Privacy Policy

This policy explains how the "Lena Water Distribution" apps (customer app and driver app) and the website lena-water.net collect, use, protect and delete personal data. By using the app you agree to this policy.

1. Data we collect

• Account data: name and mobile number, plus email if you provide it. For driver accounts: name, mobile number and password.
• Delivery addresses: address, building, floor and apartment number, and the map coordinates you select.
• Location: we request location permission only while the app is in use, to pin your delivery address on the map. We do not track your location in the background.
• Order data: products, quantities, amounts, delivery time, payment method, order status and notes.
• Device data: push-notification token (Firebase) to send order notifications, device type and app version.
• Payment data: for online payment, card details are entered directly on the payment gateway's page (MyFatoorah). The app never receives or stores card numbers; we keep only the transaction result and its reference number.

2. How we use data

• Creating your account, signing in and verifying your mobile number.
• Receiving, preparing and delivering orders to the right address at the chosen time.
• Sending order status notifications.
• Issuing invoices, customer support and handling complaints.
• Improving the service, preventing fraud and complying with applicable law.

We do not sell your personal data and do not use it for advertising.

3. Data sharing

• The driver assigned to your order: sees only your name, mobile number, delivery address and order details, to make the delivery.
• Payment gateway (MyFatoorah): to complete online payments.
• Google Firebase: to send notifications. Google Maps: to show the map and select addresses.
• Authorities: only when required by a binding legal request.

We do not share data with any other party without your consent.

4. How we protect your data (secure data handling)

• All data between the app and our servers travels over an encrypted connection (HTTPS / TLS).
• Passwords are stored as one-way hashes (bcrypt) and cannot be read by anyone.
• Every server request requires the user's own access token. No user can access another user's orders or addresses, and drivers see only the orders assigned to them.
• Access to the admin dashboard is limited to authorised staff with role-based permissions.
• Card data never passes through our servers; it is processed by the payment gateway under its own security standards.
• Data is kept on protected servers, and we review access rights and update our systems regularly.

No method of transmission or storage is 100% secure, but we take reasonable measures to protect your data and will notify you as required by law if a breach affects your data.

5. Data retention

• Account and address data are kept while your account is active.
• Order and invoice records may be kept for as long as accounting and tax regulations require, then deleted or anonymised.

6. Your rights and account deletion

• You can view and edit your data from "My Account" in the app, and delete any saved address.
• You can delete your account inside the app: My Account → Delete account. Your account is closed immediately and your mobile number and email are unlinked from it. To erase your remaining personal data (name and addresses), email us below; after that we keep only the order records we are legally required to keep.
• You can also request account deletion or a copy of your data by emailing us below; we will respond within 30 days.
• You can turn off notifications or location permission at any time in your device settings.

7. Children

The app is not intended for anyone under 18, and we do not knowingly collect their data.

8. Changes to this policy

We may update this policy from time to time and will show the last-updated date at the top. We will notify you in the app of any material change.