Privacy Policy

1. About this Policy and who we are

This Privacy Policy explains how Zap Internet Platform Limited, a company registered in the Dubai International Financial Centre under registration number CL9885 with its registered office at Innovation One, Level 1, DIFC, Dubai, UAE ("Zap!", "we", "us", "our"), collects, uses, shares and protects personal data when you use our crowdshipping platform, available as a Telegram mini-app, iOS and Android applications, and at www.zap.ae (together, the "Platform").

Zap! is the Controller of the personal data described in this Policy. We determine why and how that personal data is processed. As a company incorporated in the DIFC, we are subject to the DIFC Data Protection Law in respect of our processing of personal data wherever that processing takes place, including processing carried out for us by couriers, agents and service providers outside the DIFC.

Data Protection contact / Data Protection Officer: hello@zap.ae, or mail to: Innovation One, Level 1, DIFC, Dubai, UAE. You can use these contact details for any question about this Policy or to exercise your rights (see Section 12).

2. How Zap! works (and why this matters for your data)

Zap! is a platform that connects people who need a document delivered internationally ("Senders") with travellers who are already going in the same direction ("Travellers"). Zap! arranges local couriers to collect, confidentially package and hand over the documents, and to deliver them to the intended recipient ("Recipient").

A defining feature of the Platform is mutual anonymity:

• A Sender does not see who the Traveller is, and a Traveller does not see who the Sender is.
• Travellers do not handle Senders' or Recipients' contact details; Zap!-arranged couriers perform the collection and the final-mile delivery.
• We share personal data only on a strict need-to-know basis with the specific parties who must act on it to fulfil a delivery.

Because we are the only party that holds the full picture, Zap! acts as the Controller for all personal data on the Platform. The local couriers, our contractors and subcontractors, our external software developers and our cloud hosting providers act as our Processors and may only process personal data under our written instructions and under a data processing agreement.

This Policy describes the data we hold about all categories of user: Senders, Recipients, Travellers and couriers.

3. The personal data we collect

3.1 Data you provide as a Sender

• Account and identity: name, Telegram nickname/username, account credentials.
• Contact details: your phone number(s) and email.
• Identification documents: passport, driving licence and/or Emirates ID, including the ID number and, where requested, an image of the document. We collect and retain this to verify your identity ("know-your-customer" / KYC), to prevent fraud and misuse, and so that we can identify you if a package you send breaches our platform policies or the laws governing the cross-border carriage of documents.
• Delivery details: pickup and delivery addresses; the name, phone number and address of the Recipient (and of any alternate contact you choose to provide).
• Package information: a photograph and description of the item to be sent (which may itself be a document such as a passport or ID).

3.2 Data about Recipients

We process the Recipient's name, address and phone number. This data is usually provided to us by the Sender, not by the Recipient directly. Where you provide another person's data, Section 6 applies.

3.3 Data you provide as a Traveller

• Account and identity: name, Telegram nickname/username, account credentials.
• Identification and vetting data: passport, driving licence and/or Emirates ID and ID number; information used to verify you and assess eligibility to use the Platform.
• Travel information: route, origin and destination, and approximate timing of your trip.
• Contact and payout details: phone number, email, and the payment/payout details needed to pay you. Payouts are made through a third-party payment provider, and for Travellers paid in Russia through our local payment agent in Russia (see Sections 5.6 and 8).

3.4 Data about couriers and contractors

For couriers, contractors and freelancers we engage, we process the contact and identity details needed to allocate, perform and account for collection, packaging and delivery work.

3.5 Data we collect automatically and in the course of delivery

When you use the Platform we collect device and usage information, IP address, app/version and diagnostic data, and cookie or similar-technology data (see Section 13). For some features we may process approximate location to coordinate collection and delivery. In the course of a delivery, we and our couriers may also record delivery-confirmation data (for example, the recipient's signature, name of the person accepting, or a handover photo) as proof that the delivery was performed.

Please keep the data you give us accurate and up to date — in particular addresses and phone numbers, which we rely on to perform deliveries.

3.6 Sensitive and high-risk data — please minimise

We do not seek to collect special categories of personal data (such as data revealing health, religion, or biometric data used to identify you uniquely). However, identity documents are high-risk, and a document you send may itself contain special-category data. Please do not ship documents containing sensitive personal data unless necessary, and be aware that any clear facial image on an ID may, in context, constitute biometric data. We apply additional safeguards to identity documents and ID images and restrict who can access them.

4. Why we process your data, and our legal bases

Under the DIFC Data Protection Law we must have a lawful basis for each processing activity. We rely on the following:

Where we rely on consent (including for certain international transfers and for processing third-party data), you may withdraw it at any time, without affecting processing already carried out. Please note that if you withdraw a consent that is necessary for a delivery (for example, consent to the international transfer of delivery data), we may be unable to complete that delivery.

