Who is responsible for your data, what Got collects when you send a purchase request, why, who receives it, where it is kept, for how long, and how to use your rights. Browsing the catalogue collects none of this.
Matches text version GY-UNDERTAKING-v6-email
To review a purchase request Got stores: your name, email, mobile number, delivery address, the photographs of your identity document, your portrait photograph, your signature image, and the request itself. If an agreement follows, Got also keeps the signed agreement, photos of its signed pages, and a record and receipt of every payment. When you sign the agreement on screen, Got keeps the signing record: your drawn signature, the live photo taken with the front camera at signing, the three confirmations you ticked, the time, the version of the agreement you read, the internet (IP) address and the browser or app the signature came from, an identifier of that app installation or browser, and the location of the device if it already allows Got to use it. Each visit is recorded too: when the Got representative scanned your code at your door or for a payment, how (your QR code, your 6-digit code or the owner's logged override), and where the representative's phone was if it shares its location. If you allow notifications in the Got app, Got keeps that phone's notification token to send you your order notices; it is removed when you sign out. Browsing the catalogue stores none of this; it is collected only when you choose to send a request.
Your identity photographs, portrait and signature are encrypted before they are written to disk, using AES-256-GCM, and are kept outside any public web directory. Location and device details that phones add inside photos are removed before a photo is stored. Photos are never served from a public URL and never attached to an email. Only you and authorised Got reviewers can download them, through an authorised link. If your request is approved, your portrait and the front of your identity document are also printed on your hire-purchase agreement so the representative can check your identity at signing. The agreement with those photos can be downloaded by you, Got staff and the representative who comes to sign it; a representative who only collects payments, and the copy of the signed agreement sent to you by post, get it without the photos.
Got's servers are in the United States, so your data is transferred outside Guyana. Encrypted backup copies are kept on the server and by Got's management outside Guyana. Before any photo is uploaded you are asked to agree to this.
Sharing your location is optional. In a request it is sent only if you press the location button and your device grants permission, and it is used to confirm the delivery address and that the request belongs to the country you are shopping in. If you decline, you type your address instead and the request proceeds normally. When you sign an agreement on screen, Got never asks for your location; if your phone or browser already allows Got to use it, the location is added to the signing record as evidence of where the agreement was signed. The representative's phone may record where your code was scanned at a visit. No location is collected while you browse.
A mobile number is required for every purchase request: without it the request cannot be sent. You type it yourself; it is not checked by SMS, and sign-in codes are sent by email only. It is shown to the Got reviewer handling your request and to the representative who arranges the signing visit, and it is printed on your price statement and hire-purchase agreement. It is not sold, and it is not passed to advertisers.
You can delete your account in the Got app or on your account page (api.gotshop.net/account). Photos that are not part of a sent request can be deleted one by one on your account page. Photos of a sent request cannot be deleted one by one; to withdraw a sent request, delete your account (if you have no order) or write to Got. If you have no order, deleting the account deletes your stored documents and requests, sent ones included. When a request sent back for changes is edited, its earlier request document is deleted. Once Got has approved an order for you, the order, its agreement, receipts and payment records, and your sent requests with their photos, are kept as long as the law requires; photos that are not part of a sent request are deleted, and your name, email and phone are removed from your account.
No algorithm approves or refuses your request, and the portrait is not used for biometric face matching or liveness checking. A person reviews the request.
When you sign in, Got records the time, your IP address and details of your browser or app (device, platform and version). Your IP address and the time are also recorded when you accept the data notice. When a Got representative records a signing visit or a payment, the location of the representative's phone at that moment is saved with the record if the phone shares it. Each payment record shows the amount, the time and the representative who received it.
To send a purchase request you must give your full name in Latin letters exactly as on your ID, your address, a mobile number, photos of the front and back of your ID, a portrait and a drawn signature. Without them the request cannot be sent. Sharing your location is optional.
Only people aged 18 or older may send a request. You confirm this before the first photo is taken, together with the data notice.
Got's servers are in the United States, so your data leaves Guyana. Got relies on the consent you give in the data notice, and on the transfer being needed for the request and agreement you ask for (Data Protection Act 2023, section 28). Identity photos, portraits, signatures, signed pages and backups are encrypted with AES-256-GCM. The site, the account page and the app reach the server over an encrypted (HTTPS) connection.
Under the Data Protection Act 2023 (sections 11 to 19) you can ask Got:
Withdrawing consent: delete your account in the Got app or on your account page, delete single photos on your account page, or write to Got. Withdrawal does not undo what was done before it, and records the law requires Got to keep, such as a signed agreement and payment records, are kept.
How to ask: e-mail orders@gotshop.net from the address on your account, with the subject “Privacy”. The Act gives you the right to an answer within one month (section 22).
Complaints: write to Got first at the same address. You may also complain to the Data Protection Commissioner of Guyana under the Data Protection Act 2023.
No automated decision: a person reviews every request.