Privacy notice

Last updated: 5 November 2026

This notice explains what personal information DeliverPoint (deliverpoint.app, the DeliverPoint apps and recipient tracking pages) collects, why, where it is processed and your rights under Canadian law (PIPEDA and, in Quebec, the Act respecting the protection of personal information in the private sector as amended by Law 25) and the EU General Data Protection Regulation.

1. Who is responsible

Operator	Golan Europe S.L.
CIF	B16546020
Address	Av. Blai Bonet 8, Bl. 3, Apt. 301, Santa Ponça, 07180 Calvià, Illes Balears, Spain
Registry	Registro Mercantil de Islas Baleares, Tomo 2729, Folio 223, Sección 8, Hoja PM-82642
Email	support@ofertobra.es

Person in charge of the protection of personal information (privacy officer): reachable at support@ofertobra.es.

2. What we collect and why

Who	Information	Purpose	Kept
Website visitors	Standard server logs: IP address, page, time, browser string	Security, abuse prevention, rate limiting	Up to 14 days
People who join the country list	Email, country, role (driver / company / other), language, time and text of the consent, a hash of the IP address	Send the confirmation link and then one notice when DeliverPoint is available in your country, plus launch news	Unconfirmed: 30 days. Confirmed: until you unsubscribe or 3 years after the last message
Drivers and companies (app users)	Account details, stops you import, route, GPS position while a route is active, proof of delivery (photos, signatures, notes), reports	Provide the service you signed up for	GPS positions 30 days; other data while the account exists — you can export or delete it in the app
Recipients	The delivery address, name, phone and instructions the sender provided; proof of delivery for that stop	Delivery and the private tracking page	Tracking links expire 2 days after the delivery date

We do not sell personal information, do not use it for advertising, and set no advertising or analytics trackers on this website.

3. The tracking page

Anyone with a tracking code sees only that one delivery: status, arrival window, how many stops are before it, the delivery instructions, and, once delivered, the photo and signature. The driver’s position is shown only while the delivery is on its way and the driver is at most 5 stops away, rounded to about 10 m. Codes are long random strings; unknown or expired codes return the same “not found” answer, and lookups are rate-limited.

4. Where your information is processed

All DeliverPoint data is stored and processed on servers in the European Union (Hetzner Online GmbH, data centre in Helsinki, Finland). Information about people in Canada is therefore transferred outside Canada. The EU offers protection comparable to Canadian law (the GDPR applies to us as an EU company). For Quebec residents we assessed this transfer as required by section 17 of the Quebec private-sector Act before relying on it. Emails are sent only to deliver the messages described above; any email service provider we use acts on our instructions only.

5. Legal bases (GDPR) and consent (Canada)

App and tracking: performance of a contract with the driver or company (GDPR art. 6(1)(b)) and their legitimate interest in proving delivery (art. 6(1)(f)). Country list: your express consent (art. 6(1)(a); Canada’s Anti-Spam Legislation s. 6 and 10), confirmed by a double opt-in link. You can withdraw consent at any time with the unsubscribe link in every email or by writing to us. Server logs: legitimate interest in security.

6. Your rights

You may ask for access to, correction of, deletion of, or a copy of your personal information, withdraw consent, and object to processing. In Quebec you may also ask that information be de-indexed or that its dissemination stop. We answer within 30 days. Write to support@ofertobra.es. Complaints: the Office of the Privacy Commissioner of Canada (priv.gc.ca), in Quebec the Commission d’accès à l’information (cai.gouv.qc.ca), or the Spanish Agencia Española de Protección de Datos (aepd.es).

7. Security

Encrypted connections (HTTPS), hashed passwords, access limited to the operator’s staff, and backups in the same EU region. If a breach creates a risk of significant harm we notify you and the competent authorities as the law requires.

8. Children

DeliverPoint is a business service and is not directed to children under 16.

9. Changes

We will post changes here with a new date; material changes to how we use information collected with consent will be asked again.

See also: Cookies · Terms