5. Who we share your data with

We share personal data only where necessary, on a need-to-know basis, with the following categories of recipient. We do not sell your personal data.

5.1 Couriers (collection, packaging and delivery)

To collect, package and deliver a document, we share the minimum necessary data with the relevant local courier — typically the Recipient's name, phone number and delivery address, and the Sender's pickup details. Couriers act as our Processors (or sub-processors) under a data processing agreement and may use the data only to perform the delivery. In Russia, couriers are engaged by our local payment agent on our behalf (see Section 5.6), and that agent and its couriers are bound by equivalent obligations.

5.2 Contractors, subcontractors and freelancers

Employees, contractors and freelancers who help operate the Platform may access personal data strictly as needed for their role, under confidentiality obligations and a data processing agreement.

5.3 External software developers and IT providers

External developers who build and maintain our technical framework, and our cloud hosting and infrastructure providers, may process personal data as our Processors. We apply role-based access controls, logging, and use pseudonymised or test data wherever production data is not strictly required.

5.4 The mutual-anonymity rule (Senders and Travellers)

By default, a Sender's data is not shared with a Traveller, and a Traveller's data is not shared with a Sender. Travellers do not receive Recipients' contact details. This is a deliberate feature of the Platform.

5.5 Exception — claims, fraud and breach of law

We may share a Traveller's data with a Sender (and vice versa), or with a courier, authority or our advisers, where we reasonably consider it necessary to investigate, exercise or defend a claim of fraud, dishonesty, breach of contract or breach of law, or to protect the rights, property or safety of any person. In these cases we share only what is necessary for that purpose.

5.6 Payment providers and our local payment agent in Russia

Platform payments and Traveller payouts are processed by a third-party payment provider, which processes the necessary financial and contact data.

For deliveries and payments in Russia, we engage a local payment agent in Russia. Acting as our agent, the partner: (i) receives incoming payments in Roubles and makes payouts to Travellers; and (ii) engages the local couriers who collect, package and deliver the documents. To perform these functions, we share with the agent the personal and payment data necessary for the relevant delivery and payment — including the Recipient's name, address and phone number and the Traveller payout details. The agent acts as our Processor for delivery purposes and may also act as an independent Controller in respect of its own legal and regulatory obligations under Russian law (including payment and anti-money-laundering rules). The agent and the couriers it engages are bound by contractual data-protection and confidentiality obligations equivalent to those in this Policy. See Section 8 for the Russia-specific position.

5.7 Authorities, customs and law enforcement

We may disclose data to courts, regulators, customs authorities of transit or destination countries, and law-enforcement or government bodies where required by applicable law, or to comply with a lawful request. Consistent with the amended DIFC Data Protection Law, before disclosing personal data to a public authority we assess the legality and proportionality of the request and the availability of redress for affected individuals.

5.8 Corporate transactions

If we are involved in a merger, acquisition, financing or sale of assets, personal data may be disclosed to advisers and counterparties subject to confidentiality, and transferred to a successor entity that will continue to be bound by this Policy.

6. When you provide another person's data

To arrange a delivery you will often give us personal data about another person — most commonly the Recipient, or an alternate contact, including their phone number (which may not be your own). When you provide such data, you confirm that:

• you are authorised to provide it to us for the purpose of arranging the delivery;
• you have informed that person that their data will be shared with Zap! and with couriers (which may be located in their country, including Russia) for delivery; and
• you will, on request, make this Privacy Policy available to them.

If you cannot give these confirmations, please do not provide that person's data. We rely on you for the accuracy of data you provide about others.

7. International transfers of your data

Zap! receives personal data through its DIFC entity, Zap Internet Platform Limited. To deliver a document internationally, we must transfer personal data out of the DIFC to the country of collection and the country of delivery, and to our couriers, contractors and service providers in those countries.

Before transferring personal data outside the DIFC we carry out, and document, an assessment of whether the destination provides adequate protection and effective remedies for data subjects, as required by the DIFC Data Protection Law. Where the destination does not benefit from an adequacy decision, we transfer personal data only:

• where the transfer is necessary for the performance of the delivery contract with you, or to take steps at your request before entering into it (a recognised basis under the DIFC Data Protection Law); and/or
• under appropriate safeguards, such as the standard contractual clauses issued or recognised by the DIFC Commissioner of Data Protection (including the DIFC's Article 24 contract clauses), incorporated into our agreements with couriers, agents and service providers; and/or
• with your explicit consent, having been informed of the possible risks of the transfer, where no other basis is available.

A delivery cannot be completed without transferring the Recipient's name, address and phone number to a local courier in the destination country. By requesting a delivery you understand that this transfer is necessary to perform it.

