This Privacy Policy explains how we collect, use, store and protect personal data when you visit our website, contact us, enquire about or purchase our products and services, use an OrderSense® service directly, communicate with us, or otherwise interact with OrderSense.
It also explains our role when we provide technology and managed services to restaurants and other businesses.
1. Our role under data protection law
OrderSense® may act in different capacities depending on how our services are being used.
OrderSense® as a data controller
OrderSense® is the data controller for personal data that we process for our own business purposes. This includes information relating to our customers, prospects, business contacts, suppliers, partners, website visitors and other individuals who interact with OrderSense.
Where OrderSense® is the data controller, we determine why and how the personal data is processed and are responsible for complying with applicable data protection law.
OrderSense® as a data processor
OrderSense® also provides online ordering, ePOS, kiosk, customer management, loyalty, marketing and related technology services to restaurants and other businesses. Where we process personal data on behalf of one of our customers, such as a restaurant, and in accordance with that customer's documented instructions, that customer is generally the data controller and OrderSense acts as its data processor.
For example, where a restaurant uses OrderSense® to operate its online ordering service, that restaurant is responsible for determining the purposes for which its customers' personal data is processed, while OrderSense processes that data on the restaurant's behalf under the terms of our agreement with them.
In those circumstances, the restaurant's privacy policy is the primary privacy notice for the restaurant's customers. OrderSense® does not determine the purposes for which restaurant customers' personal data is used merely because we provide the technology or operate the service.
Where OrderSense® processes personal data for its own independent purposes, we may act as a separate data controller for that specific processing.
2. Information we collect as a data controller
Depending on how you interact with OrderSense®, we may collect the following information.
Business and contact information
This may include your name, job title, company name, business address, email address, telephone number and other professional contact information.
Customer and account information
If you purchase or use OrderSense® products or services directly, we may collect information required to establish and manage your account, provide services, process invoices and payments, communicate with you and provide customer support.
Enquiry and sales information
If you contact us, request information, arrange a demonstration or enquire about our products or services, we may collect information about your enquiry, your requirements, communications with you and information relevant to managing our relationship with you.
Support and service information
When you contact our support or service teams, we may collect information required to identify you, understand and resolve the issue and manage the service provided to you. This may include communications, technical information, device information, service configuration information and relevant system activity.
Marketing preferences
We may record whether you have agreed to receive marketing communications from OrderSense®, the communication channel involved, and when and how your preference was obtained. We may also maintain records of unsubscribe requests, objections and suppression requirements so that we can respect your preferences.
Payment and billing information
Where you purchase services directly from OrderSense®, we may collect information required for billing, payment administration, accounting and credit control. Where payments are processed by a third-party payment service provider, payment card details may be collected and processed directly by that provider.
Website and technical information
When you use the OrderSense® website, we may collect information such as your IP address, browser type, device information, operating system, pages visited, referring website, approximate location and information about how you interact with our website. Some of this information may be collected through cookies and similar technologies.
3. How OrderSense® uses personal data as a controller
We may use personal data for the following purposes.
Providing our products and services
We use personal data to provide, configure, operate and support the products and services that we supply directly to our customers.
Lawful basis: Performance of a contract, or taking steps at the request of the individual before entering into a contract.
Managing customer relationships
We may use contact information to communicate with customers, manage accounts, respond to enquiries, arrange demonstrations, provide support and administer our business relationship.
Lawful basis: Performance of a contract and, where appropriate, legitimate interests.
Billing, accounting and payment administration
We may process information to issue invoices, collect payments, maintain accounting records, manage credit control and comply with tax and financial obligations.
Lawful basis: Performance of a contract and legal obligation, as applicable.
Service security and fraud prevention
We may process technical and account information to protect our systems, detect fraud, prevent misuse, maintain information security and investigate security incidents.
Lawful basis: Legitimate interests and, where applicable, legal obligation.
Improving our products and services
We may analyse service usage, support information, technical information and customer feedback to maintain, develop and improve our products and services. Where possible, we will use appropriate aggregation, anonymisation or minimisation techniques where detailed personal data is not required.
Lawful basis: Legitimate interests, where appropriate.
Business administration
We may use personal data for internal administration, reporting, record keeping, corporate governance, insurance, professional advice and the management of our business.
Lawful basis: Legitimate interests and legal obligation, where applicable.
4. Marketing
We may use personal data to promote OrderSense® products and services, including online ordering, ePOS, kiosks, payment-related solutions, loyalty, customer engagement, automation and other services we provide.
Where required by law, we will obtain appropriate consent before sending direct marketing by email, SMS or other electronic communications. Where consent is not required by applicable law, we may rely on legitimate interests where we have completed an appropriate assessment and the processing is proportionate and reasonably expected.
