Privacy Policy

Last updated: 14th September 2026

Shuppa is an online grocery shop. We buy, store, pick and pack our own stock in our hubs in Dublin. We are not a marketplace — we don't collect orders from other retailers' shops. Most orders are delivered by our own riders, some are delivered by a delivery partner, and you can also collect an order from one of our hubs yourself. See sections 10 and 16A.

The company responsible for your personal data (the "data controller" under the GDPR) is:

Ooft Ltd, trading as Shuppa
Registered in Ireland, company number 701115
Registered office: 26–28 Lombard Street East, Dublin 2, D02 VX28
Email: help@myshuppa.com

This notice covers the Shuppa website, the Shuppa iOS and Android apps, and any contact you have with our customer care team. It includes how we use cookies and similar technologies — see section 9.

• Login providers. If you sign in with Google, Apple or Facebook, we receive your name and email address from them, and a unique identifier. If you use Apple's "Hide My Email", we receive a relay address, not your real one. We do not receive your contacts, friends list, posts or photos, and we do not ask for them.
• Payment providers. Our payment processor tells us whether a payment succeeded, the card type, the last four digits of the card, and its expiry date.
• Analytics and advertising partners. Aggregated or pseudonymous information about how people found and used our app or website.
• Delivery and mapping services. We use Google Places for address autocomplete and Google Geocoding to turn coordinates into an address.

Under the GDPR we have to have a lawful basis for each use. Here is ours.

Where we rely on legitimate interests, we've weighed our interest against your rights. You can ask us for a summary of that assessment, and you can object — see section 13.

We sell four kinds of product that cannot be sold to under-18s:

• alcohol
• general sale medicines
• vapes and other nicotine inhaling products
• cigarettes and other tobacco products

At checkout. If your basket contains an age-restricted item, you must enter your date of birth before you can place the order. If the date you enter means you are under 18, the order can't be placed.

You can also add or change your date of birth in your profile. We use it to check your age when you order age-restricted items.

At the door, or at the collection point. If the person receiving the order looks under 25, the rider — or the member of our team handing it over at a hub — will ask to see photo ID and check that they are over 18. When we use third party delivery services, they may always be required to check photo ID for age-restricted items, even if the person receiving it looks over 25.

• We never photograph, scan, copy or store your ID document. It's looked at and handed back.
• For deliveries, the rider confirms in their app that they carried out the check. We keep that confirmation against the order.
• For collections, the hub team member carries out the same check at handover. We don't currently keep a record of it.
• If you can't produce ID, or the person receiving the order isn't over 18, the age-restricted items aren't handed over. The rest of your order is delivered or handed over as normal, and you're refunded for the items withheld.
• If age-restricted items have to be withheld repeatedly, we may stop you ordering them in future. See section 14.

Card payments are handled for us by Stripe and Braintree. Both are certified to PCI DSS Level 1, the highest level of the card industry's security standard. We contract with Stripe Payments Europe Limited in Dublin, and with PayPal (Europe) S.à r.l. et Cie, S.C.A. in Luxembourg, which provides Braintree.

We never see or store your full card number or security code. The payment provider gives us a token that lets us charge a saved card without holding the card details ourselves, along with the card type, the last four digits and the expiry date.

We accept card payments only. Braintree is part of the PayPal group, so if your payment is processed through Braintree your payment data is handled within that group, even though you aren't paying with a PayPal account.

Our payment providers don't only act on our instructions. They also use payment data for their own purposes — detecting fraud, and meeting the financial regulation, anti-money-laundering and reporting obligations that apply to them as regulated payment institutions. For those purposes they are independent data controllers and their own privacy notices apply: stripe.com/privacy and paypal.com/ie/legalhub/paypal/privacy-full.

If you pay with Apple Pay or Google Pay, we receive a device-specific token rather than your real card number, and the authentication happens on your device — we never see your card details or your fingerprint or face data.

We keep a record of credit added to and spent from your account. That includes deposits refunded when you hand Deposit Return Scheme containers back to one of our riders, and refunds, which we issue as account credit by default.

If you take out a Shuppa subscription, it is managed for us by Chargebee, on their EU infrastructure. Chargebee holds your name, email address, billing address and the details of your plan, and keeps a record of your invoices, payments and renewals. Your card details stay with our payment providers — Chargebee works from the same token and never receives your card number.

We use location data in two ways.

To take an order. We need a delivery address inside our service area. You can always type this in — you never have to share your device location.

To suggest your address. If you allow it, we use your device's location once, when you ask us to, to work out your address and check you're in a delivery zone.

We only ask for your location while you're actively using the app, and only at the moment you tap to use it. We don't track your location in the background, we don't monitor it continuously. You can turn the permission off at any time in your device settings and the app still works — you'll just type your address.

Your coordinates are sent to Google's geocoding service to turn them into an address, to our own servers to route the delivery, and to our analytics provider. They are not shared with advertising platforms.

