Trust Center - Privacy

We have a dedicated Privacy Legal team that regularly reviews and updates our policies and procedures to ensure alignment with relevant privacy laws and regulations including GDPR.

In Wolt Marketplace (Wolt App), Wolt acts as a data controller for the data of users placing orders through an account in the service. Wolt is also a controller for courier data and personal data of merchants and their contact persons. Besides the marketplace, Wolt also offers other services and products where the roles may differ. Please see product-specific privacy questions on this site.

We have a dedicated process in place for handling data subject requests, including requests for access, rectification, deletion, and data portability, in compliance with applicable privacy laws.

For data deletion requests, you can request the deletion of your Wolt account via the Wolt customer app. For Data Subject Access Requests please contact support@wolt.com.

Our data retention policy mandates that data is retained only as long as necessary to fulfil its intended purpose, after which it is securely deleted or anonymized in accordance with legal and regulatory requirements.

See "Public documentation and links" heading above.

In our operations we handle certain types of sensitive data ("special category data") such as pharmacy orders and orders that contain sexual health products. Processing of special category data is always based on the customers' consent (opt-in).

Sensitive data is defined in our data policy and it sets specific guardrails on it's processing, such as labeling in systems and deletion rules. Access to sensitive data is restricted by role-based access controls.

Wolt mainly stores data within the EU/EEA area. However, the data is not necessarily stored in the country of the data subject, and can be accessed by employees conducting their work duties in any of the Wolt countries.  We also have contractors who might process or access data from third countries. Wolt complies with requirements of the GDPR and other applicable data protection laws for international data transfers. In the EU, we use appropriate transfer mechanisms such as EU Commission’s standard contractual clauses (SCCs) and conduct transfer impact assessments (TIAs) when necessary. We can also rely on Data Privacy Framework certification of our US partners.

We have a dedicated process in place for handling data subject requests, including requests for access, rectification, deletion, and data portability, in compliance with applicable privacy laws.

Yes, we have appointed a Data Protection Officer who is responsible for overseeing our privacy practices and ensuring compliance with applicable regulations. You can contact the DPO via privacy@wolt.com.

Security matters at Wolt are overseen by the Chief Security Officer.

Wolt Drive is a last-mile delivery service where customers place their order on the merchant’s own online store and have it delivered by Wolt. For end-user data processed in scope of the  Drive service, the merchant acts as a data controller and Wolt is the merchant’s processor. The merchant will provide Wolt with basic customer and order information necessary to deliver the order.

Wolt and the merchant enter into a data processing agreement (DPA) as a part of the Drive service agreement that specifies the rights and obligations in terms of the shared data, and documents the instructions given to the processor by the data controller. In its systems, Wolt identifies Drive-related data, limits its processing only to what is necessary to fulfil the agreement with the merchant, and implements robust security measures to safeguard the data.

Wolt keeps data related to Drive orders and customers for three months, after which the data is anonymized. This retention period allows Wolt and the merchant to handle potential reclamations and other issues, and ensures that Wolt can accurately pay to its merchants and couriers.

In order to provide Wolt for Work service to its employees, the client (the company providing Wolt for Work benefit to its employees) will need to disclose Wolt names and email addresses of its employees. In order to use the service, the employees will need to create a Wolt account. 

Both Wolt and the client act as independent data controllers for the data shared between the Parties. The client will be a controller of all employment-related information of their employees. Wolt will be the data controller of all data related to Wolt accounts created by the employees.

In context of Wolt for Work, Wolt processes names and contact information of its clients’ employees who receive Wolt for Work benefit from the client. Wolt uses this information to identify Wolt user accounts entitled to Wolt for Work, and to provide the service to the entitled users. Wolt may also report aggregated data for its client about the use of Wolt for Work by their employees.  The employees need to have or create a Wolt account in order to use Wolt for Work provided by their employer. Wolt processes the personal data related to these user accounts similarly to any other Wolt customers according to Wolt Privacy Statement available at: https://explore.wolt.com/en/fin/privacy.

Wolt informs its users about data processing through its user application. Wolt also processes information of its client's employees who act as contact persons towards Wolt in matters related to the service.

Wolt Storefront allows merchants to turn their website into a seamless, branded ordering platform to drive sales. Both Wolt and the merchant will act as independent data controllers for personal data processed for the orders.

During the purchase process, the users will see Wolt Privacy Statement informing them about data processing in Storefront service. The merchant can also add their own privacy policy for the users to see.

Wolt uses the user and order data to fulfill and deliver the orders according to Wolt Privacy Statement available at: https://explore.wolt.com/en/fin/privacy.

The merchant can use user data to fulfil the orders placed through Storefront, and to other lawful purposes subject to applicable data protection and privacy laws. The merchant is responsible for complying with its legal obligations to inform users about their data processing through a privacy policy or a similar document, and to obtain appropriate consents for data processing where necessary.