We will always provide an appropriate way to opt out of marketing communications and will respect objections and unsubscribe requests.
The rules applicable to electronic marketing depend on the type of recipient and communication method. For example, PECR treats corporate subscribers differently from individual subscribers, while UK GDPR still applies where personal data relating to an identifiable business contact is processed.
Where consent is required, it must involve a clear affirmative action and must be specific and informed. We will maintain appropriate records of marketing consent where relevant.
You may object to our use of your personal data for direct marketing at any time. Where you object, we will stop using your personal data for direct marketing purposes, subject to limited processing necessary to maintain an appropriate suppression record.
5. Marketing to restaurant and business customers
OrderSense® primarily operates in a business-to-business environment. We may contact businesses and their representatives about OrderSense products and services where permitted by applicable law.
Where we process personal data relating to an identifiable business contact, such as an individual's name, email address or telephone number, UK data protection law still applies.
For corporate subscribers, PECR does not generally require consent for direct marketing by email or text, although we must identify ourselves and provide a valid means of opting out.
Where we contact sole traders or certain partnerships, different PECR requirements may apply and consent may be required unless a lawful exception such as the soft opt-in applies.
We will assess our marketing activity based on the recipient, communication method and applicable legal requirements rather than assuming that all business marketing is exempt.
6. Data processed on behalf of restaurant customers
When a restaurant or other business uses OrderSense® technology to collect and process customer information, OrderSense may process personal data including:
- customer names;
- telephone numbers;
- email addresses;
- delivery addresses;
- order and transaction history;
- booking information;
- loyalty information;
- marketing preferences;
- customer communications;
- technical and usage information; and
- other information configured by the customer within the OrderSense® platform.
In these circumstances, the restaurant or business remains responsible for determining the purposes and lawful basis for processing its customers' personal data. OrderSense® processes that data on behalf of the customer in accordance with the applicable Data Processing Agreement and documented instructions.
For example, where a restaurant instructs OrderSense® to send a promotional campaign to customers who have opted into marketing, OrderSense may configure, manage and execute that campaign as the restaurant's processor. The restaurant remains responsible for determining the purpose of the campaign, the audience, the offer and the lawful basis.
7. OrderSense®'s use of processor data
OrderSense® will not use personal data processed solely on behalf of a restaurant or other customer for OrderSense's own independent purposes unless such use is authorised by the customer, required by law, or OrderSense is otherwise acting as a separate controller for a specific and clearly identified purpose.
Where OrderSense® wishes to use information beyond the customer's instructions, we will assess the applicable data protection requirements and, where necessary, identify the appropriate lawful basis, controller role and privacy information.
This distinction is important because processing personal data for a customer's purposes is different from deciding to process that information for OrderSense®'s own purposes.
8. Loyalty and customer engagement services
Where OrderSense® provides loyalty, rewards, customer engagement or similar functionality on behalf of a restaurant, the restaurant generally determines the purpose of the processing and the rules of the loyalty programme. OrderSense provides the technology and operational services necessary to administer the programme.
Where OrderSense® uses personal data solely to operate such services on behalf of the restaurant, it acts as the restaurant's processor. Any use of that information by OrderSense for its own purposes will be assessed separately under applicable data protection requirements.
9. How we share personal data
We may share personal data where necessary to provide our services, operate our business, comply with legal requirements or protect our rights. Depending on the circumstances, recipients may include:
Service providers and sub-processors
We may use specialist providers for services such as cloud hosting, infrastructure, email delivery, SMS delivery, payment processing, analytics, security, customer support, backups and other technology services. Where these providers process personal data on our behalf, we will require appropriate contractual and security arrangements.
Payment providers
Where relevant, payment information may be processed by payment service providers to complete transactions, manage refunds, detect fraud and support payment administration.
Professional advisers
We may share relevant information with legal, accounting, insurance, audit and other professional advisers where necessary.
Authorities and legal recipients
We may disclose personal data where required by law, court order, regulatory requirement or lawful request from a public authority, or where necessary to establish, exercise or defend legal rights.
Business transactions
If OrderSense® is involved in a merger, acquisition, investment, restructuring, sale of assets or other corporate transaction, personal data may be disclosed as part of that process where legally permitted and subject to appropriate safeguards.
10. International data transfers
Some of our service providers or subprocessors may process personal data outside the United Kingdom.
Where personal data is transferred outside the UK, we will ensure that the transfer is made using an appropriate lawful mechanism and that appropriate safeguards are in place as required by applicable data protection law. This may include an adequacy decision, appropriate contractual safeguards or another legally recognised transfer mechanism.
11. Cookies and similar technologies
Our websites may use cookies and similar technologies.
Strictly necessary cookies may be used where they are required to provide services requested by the user, maintain security, manage sessions or operate core website functionality.