We don't ask you for sensitive information, and we don't have a field for allergies, dietary requirements or medical needs. But what someone buys in a grocery shop can reveal things the GDPR treats as special category data (Article 9) — gluten-free or diabetic products can suggest a health condition, halal or kosher products can suggest a religious belief, medicines can suggest an illness, and some products can suggest a pregnancy or a sexual health need.

• We use your purchase history to run the shop: restocking, reordering, showing you your previous orders, processing refunds and forecasting demand.
• We analyse purchasing across our customers, including by age band and product category, to decide what to stock and how to run the business.

Where we share information with advertising platforms, we do that only with your consent, and you can withdraw it at any time. See section 9.

Email. If you've bought from us, we may email you about similar Shuppa products and offers. Every message has a one-click unsubscribe, and you can turn it off in your account. If you haven't bought from us, we'll only market to you if you've asked us to.

Push notifications. Order updates ("your rider is 2 minutes away") are part of the service. Promotional pushes are separate, and you can switch off all notifications in your device settings.

Ads on other platforms. With your consent, we show ads on platforms like Meta and Google, and we may share a hashed version of your email address so those platforms can show our ads to you or to people like you. You can withdraw consent at any time in our cookie settings, and you can opt out at the platform itself.

Our website uses cookies. Our app uses software kits (SDKs) and device identifiers that do a similar job.

Some are strictly necessary — keeping you signed in, holding your basket, routing traffic, verifying the app is genuine, monitoring for crashes, and preventing fraud. These run without consent because the service cannot work without them.

Everything else — product analytics, marketing automation, and advertising measurement — only runs if you agree. You can accept, reject or change your mind at any time in the app, or through the cookie settings link in the footer of our website.

Rejecting is as easy as accepting. We don't treat a scroll, a swipe or continued use as consent.

On iPhone and iPad, advertising measurement also needs your permission through Apple's App Tracking Transparency prompt. That's separate from, and additional to, the consent above.

On iPhone and iPad, advertising measurement also needs your permission through Apple's App Tracking Transparency prompt. That's separate from, and additional to, the consent above.

We don't sell your personal data. We share it with:

Our riders. The rider bringing your order sees your first name, delivery address, access notes and your phone number, so they can reach you if there's a problem finding you. They see it only for that delivery.

Our delivery partner. Some orders are delivered for us by Deliveroo. When that happens we give them your name, delivery address and phone number so they can complete the delivery, and a flag showing whether the order contains age-restricted items and of what kind. We do not give them your date of birth. If the order contains age-restricted items, the Deliveroo rider carries out an ID check at the door and records the date of birth from your ID. That record is Deliveroo's, not ours — it isn't sent back to us.

Deliveroo is a separate data controller for this information, not a processor acting on our instructions. That means they decide how they use it and for how long, and their own privacy notice applies alongside this one. The Deliveroo companies responsible are Deliveroo Ireland Limited and Roofoods Ltd in the United Kingdom. Deliveroo is part of the DoorDash group, and DoorDash, Inc. in the United States also acts as a controller of information Deliveroo holds in some circumstances.

Deliveroo has told us that they keep the date of birth recorded at an age check for as long as reasonably necessary for the purpose they collected it for, and to meet legal, regulatory, tax, accounting and reporting requirements — specifically for audit, so they can satisfy themselves that age-restricted products were supplied to people of the right age. It's held against the order and delivery record.

For questions about what Deliveroo does with your data, or to exercise your rights against them, see their privacy notice at deliveroo.ie/privacy or contact them directly at dpo@deliveroo.com.

The company that runs our shop. Our website and online shop, and parts of the systems behind them, are built and operated for us by Jungleworks, using their Yelo and Tookan products. That means Jungleworks handles your account details, delivery addresses, orders and order history on our behalf. They act on our instructions and are not permitted to use your information for their own purposes. Our mobile apps are our own, but they connect to systems Jungleworks operates.

Other service providers who work for us, under written contracts that require them to process data only on our instructions:

Authorities and professional advisers, where we're legally required to share, or where we need to establish or defend a legal claim — for example An Garda Síochána, Revenue, the HSE, the Food Safety Authority of Ireland, or our lawyers, auditors and insurers.

A buyer, if we sell or restructure the business. We'd tell you before your data became subject to a different privacy notice.

Some of your data is held in the European Union, on Google Cloud. Our shop and website are operated for us by Jungleworks, a company based in the United States, and the account, address and order information they hold on our behalf is stored in the United States.

Both our payment providers contract with us through European entities: Stripe Payments Europe Limited in Dublin, and PayPal (Europe) S.à r.l. et Cie, S.C.A. in Luxembourg, which provides Braintree. Both are regulated in the EU.

Some of the organisations we work with are based outside the EEA, or belong to groups that operate outside it:

• United Kingdom — Roofoods Ltd, part of our delivery partner's group.
• United States — Segment (Twilio), Klaviyo, Sentry, Meta, TikTok, Google and Apple, and the US parents of our payment providers. DoorDash, Inc. also acts as a controller of some information held by our delivery partner.
• United States — Jungleworks, who operate our shop and website and parts of the systems behind them.

