1. Data controller
GNCS IKE, Kalogrezis 8, Chalandri, Greece, tax identification number 801615934, operates PANDOO and Pandoo Riders. Personal data contact: admin@gncs.gr. This notice covers visitors, customers, recipients and riders. Company details were supplied by the business.
This notice describes the current operation of the service. Last updated: 15 October 2026.
2. Data and sources
Accounts: name, username, email, activation and order approval status, Google identifier and login times. Customer passwords are stored as hashes, not plain text. We do not receive your Google account password.
Orders: addresses and coordinates, entered contact details, notes, saved addresses, time window, distance, price and status. Billing data includes business name, tax number, address and details entered by the customer or administrator. Account records include charges, discounts, payment amounts/dates, payment method/reference, balance and change history. Administrators may block new orders and record an internal reason. Customers may supply recipients’ details and administrators may create customer accounts.
Riders: first name, last name, contact phone number, Google details, address, area, postal code, tax number, IBAN and date of birth entered by the administrator after contacting the rider, approval, availability, latest GPS position/accuracy/update time, assigned orders, agreed compensation, bonuses, earnings and payment entries. Push messaging uses a device identifier/FCM token and records delivery results.
Technical data: IP addresses, requests, access times/errors, abuse prevention records, session cookies and language preference. Infrastructure providers may keep their own technical logs.
The rider app also records the device manufacturer and model, Android and app versions, installation ID, a hash of the Android identifier, and first and last contact times. These support technical assistance, compatible-version checks, and administrator reports of accounts using multiple devices or devices used by multiple accounts. The hardware serial number and IMEI are not collected. Sharing a device does not automatically block an account. The latest available battery percentage and charging state are also reported for rider operational support.
3. Purposes and legal bases
Accounts, deliveries, price calculation and compensation support service performance or pre-contractual steps. Required tax documentation and retention relate to legal obligations.
Security, fraud prevention and dispute handling may rely on legitimate interests following a documented balancing assessment. The exact basis for each activity, particularly recipient data and rider monitoring, must be finalised considering the actual working relationship.
Android location/notification permission alone is not a GDPR legal basis. Where consent is required, it must be requested separately with a withdrawal mechanism. This notice is not blanket consent.
4. Location and notifications
When a rider chooses availability, the app sends their position for the operational map and delivery coordination. Authorised administrators can view it. Customers can see only riders serving their own active orders. Tracking for that order ends on delivery or cancellation. This may continue in the background through an Android service with a visible notification.
The app may also use GPS locally while open for the rider’s own map. Sending position to the server is linked to availability. The database stores the latest position and update time, not a separate history of every movement. The last position is not automatically deleted when availability is switched off.
Riders cannot become unavailable while active assigned orders remain; emergencies should be reported to dispatch. Android permission can be revoked but service operation is affected. Administrators can send Firebase push messages. Notification permission can be changed in device settings.
5. Recipients and providers
Authorised administrators and, where needed, riders have access. Available orders show route details; after acceptance contact details and notes are also shown. Accountants or advisers may receive necessary information for legal duties or support.
Services include IPHost hosting, Google sign-in, geocoding/routing and maps where loaded, and Firebase Cloud Messaging for push. Searched addresses/coordinates are sent to the mapping service. The app uses MapLibre and OpenStreetMap tiles; the tile provider may receive IP addresses and requests for the displayed area. Navigation opens Google Maps with the destination.
During hosting migration, older app versions may temporarily pass through eatopia.gr as a proxy to pandoo.gr. Access and retirement of this route should be recorded.
Provider contracts, roles, processing countries and safeguards for any transfers outside the EEA require confirmation. We do not claim that all data remains exclusively in Greece.
6. Retention and security
A retention schedule per category has not been finalised. Current accounts, orders, latest positions and financial records remain until administrative action; there is no universal automatic deletion. The final policy must specify periods/procedures for the database, backups and provider logs.
Tax records or information for legal claims may remain after closure for the required period. Deactivation is not deletion. Rider sessions remain active until logout or revocation/deactivation.
Safeguards include HTTPS, access controls, password/token hashes and protected configuration. No system guarantees absolute security. Internal access, backup and incident policies remain to be documented.
7. Rights and account deletion
Subject to legal conditions, you may request access, correction, erasure, restriction or portability, or object. Where consent applies, you may withdraw it without affecting prior lawful processing.
For rights or PANDOO / Pandoo Riders account deletion, email admin@gncs.gr from your account email with the subject “PANDOO personal data request” or “Delete Pandoo Riders account”. Do not send passwords. Proportionate identity verification may be needed. GDPR deadlines apply, normally one month; any lawful extension will be explained.
Deletion is not automatic. You will be informed about erased data and any retention for duties or claims. You may complain to the Hellenic Data Protection Authority, www.dpa.gr.
Prices/compensation use administrator-set rules, and account activation is decided by an administrator. The current app has no solely automated rider approval or behavioural scoring.