Privacy Policy

This Privacy Policy explains how OrderWeb Ltd (“OrderWeb”, “we”, “us” or “our”) collects, uses, stores and protects personal information.

OrderWeb Ltd is a company incorporated in England and Wales.

Company number: 12760826 Location: Brockley, London, United Kingdom Privacy contact: mail@orderweb.co.uk

OrderWeb provides software and digital services to businesses, with a particular focus on restaurants and food-service businesses.

Our services may include:

• online restaurant ordering systems;
• local point-of-sale (“POS”) software;
• restaurant websites;
• table reservations;
• customer accounts;
• loyalty functionality;
• gift cards and online shops;
• payment-provider integrations;
• SMS and email notifications;
• website design and development;
• web application development;
• custom software development;
• design and media services, including video or other digital content where agreed with a customer; and
• maintenance, support and agreed post-development editing services.

This Privacy Policy primarily explains how OrderWeb Ltd processes personal data for its own business purposes.

Where a restaurant or other business uses the OrderWeb platform to process information about its own customers or personnel, that business will generally be the Data Controller and OrderWeb will generally act as its Data Processor for that processing. Further information about that relationship is contained in our Data Processing Agreement (DPA).

The information we collect depends on how you interact with OrderWeb and which services you use.

We may collect the following categories of personal information.

2.1 Contact and enquiry information

When you contact us, request information, ask for a demonstration, request a quotation or discuss a project, we may collect:

• your name;
• email address;
• telephone number;
• business or restaurant name;
• job title or role;
• correspondence with us;
• project requirements;
• quotation or proposal information; and
• other information you choose to provide.

2.2 OrderWeb customer information

If you or your business becomes an OrderWeb customer, we may collect:

• your name;
• business name;
• business address;
• email address;
• telephone number;
• billing and invoicing details;
• account information;
• subscription or service information;
• contracts and agreements;
• support requests;
• communications with us; and
• records relating to services provided to your business.

2.3 Website, design and software-development projects

Where you engage OrderWeb to design, develop, edit, maintain or support a website, web application, software application, video, design or other digital project, we may process:

• project contact information;
• project requirements and specifications;
• text, images, video or other materials supplied to us;
• website or application content;
• technical information;
• hosting and domain information where relevant;
• support communications;
• credentials or access information where necessary to provide the agreed service; and
• other information reasonably required to complete and support the project.

Access credentials and other sensitive technical information should only be provided where necessary. We take reasonable measures to restrict access to such information.

2.4 Technical and website information

When you visit our website or use our services, we may receive technical information such as:

• IP address;
• browser type and version;
• device type;
• operating system;
• pages visited;
• date and time of access;
• referral information;
• security and application logs;
• cookie identifiers; and
• approximate geographic information derived from an IP address.

Some of this information may only be collected where the relevant cookies or technologies have been enabled or consent has been provided where required.

2.5 Account and authentication information

Where an OrderWeb account is provided, we may process:

• name;
• email address;
• telephone number;
• account identifiers;
• password hashes;
• authentication information;
• session information;
• login records; and
• security logs.

Passwords should be stored using appropriate cryptographic hashing rather than in readable form.

2.6 Billing and payment information

We may process information necessary to invoice customers and administer payments, including:

• billing name;
• billing address;
• invoice information;
• amounts due or paid;
• payment status;
• payment-provider references; and
• transaction identifiers.

Where card payments are accepted, card information may be collected and processed by third-party payment providers.

OrderWeb does not intentionally store full payment-card numbers, PINs or card verification values such as CVV/CVC in its application databases.

OrderWeb provides software that enables restaurants and other food-service businesses to interact with their customers.

Depending on the services enabled by a restaurant, the OrderWeb platform may process information including:

• customer names;
• email addresses;
• telephone numbers;
• delivery addresses;
• billing addresses;
• food orders;
• items and quantities ordered;
• order values;
• collection or delivery preferences;
• order notes or special instructions;
• table-booking information;
• customer account information;
• saved addresses;
• order history;
• loyalty points and loyalty transaction history;
• marketing preferences and consent records;
• gift card information;
• shop purchases;
• payment status;
• payment-provider references; and
• related transactional information.

In most circumstances involving a restaurant's own customer data, the restaurant is the Data Controller and OrderWeb acts as a Data Processor on the restaurant's behalf.

The restaurant determines why its customer information is collected and how it is used for purposes such as fulfilling orders, managing reservations, administering loyalty programmes and communicating with its customers.

Restaurant customers should therefore also read the privacy notice provided by the restaurant from which they are ordering or making a booking.