Our customer support chat runs on Freshchat's EU infrastructure, our product analytics run on Amplitude's EU infrastructure, and our subscription billing runs on Chargebee's EU infrastructure.

When data does go outside the EEA, we rely on one of:

• an adequacy decision by the European Commission — the United Kingdom has one, renewed in December 2025, and some US providers are covered by the EU–US Data Privacy Framework where they are certified under it; or
• the European Commission's Standard Contractual Clauses, together with an assessment of the laws in the destination country and extra technical measures such as encryption.

For our shop platform provider, which is not certified under the Data Privacy Framework, we rely on the Standard Contractual Clauses.

You can ask us for a copy of the safeguards we use by emailing help@myshuppa.com.

We keep personal data for as long as we need it for the purpose we collected it, and then delete or anonymise it. In practice that means:

Where we haven't set a fixed period, we decide how long to keep something by looking at how much data it is and how sensitive it is, what harm could come from it being disclosed, whether we still need it for the purpose we collected it, whether we're required to keep it by law, and whether it might be needed for a legal claim.

We may keep something longer if there's an ongoing dispute, investigation or legal claim.

You can:

• Get a copy of the personal data we hold about you (a "subject access request").
• Correct anything that's wrong.
• Delete your data, where we don't have a legal reason to keep it. Note that we have to keep order and payment records for six years for Revenue, so deleting your account won't delete those.
• Object to processing based on legitimate interests. If you object to direct marketing, we will always stop.
• Restrict how we use your data while a dispute about it is being sorted out.
• Get your data in a portable format, or have us send it to another provider, where processing is based on consent or contract and is automated.
• Withdraw consent at any time, for anything based on consent. This doesn't affect what we did before you withdrew it.

How to use these rights. You can request deletion of your account and your data directly in the app, and we action those requests within 7 days. For anything else — a copy of your data, a correction, an objection — email help@myshuppa.com.

We may ask you to confirm your identity, so that we don't hand your data to someone else. We'll respond within one month. If your request is complex, we can extend that by two more months, and we'll tell you if we need to. It's free, unless a request is manifestly unfounded or excessive.

If you're unhappy, please tell us first — we'd rather fix it. You also have the right to complain to the Irish supervisory authority:

Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28
dataprotection.ie

Some decisions about your orders are made automatically.

Fraud and payment checks. Our payment providers run automated fraud checks on every order. These look at signals from the card and the device you're ordering from, the value of the order, and the delivery address. If an order is scored as high risk it may be declined automatically, without anyone at Shuppa reviewing it first. If that happens the order doesn't go through and you aren't charged.

Age-restricted orders. If age checks at the door or on collection are failed repeatedly, we may stop you ordering age-restricted items in future. That decision is made by a person, not automatically.

In either case you can ask for a person to look at it, explain your side, and challenge the outcome. Email help@myshuppa.com.

We don't knowingly collect data from children. In Ireland, the age of digital consent is 16, and a child under that age cannot consent to their data being processed on the basis of consent. If you believe a child has given us their data, email help@myshuppa.com and we'll delete it.

We protect your data with encrypted connections between our apps and our servers, checks that verify requests come from the genuine Shuppa app, and settings that stop app data being copied into device backups. We limit who inside Shuppa can see what: access depends on a person's role, and more sensitive information such as your date of birth is restricted to a small number of administrators.

If a breach happens that's likely to put your rights at risk, we'll notify the Data Protection Commission within 72 hours and tell you directly where we're required to.

We operate CCTV at our hubs — the sites where we store stock and pick and pack orders — for security, to protect our staff and stock, and to deter and investigate theft. Cameras cover the inside of the premises and the area immediately around it, including entrances and the loading area.

If you collect an order from a hub, you will be recorded. There are signs at the entrance and in the areas covered so you know before you enter. We don't use the cameras to identify or track individual customers, and we don't match footage against your account as a matter of routine.

We may look at footage where:

• there's a dispute about whether an order was collected, or about what was handed over;
• there's a dispute about a missing, wrong or damaged item, and reviewing the pick or pack helps settle it;
• we're investigating theft, abuse of a member of staff, or an accident;
• there's a food safety incident or product recall to trace;
• we're asked for footage under a valid legal request, or need it to defend a claim.

Footage is kept for a maximum of 30 days and then deleted, unless it's needed for an ongoing investigation, an insurance claim or legal proceedings.

You can ask for a copy of footage of yourself — see section 13. We may need to blur or remove other people from it before we can give it to you.

We'll post any updated version here with a new "last updated" date. If a change materially affects how we use your data, we'll tell you by email or in the app before it takes effect.

Ooft Ltd, trading as Shuppa
26–28 Lombard Street East, Dublin 2, D02 VX28
Email: help@myshuppa.com