Motorcity Mobile Application Privacy Policy

Effective date: 3 August 2026
Last updated: 3 August 2026

1. Introduction

This Privacy Policy explains how T.M.S Motorcity LTD, trading as Motorcity (“Motorcity”, “we”, “us” or “our”), collects, uses, stores and protects personal data when you use the Motorcity mobile application and its related ordering and account services.

The Motorcity application allows customers to:

Browse our menu and product information.
Create and manage a customer account.
Place food and beverage orders.
Track order preparation and status.
View previous orders.
Manage personal information and communication preferences.
Sign in using email and password or supported external sign-in providers.

This Privacy Policy applies specifically to the Motorcity mobile application and the services directly connected to it. Our main website may also have a separate cookie notice or website privacy policy.

2. Who is responsible for your personal data?

The data controller responsible for the processing described in this Privacy Policy is:

T.M.S Motorcity LTD

Trading as: Motorcity
Email: info@tmsmotorcity.com
Telephone: 22255508
Website: www.motorcity.com

For questions about this Privacy Policy or to exercise your data-protection rights, contact us using the details above.

3. Personal data we collect

Depending on how you use the application, we may collect the following categories of personal data.

3.1 Account and profile information

When you register or manage an account, we may collect:

First name and last name.
Email address.
Telephone number.
Encrypted or securely hashed password information.
Account status.
Date and time of registration.
Date and time of your most recent login.
Marketing-consent preference.
Authentication and security information associated with your account.

We do not store your password in readable form.

3.2 Information received through Google sign-in

When you choose Continue with Google, Google may provide us with basic account information authorised by you, such as:

Your Google account’s unique identifier.
Your name.
Your email address.
Confirmation that your email address has been verified.
Basic profile information made available through the openid, email and profile permissions.

We use this information only to authenticate you, create or locate your Motorcity customer account, and provide the application’s services.

Motorcity:

Does not receive or store your Google password.
Does not access your Gmail messages.
Does not access your Google contacts.
Does not access your Google Drive files.
Does not post content to your Google account.
Does not use Google user data for advertising.
Does not sell Google user data.

If an existing Motorcity account uses the same email address, we may ask you to sign in using the original method before linking another login provider. We do not automatically merge accounts solely because their email addresses match.

3.3 Information received through Sign in with Apple

When Sign in with Apple becomes available and you choose to use it, Apple may provide us with:

A unique Apple account identifier.
Your name, usually only during the first authorisation.
Your email address or an Apple private relay email address.

We use this information only to authenticate you and create or locate your Motorcity account.

We do not receive or store your Apple ID password.

3.4 Order information

When you place an order, we may process:

Your customer account identifier.
Products, quantities, variants and selected options.
Order type, such as takeaway, delivery or dine-in, where available.
Order date and time.
Order number.
Order value and selected payment method.
Preparation estimates.
Order status and operational timestamps.
Cancellation status and cancellation reason.
Notes or instructions you submit with an order.
Order history.

Staff members may update an order’s status, estimated preparation time and cancellation information as part of fulfilling the order.

3.5 Communications and support information

When you contact us, we may collect:

Your name and contact details.
The contents of your request or complaint.
Relevant order or account information.
Our response and follow-up correspondence.

3.6 Technical, device and security information

When you use the application or related API services, we may automatically process limited technical information, including:

IP address.
Device and operating-system information.
Application version.
Authentication-session identifiers.
Login and security events.
Error and diagnostic logs.
Dates and times of requests.
Information necessary to detect misuse, failed login attempts or security threats.

We use this information to operate, troubleshoot and secure the application.

3.7 Push-notification information

When push notifications are introduced and you enable them, we may process:

A device notification token.
Device platform.
Notification preferences.
The date the device was registered or last active.

The token allows us to send order-related notifications, such as an accepted order, preparation delay, cancellation or an order that is ready for collection.

A notification token does not give us access to other information stored on your device.

4. How we use your personal data

We process personal data for the following purposes.

Providing the service

We use your information to:

Register and authenticate your account.
Maintain your customer profile.
Process and fulfil orders.
Display your order history.
Provide real-time order tracking.
Communicate order-status information.
Provide customer support.
Allow you to update or delete your account.

The legal basis for this processing is generally that it is necessary to perform our contract with you or take steps requested by you before entering into that contract.

Security and service operation

We use relevant information to:

Protect customer accounts.
Prevent fraudulent or unauthorised access.
Investigate technical problems.
Maintain service availability.
Detect misuse.
Maintain audit and security records.
Improve the reliability and usability of the application.

The legal basis is our legitimate interest in operating and protecting Motorcity’s services, customers and business.

Legal and accounting obligations

We may retain and process certain order, transaction and accounting information where necessary to comply with:

Tax and accounting obligations.
Record-keeping requirements.
Lawful requests from authorities.
Legal claims and dispute resolution.

The legal basis is compliance with our legal obligations and, where applicable, our legitimate interest in establishing, exercising or defending legal claims.

Marketing

Where you have actively consented, we may use your contact information to send Motorcity promotions, offers or relevant news.

Marketing consent is optional and is not required to place an order or maintain an account.

You may withdraw your consent at any time through the application, where available, or by contacting us.

5. Google user data

Motorcity’s use and transfer of information received from Google APIs will comply with the applicable Google API Services User Data Policy and relevant Limited Use requirements.

We use Google user data only to:

Confirm your identity.
Create or locate your Motorcity account.
Sign you into the application.
Display the basic account information needed to provide the service.
Protect the security of your account.