Our processing of this information on behalf of restaurant customers is additionally governed by our Data Processing Agreement and contractual arrangements with the relevant restaurant.

There may be limited circumstances where OrderWeb processes certain information as an independent Controller, for example where necessary for platform security, fraud prevention, compliance with law or the establishment, exercise or defence of legal claims.

OrderWeb integrates with third-party payment service providers.

Depending on the restaurant or service, these providers may include providers such as Stripe, Worldpay, Global Payments, Adyen, Teya, PayPal or other supported payment services.

For many online payment transactions, customers are redirected to a payment provider's hosted payment environment.

For certain integrations, secure payment fields or payment components supplied by the payment provider may appear within an OrderWeb-powered page.

In these circumstances, payment-card information is intended to be transmitted directly to the relevant payment provider rather than stored in OrderWeb's application databases.

OrderWeb may receive and process information such as:

• payment status;
• transaction reference;
• payment-provider identifier;
• merchant reference;
• payment token;
• card brand; and
• masked card information, such as the final four digits, where supplied by the payment provider.

Payment providers process payment information according to their own contractual arrangements, regulatory obligations and privacy policies.

Depending on the circumstances, we may use personal information to:

• respond to enquiries;
• provide quotations and proposals;
• arrange demonstrations;
• establish and manage customer relationships;
• provide our SaaS services;
• provide online ordering and POS functionality;
• design and develop websites;
• develop web applications and custom software;
• provide design, video or other agreed digital services;
• provide agreed editing, maintenance and support;
• manage customer accounts;
• provide technical support;
• communicate about services;
• issue invoices and administer payments;
• maintain business and accounting records;
• secure our websites, applications and infrastructure;
• authenticate users;
• investigate errors and technical problems;
• prevent fraud, abuse and unauthorised access;
• monitor the reliability and performance of our systems;
• improve our products and services;
• comply with legal and regulatory requirements;
• establish, exercise or defend legal claims; and
• send marketing communications where permitted by law.

We do not sell personal information.

Under UK data-protection law, we must have a lawful basis for processing personal information.

Depending on the activity, we may rely on the following bases.

Contract

We may process personal information where necessary to enter into or perform a contract with you.

For example, this may apply when providing an agreed service to an individual customer.

Legitimate interests

We may process personal information where necessary for our legitimate business interests, provided those interests are not overridden by your rights and interests.

These interests may include:

• operating our business;
• responding to business enquiries;
• supporting customers;
• maintaining and improving our products;
• securing our systems;
• preventing fraud and abuse;
• maintaining appropriate business records; and
• protecting our legal rights.

Legal obligation

We may process information where necessary to comply with a legal obligation, including applicable tax, accounting, regulatory or law-enforcement requirements.

Consent

Where required, we may rely on your consent.

This may apply, for example, to certain:

• marketing communications;
• analytics technologies;
• advertising technologies; or
• non-essential cookies.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

We may send information about OrderWeb products or services where we have an appropriate lawful basis to do so.

Where consent is required, we will request it before sending the relevant marketing communication.

You can unsubscribe from marketing communications using an unsubscribe facility included in the communication, where available, or by contacting mail@orderweb.co.uk.

Service messages, security alerts, billing information and other communications necessary to provide an existing service are not necessarily marketing communications.

Where restaurants use OrderWeb functionality to send marketing messages to their own customers, the restaurant is generally responsible for establishing the appropriate lawful basis and complying with applicable direct-marketing requirements.

Our websites and software may use cookies and similar technologies.

Some cookies are necessary to:

• operate websites and applications;
• maintain sessions;
• authenticate users;
• maintain security;
• remember essential preferences; or
• provide functionality requested by the user.

We may also use optional analytics or other non-essential technologies.

Where required by law, non-essential cookies or similar technologies will only be used after the appropriate consent has been obtained.

Where applicable, further details about the cookies used by a website should be provided through the relevant cookie notice or consent interface.

You may also be able to control cookies using your browser settings.

Further information is available in our Cookie & Similar Technologies Policy.

We may share personal information with trusted service providers where reasonably necessary to operate our business and provide our services.

These may include providers of:

• cloud hosting and infrastructure;
• database and storage services;
• payment processing;
• email delivery;
• SMS delivery;
• website hosting;
• domain services;
• analytics;
• monitoring and error reporting;
• customer support tools;
• accounting or professional services;
• security services; and
• other technical infrastructure.

For OrderWeb platform services, providers may include, depending on the services and integrations in use:

• Amazon Web Services;
• Google Cloud Platform;
• Stripe;
• Worldpay;
• Global Payments;
• Adyen;
• Teya;
• Twilio;
• SendGrid; and
• other providers required to deliver configured services.