8. Deliveries to and from Russia (Federal Law No. 152-FZ)

Where a delivery involves Russia, additional rules under Russian Federal Law No. 152-FZ ("On Personal Data") may apply to the personal data of individuals in Russia. In particular:

• Our local payment agent. In Russia we act through a local payment agent who receives Rouble payments, makes Traveller payouts and engages the local couriers. To do this, we share with the agent the personal and payment data needed for the delivery and payment (including the Recipient's name, address and phone number and Traveller payout details). The agent may itself be an "operator" under Law 152-FZ with its own obligations.
• Local delivery requires data sharing. To complete a delivery in Russia, a local courier (engaged by our payment agent) receives the Recipient's name, address and phone number. As noted in Section 6, the phone number you provide may belong to someone other than you; you confirm that you are authorised to provide it and have informed that person.
• Data localisation. Where required by Russian law, personal data of Russian citizens that is subject to localisation will be recorded and stored using a database located in the Russian Federation, with any cross-border transfer carried out separately and in accordance with applicable Russian requirements.
• Notification of cross-border transfer. Where Russian law requires it, cross-border transfers of personal data from Russia are notified to the Russian regulator (Roskomnadzor) before they are carried out.
• Legal basis. We process and transfer this data on the basis that it is necessary to perform the delivery you have requested and, where required by Russian law, on the basis of consent obtained in the form required by Law 152-FZ.
• Security incidents. Where a security incident affecting personal data subject to Russian law occurs, we will act in accordance with the notification timeframes required under Russian law.

If you are located in Russia, you have the rights afforded to data subjects under Law 152-FZ, including the right to access, correct and require deletion of your personal data, and to withdraw consent. Contact us using the details in Section 1.

9. How long we keep your data

We keep personal data only for as long as necessary for the purposes set out in this Policy:

• Delivery and transaction data: for the duration of the delivery and for three years thereafter, to handle queries, claims and disputes.
• Account data: for as long as your account is active and for one year after closure.
• Identity and verification documents (KYC): we retain these for as long as you hold an account and for three (3) years afterwards — aligned with the limitation period for civil claims — so that we can identify a Sender if a package breaches our policies or applicable law, and to meet any applicable KYC/AML or cross-border carriage obligations. We delete them sooner if there is no longer any lawful basis to retain them.
• Data needed for legal claims, fraud investigation or regulatory compliance: for as long as required for that purpose.

When data is no longer needed, we securely delete or anonymise it.

10. How we protect your data

We use technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls and the need-to-know principle, pseudonymisation or test data for development where feasible, confidentiality undertakings and data processing agreements with everyone who processes data on our behalf, and logging and monitoring of access to high-risk data such as identity documents.

No system is completely secure, but we work to protect your data and to respond promptly to any incident, including notifying the DIFC Commissioner of Data Protection and affected individuals where required.

11. Automated decision-making

Where we use automated processing to support fraud detection, matching or vetting, we apply human review before any decision that produces a significant effect on you. You may ask us to review such a decision and contest it (see Section 12).

11A. Marketing communications

We may send you service communications about your deliveries and account (these are not marketing and you will receive them while you use the Platform). Where permitted, we may also send you marketing about Zap! features and offers — by email, push notification or in-app message. You can opt out of marketing at any time, free of charge, using the unsubscribe link or your app settings, or by contacting us (Section 1). We will action your objection and stop marketing to you. We do not share your data with third parties for their own marketing.

12. Your rights

Subject to the conditions and exemptions in the DIFC Data Protection Law, you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data in certain circumstances;
• restrict or object to processing in certain circumstances, including an absolute right to object to direct marketing at any time;
• data portability for data you provided to us;
• withdraw consent where we rely on consent; and
• not be subject to a solely automated decision with a significant effect on you.

To exercise any right, contact us using the details in Section 1. We will respond within the timeframe required by law.

Complaints. You may complain to us at any time. You also have the right to complain to the DIFC Commissioner of Data Protection (https://www.difc.com). Following amendments to the DIFC Data Protection Law effective 15 July 2025, you may also bring a claim directly before the DIFC Courts in respect of a contravention of your rights.

If Russian law applies to your data, you also have the rights described in Section 8.

13. Cookies and similar technologies

We use cookies and similar technologies in the web and app versions of the Platform to keep you signed in, to operate and secure the Platform, and to understand usage. The Telegram mini-app operates within Telegram and is also subject to Telegram's own privacy practices. Where required (including for users in Russia), we will obtain consent for non-essential cookies and provide controls to manage them.

The Platform may contain links to third-party websites and services (including payment pages). Their privacy practices are governed by their own policies, which we encourage you to read.

14. Children

The Platform is intended for users aged 18 and over. We do not knowingly process the personal data of children. If you believe a child has used the Platform, please contact us.

15. Changes to this Policy

We may update this Policy from time to time. We will post the updated version on the Platform and, where changes are material, notify you. The "Effective date" above shows when this version took effect.

16. Contact us

Innovation One Level 1, DIFC, Dubai, UAE
hello@zap.ae
zap.ae