Where we use analytics, advertising or other non-essential cookies or similar technologies that require consent, we will obtain appropriate consent before using them. You may manage your cookie preferences through our cookie consent mechanism where available. Further information is available in our Cookie Policy.
PECR applies to the use of cookies and similar technologies alongside UK data protection law.
12. How long we keep personal data
We retain personal data only for as long as necessary for the purposes for which it was collected, taking account of our legal, contractual, operational and legitimate business requirements. Retention periods vary depending on the nature of the information. For example:
- customer and contractual records may be retained for the duration of the business relationship and for an appropriate period afterwards;
- financial and accounting records may be retained for periods required by law;
- support and technical records may be retained for as long as reasonably necessary to manage the service, investigate incidents and improve security;
- marketing preferences may be retained while necessary to manage marketing activity and demonstrate consent or objection; and
- suppression records may be retained so that we do not inadvertently send further marketing to people who have opted out.
Where we process personal data on behalf of a restaurant or other customer, retention is generally determined by that customer in accordance with its instructions and our contractual arrangements.
13. Your data protection rights
Where OrderSense® is the data controller, you may have rights under applicable data protection law, including:
- the right to request access to your personal data;
- the right to request correction of inaccurate or incomplete information;
- the right to request erasure in certain circumstances;
- the right to request restriction of processing in certain circumstances;
- the right to object to certain processing;
- the right to data portability where applicable; and
- the right to withdraw consent where consent is our lawful basis.
These rights are subject to legal conditions and exceptions. You have an absolute right to object to the processing of your personal data for direct marketing purposes.
Where OrderSense® acts only as a processor for a restaurant or other business, requests concerning that customer's customers' personal data should normally be directed to the relevant restaurant or business, which remains the data controller. We will assist the relevant controller in accordance with our contractual and legal obligations where required.
14. Exercising your rights
If you have a privacy question or wish to exercise your rights in relation to personal data for which OrderSense® is the controller, please contact:
OrderSense® Ltd
Email: malik.tahir@ordersense.co.uk
We may need to verify your identity before responding to certain requests.
Where your request relates to personal data that OrderSense® processes solely on behalf of one of our restaurant or business customers, we may refer your request to that customer or assist the customer in responding to it, in accordance with our contractual arrangements.
15. Security
OrderSense® takes appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access. Our security measures may include:
- access controls and authentication;
- role-based permissions;
- encryption where appropriate;
- secure infrastructure;
- monitoring and logging;
- backup and recovery measures;
- vulnerability and security management;
- incident response procedures;
- staff confidentiality requirements; and
- regular review of technical and organisational safeguards.
The specific security measures applied may vary according to the nature of the service, the sensitivity of the information and the risks involved. No internet-based service can be guaranteed to be completely secure, but we continually review and improve our security controls.
16. Data breaches and security incidents
OrderSense® maintains procedures for identifying, managing and responding to actual or suspected personal data breaches and other security incidents.
Where OrderSense® acts as a processor, we will notify the relevant controller without undue delay where required by applicable law and the relevant Data Processing Agreement, and will provide reasonable assistance in investigating and responding to the incident.
Where OrderSense® is the data controller, we will assess and manage the incident in accordance with applicable data protection requirements.
17. Children's privacy
OrderSense®'s services are primarily intended for businesses and their customers and are not specifically directed at children.
Where OrderSense® processes children's personal data on behalf of a restaurant or other customer, the relevant controller remains responsible for determining the appropriate lawful basis and safeguards. OrderSense will process such information only in accordance with the applicable controller's instructions and applicable law.
18. Third-party websites and services
Our website and services may contain links to third-party websites or integrate with third-party services.
We are not responsible for the privacy practices, content or security of third-party websites or services. You should review the relevant third party's privacy notice before providing personal information to them.
19. Complaints
If you have concerns about how OrderSense® has handled your personal data, please contact us first so that we can investigate and seek to resolve the issue.
You also have the right to complain to the UK's data protection supervisory authority, the Information Commissioner's Office (ICO). Further information is available at ico.org.uk.
20. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our products, services, technology, legal requirements or data-processing activities.
The "Last updated" date at the top of this policy indicates when it was most recently changed. Where appropriate, we may provide additional notice of significant changes.
21. Contact us
Data Protection Roles
OrderSense® as Data Controller. For personal data relating to OrderSense®'s own customers, prospects, suppliers, business contacts, website visitors and other individuals with whom we interact directly for our own purposes, OrderSense is the data controller.
OrderSense® as Data Processor. Where we operate online ordering, ePOS, kiosk, loyalty, marketing or related systems on behalf of a restaurant or other business, we may process personal data on that organisation's behalf. In those circumstances, the relevant organisation is generally the data controller and OrderSense® acts as its data processor under a Data Processing Agreement.
The OrderSense® Standard