Not every provider necessarily processes information relating to every OrderWeb customer.

Where a provider acts as our Processor or Sub-processor, we take appropriate steps to require it to protect personal information in accordance with applicable data-protection requirements.

We may also disclose information where reasonably necessary:

• to comply with law;
• to respond to lawful requests from authorities;
• to enforce contractual rights;
• to investigate fraud or security incidents;
• to establish, exercise or defend legal claims; or
• as part of a corporate transaction such as a merger, acquisition, restructuring or sale of relevant business assets, subject to applicable law.

Some service providers may process personal information outside the United Kingdom.

Where UK data-protection law treats such processing as a restricted international transfer, we take steps designed to ensure that an appropriate lawful transfer mechanism applies.

Depending on the circumstances, this may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement (“IDTA”);
• the UK Addendum to the European Commission Standard Contractual Clauses; or
• another transfer mechanism or exception permitted under UK data-protection law.

The specific mechanism may vary depending on the provider, country and processing activity.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, accounting, security and dispute-resolution requirements.

Different information may therefore have different retention periods.

When determining retention periods, we may consider:

• the nature of the information;
• why it was collected;
• whether an active customer relationship exists;
• contractual requirements;
• legal and regulatory requirements;
• accounting and tax obligations;
• security requirements;
• limitation periods for legal claims; and
• whether the information is contained within routine backups.

Where OrderWeb Processes restaurant customer information as a Processor, retention may also depend on instructions from the relevant restaurant and the applicable customer agreement and DPA.

When information is no longer reasonably required, we will delete, anonymise or otherwise dispose of it as appropriate.

We use technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, disclosure or access.

Depending on the systems involved, measures may include:

• encrypted connections;
• access controls;
• authentication controls;
• multi-factor authentication for appropriate privileged systems;
• tenant-separation controls;
• cryptographic protection for sensitive credentials and secrets;
• logging and monitoring;
• backups;
• restricted production access;
• vulnerability management;
• secure software-development practices; and
• incident-response procedures.

No internet-based service can guarantee absolute security. We continually review appropriate measures according to the nature and risks of our processing.

Depending on the circumstances and applicable law, you may have rights including:

• the right of access to personal information held about you;
• the right to rectification of inaccurate or incomplete information;
• the right to erasure in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to object to certain processing;
• the right to data portability in certain circumstances;
• the right to withdraw consent where processing relies on consent; and
• rights relating to certain forms of automated decision-making.

These rights are not absolute and may be subject to legal conditions and exemptions.

To exercise a right concerning information for which OrderWeb is the Controller, contact mail@orderweb.co.uk.

If your request concerns information held by a restaurant using OrderWeb — for example your food-order history, restaurant loyalty account or table reservation — the restaurant will generally be the Controller.

In that situation, you should normally contact the restaurant directly. Where appropriate, OrderWeb will assist the restaurant with responding to requests in accordance with our contractual and legal obligations.

If you have concerns about how OrderWeb handles your personal information, please contact us first so that we can investigate.

Email: mail@orderweb.co.uk

You also have the right to complain to the UK's independent data-protection regulator:

Information Commissioner's Office (ICO)

Information about making a complaint is available from the ICO's official website.

OrderWeb's business services are intended primarily for businesses and their customers and are not designed as services directed specifically at children.

Restaurants using OrderWeb remain responsible for ensuring that their collection and use of customer information is lawful, including where their services may be used by children.

Where OrderWeb becomes aware that information has been processed unlawfully in relation to a child, we will take appropriate action in accordance with applicable law and our obligations as Controller or Processor.

Our websites and applications may contain links to or integrations with third-party websites and services.

Those third parties may process personal information under their own privacy policies.

OrderWeb is not responsible for the privacy practices of independent third parties, and you should review their privacy information where appropriate.

We may update this Privacy Policy from time to time to reflect:

• changes to our services;
• changes to our technology or infrastructure;
• changes to service providers;
• changes in applicable law or regulatory guidance; or
• changes to how we process personal information.

When we make changes, we will update the “Last updated” date at the top of this policy.

Where a change is significant and applicable law requires additional notice, we will take reasonable steps to provide that notice.

If you have questions about this Privacy Policy, how OrderWeb handles personal information or wish to exercise a data-protection right, contact:

OrderWeb Ltd Company number: 12760826 Brockley, London United Kingdom

Email: mail@orderweb.co.uk

Related documents: Data Processing Agreement (DPA) · Terms & Conditions · Master SaaS Agreement · Cookie Policy