necessary for a requested feature.
Non-essential cookies or similar technologies on our website.
Processing of sensitive personal data where consent is the applicable basis.

You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Withdrawal may limit certain optional features.

6.3 Legitimate interests

Where permitted and balanced against your rights, we process data for:

Preventing fraud, abuse, and security incidents.
Maintaining safety for customers, partners, and the public.
Improving product quality, reliability, and user experience.
Internal analytics, reporting, and business planning in aggregated or de-identified form where practical.

6.4 Legal obligation

We may process and retain data to comply with tax, accounting, consumer protection, law-enforcement, or other legal applicable requirements or other jurisdictions that lawfully apply to us.

We share personal data only as needed to operate the Services, protect rights and safety, or meet legal requirements. Recipients may include:

Restaurant partners — information needed to prepare and fulfil customer orders (for example, order details, delivery address or pick-up preferences, and contact details necessary for fulfilment).
Delivery partners — pick-up and drop-off details, customer contact information as needed for delivery, and order identifiers.
Payment service providers — to process payments, refunds, chargebacks, and payouts.
Technology and operations vendors — cloud hosting, messaging/SMS, maps and navigation, analytics, customer support tools, and similar processors acting on our instructions.
Professional advisors — lawyers, auditors, or insurers where reasonably necessary.
Authorities and regulators — when required by law, court order, or to protect rights, safety, or property.
Business transfers — in connection with a merger, acquisition, reorganisation, or asset sale, subject to appropriate confidentiality and notice where required.

We do not sell your personal data. Partners and vendors who process personal data for us are expected to protect it under contracts and applicable law.

8. Cross-border transfers

Our Services may be hosted or supported using infrastructure and vendors located outside. Where personal data is transferred outside, we will do so in accordance with the applicable laws, including by using appropriate safeguards such as:

Transfers to jurisdictions or recipients recognised as providing adequate protection, where applicable; and/or
Contractual or organisational measures designed to protect the data to a standard consistent with the applicable laws.

You may contact support@gominto.co for more information about cross-border transfers that apply to your data.

9. Retention

We retain personal data only for as long as needed for the purposes described in this Privacy Policy, including to provide the Services, resolve disputes, enforce agreements, and meet legal, tax, and accounting requirements.

Retention periods vary by data type and context. As a general approach:

Account data is kept while your account remains active and for a reasonable period afterward if needed for residual obligations or disputes.
Order and transaction records may be kept for longer periods required by tax or commercial law.
Support records are kept for a period needed to handle follow-ups and improve service quality.
Partner onboarding and compliance documents are kept for the duration of the relationship and any legally required period after it ends.

Specific schedules may be refined by our internal retention policy. When data is no longer needed, we delete or irreversibly anonymise it where feasible.

10. Security

We implement administrative, technical, and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These may include access controls, encryption in transit where appropriate, monitoring, staff confidentiality obligations, and vendor due diligence.

No method of transmission or storage is completely secure. We cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Personal Data Protection Committee and affected individuals as required.

11. Cookies and similar technologies

Our website and apps may use cookies, local storage, SDKs, and similar technologies to:

Essential operation — keep you signed in, maintain session security, and remember basic preferences.
Performance and analytics — understand how the Services are used so we can improve reliability and usability.
Marketing — where enabled and permitted, measure campaigns or deliver relevant communications.

You can control cookies through your browser settings and, where available, in-app or on-site preference tools. Blocking essential cookies may prevent parts of the Services from working correctly.

12. Your rights under the law

Subject to the applicable laws and exceptions, you may have the right to:

Be informed about the collection and use of your personal data.
Access and obtain a copy of your personal data.
Request rectification of inaccurate or incomplete data.
Request erasure or destruction of data in certain circumstances.
Request restriction of processing in certain circumstances.
Object to certain processing, including direct marketing.
Data portability, where technically feasible and legally applicable.
Withdraw consent where processing is based on consent.
Lodge a complaint with the Personal Data Protection Committee (PDPC).

To exercise these rights, contact support@gominto.co (or use in-app support where available). We may need to verify your identity before fulfilling a request. We aim to respond within the timeframes (generally within 30 days, or longer where permitted for complex requests, in which case we will inform you).

13. Sensitive personal data

In limited cases—particularly during partner identity verification or where you voluntarily provide it—we may process data that law treats as sensitive (for example, certain identity document details). We process such data only with your explicit consent or another lawful basis permitted by the applicable laws, and only to the extent necessary for the stated purpose.

Please do not submit sensitive information that is not required for the feature you are using. Where documents contain unnecessary sensitive details, you may redact them before upload if the remaining information still meets verification requirements.

14. Children

The Services are not directed to individuals under 18 years of age (or the age of legal capacity applicable to you). We do not knowingly collect personal data from children under that age. If you believe a child has provided personal data to us, contact support@gominto.co and we will take appropriate steps to delete the data where required.

15. Changes to this policy

We may update this Privacy Policy from time to time as the Services, vendors, or legal requirements change. The “Effective date” at the top will be revised when updates are published. For material changes, we will provide additional notice through the Services, email, or another appropriate channel where practicable. Continued use after the effective date of an update constitutes acknowledgment of the revised policy, except where consent is required by law for a specific change.

16. Contact

For privacy questions, data subject requests, or concerns about this Privacy Policy, contact:

Support: support@gominto.co

For terms governing use of the platform, see our Terms & Conditions.