We do not use Google user data:

For targeted advertising.
To build advertising profiles.
To sell personal information.
To determine creditworthiness.
For unrelated analytics or marketing purposes.
For purposes materially different from those described in this Privacy Policy.

Google user data is disclosed only where necessary to service providers acting on our behalf, where required by law, or where you have expressly authorised the disclosure.

When you delete your Motorcity account, we remove the external Google login association and delete or anonymise associated profile data, except for information that must be retained for legal, accounting, security or dispute-resolution purposes.

You may also manage or revoke Motorcity’s access through your Google account settings.

6. Who we share personal data with

We may share limited personal data with trusted service providers where necessary to operate the application, including:

Cloud-hosting and database providers.
Authentication providers such as Google and Apple.
Email, messaging or customer-support providers.
Push-notification providers, such as Firebase Cloud Messaging, when enabled.
Payment-service providers, if online payments are introduced.
Technical support, security and infrastructure providers.
Accountants, auditors, insurers and professional advisers.
Public authorities, regulators or law-enforcement bodies where legally required.

These recipients receive only the data reasonably necessary for their assigned purpose.

We do not sell or rent personal data.

We do not share personal data with unrelated third parties for their independent advertising purposes.

7. International data transfers

Some technology providers may process information in countries outside Cyprus or the European Economic Area.

Where personal data is transferred internationally, we take reasonable steps to ensure that an appropriate legal safeguard is used, such as:

A European Commission adequacy decision.
Standard contractual clauses.
Another transfer mechanism permitted under applicable data-protection law.

The availability and location of processing may depend on the providers used to operate the application.

8. How long we keep your information

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy.

Generally:

Account information is retained while your account remains active.
Active authentication sessions are retained until they expire, are revoked or you log out.
Order and transaction records may be retained for the period required by applicable accounting, tax and legal obligations.
Customer-support correspondence is retained for as long as reasonably necessary to resolve the matter and maintain appropriate records.
Security and diagnostic logs are retained for a limited period appropriate to their security or troubleshooting purpose.
Marketing information is retained until you withdraw consent or the information is no longer required.
Disabled device-notification tokens are deleted or anonymised when no longer needed.

When you delete your account, personal profile data is deleted or anonymised unless retention is required by law or necessary for legal claims, fraud prevention, security or accounting.

Historical orders may be retained in an anonymised or restricted form so that Motorcity can maintain required financial and operational records.

9. How we protect personal data

We use reasonable technical and organisational safeguards designed to protect personal information, including:

Secure password hashing.
Encrypted HTTPS communications.
Access controls and role-based permissions.
Secure authentication tokens.
Rotating and revocable session tokens.
Restricted staff access.
Account lockout and failed-login protection.
Database and infrastructure safeguards.
Logging and monitoring of relevant security events.
Measures intended to prevent unauthorised access, alteration, loss or disclosure.

No system can guarantee absolute security. Customers should use a strong, unique password and keep their devices and account details secure.

10. Your data-protection rights

Subject to applicable conditions and exceptions, you may have the right to:

Be informed about how your data is used.
Request access to personal data held about you.
Correct inaccurate or incomplete information.
Request deletion of your personal data.
Request restriction of processing.
Object to certain processing.
Receive certain information in a portable, machine-readable format.
Withdraw consent at any time where processing is based on consent.
Object to direct marketing at any time.
Lodge a complaint with a supervisory authority.

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights, contact:

info@tmsmotorcity.com

We may ask for information necessary to confirm your identity before responding to a request.

11. Account deletion

You may request deletion of your Motorcity account from within the application’s account settings, where this functionality is available.

Account deletion may result in:

Revocation of active sessions.
Removal of linked Google or Apple login associations.
Deletion or anonymisation of profile information.
Deactivation of push-notification registrations.
Loss of access to order history and other account features.

Certain order and financial records may be retained where required by law or necessary for accounting, fraud prevention, dispute resolution or legal claims. Where possible, such records will be separated from your active customer profile or anonymised.

Account deletion is permanent and may not be reversible.

12. Marketing and notification choices

You may manage marketing consent through the application or contact us to withdraw consent.

Operational communications necessary to provide the service are not marketing. For example, we may still communicate information about:

An order you placed.
A cancellation.
Account security.
Important service or policy changes.
A response to a support request.

You can disable push notifications through your device settings. Disabling notifications does not prevent you from viewing order status inside the application.

13. Automated decision-making

Motorcity does not currently use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects concerning customers.

14. Third-party services and links

The application may direct you to services operated by third parties, including Google, Apple, payment providers or map services.

Those organisations process personal data under their own terms and privacy policies. Motorcity is not responsible for the content or privacy practices of independent third-party services.

15. Changes to this Privacy Policy

We may update this Privacy Policy when:

Application features change.
New service providers are introduced.
Legal requirements change.
Our processing activities change.

The updated version will be published on this page with a revised “Last updated” date.

Where a change materially affects customers, we may also provide notice through the application or another appropriate communication channel.

16. Complaints

We encourage you to contact us first so that we can try to resolve your concern.

You also have the right to lodge a complaint with the supervisory authority in Cyprus:

Office of the Commissioner for Personal Data Protection
15 Kypranoros Street
1061 Nicosia, Cyprus
Telephone: +357 22 818456
Email: commissioner@dataprotection.gov.cy

The Cyprus Commissioner confirms that individuals may submit a complaint where they believe processing of their personal data infringes the GDPR.

17. Contact us

For privacy questions, account-deletion requests or requests to exercise your rights, contact us on info@tmsmotorcity.com