1. The parties
| Controller | The venue (restaurant, bar, pizzeria, food service or take-away business) that subscribes to Ordo and uses it to receive and manage orders. Hereinafter the "Controller". |
|---|---|
| Processor | Hestia Properties S.r.l., Viale Certosa 218, 20156 Milan, Italy, VAT IT10649831210 — provider of the Ordo software. Hereinafter the "Processor". |
This agreement supplements the Terms of Service, is accepted together with them and remains in force for the duration of the subscription. For the data of the venue's own account and subscription, Hestia acts as an independent controller: that processing is described in the Privacy Policy and falls outside this agreement.
2. Subject matter of the processing
2.1 Categories of data subjects
- The venue's customers who order through the digital menu, at the table, for take-away or delivery;
- The venue's staff with access to Ordo (managers, waiters, cashiers, kitchen).
2.2 Categories of personal data
| Area | Data processed |
|---|---|
| Venue customers | Name, phone number, email if provided, delivery addresses, table number, order notes, order history, device identifier, marketing consent preferences |
| Notifications | Browser push notification subscriptions, used to update the customer on the order status and, where the customer has consented, for the venue's communications |
| Staff | Name, email, login credentials (passwords stored only as hashes), role, access log |
The Service is not designed to process special categories of data (Article 9). If a customer enters such information in the order notes — for example a food allergy or intolerance — it is stored as part of the order and processed solely to prepare and deliver that order.
2.3 Purposes
The Processor processes the data solely to provide the functions of the Service requested by the Controller: receiving and managing orders, deliveries, updating customers on order status, managing staff and access permissions, the venue's communications to customers who have consented, and technical support on request.
The Processor does not use the Controller's customer data for its own purposes, does not disclose it to third parties other than the sub-processors in §6, does not combine it with data of other venues and does not use it to train artificial intelligence models.
2.4 Duration
Processing lasts for the duration of the subscription. Upon termination §10 applies.
3. Controller's instructions
The Processor processes the data only on documented instructions from the Controller. Instructions consist of this agreement, the Terms of Service and the operations the Controller performs through Ordo. Further instructions may be sent to privacy@ordoapp.cloud. If an instruction appears to infringe the GDPR, the Processor informs the Controller without carrying it out.
4. Processor's obligations
- Confidentiality: persons with access to the data are bound by confidentiality and authorised only to the extent needed for their tasks;
- Security: the measures in §5 are implemented;
- Assistance: the Processor helps the Controller respond to customer requests (§7) and fulfil the obligations of Articles 32-36;
- Breaches: notified in accordance with §8;
- Return or deletion of the data at the end of the relationship (§10).
5. Security measures (Article 32)
- encrypted HTTPS/TLS connections;
- passwords stored exclusively as hashes, never in clear text;
- logical separation of data between venues: each account accesses only its own venue's data;
- account lockout after repeated failed login attempts, protection of forms against automated and cross-site requests;
- content checks on uploaded files and upload folders that do not execute scripts;
- access logging;
- infrastructure in data centres within the European Union (§6).
6. Sub-processors (Article 28(2))
The Controller authorises the Processor to engage the following sub-processor:
| Sub-processor | Service | Location | Agreement |
|---|---|---|---|
| Aruba S.p.A. Via San Clemente 53, 24036 Ponte San Pietro (BG), Italy |
Hosting, database, backups and sending of service emails | Italy (EU) | Signed (Art. 28) |
Services that do NOT process your customers' data on our behalf, listed here for transparency:
- Paysera: if you enable online payments, you connect your own Paysera account. The customer is redirected to Paysera's payment page and card data never passes through our systems: in that relationship Paysera is your provider, not our sub-processor.
- Push notifications: travel through the browsers' notification services (Google, Apple, Mozilla) with end-to-end encrypted content that those services cannot read.
- Automatic translation: the "Translate with AI" function sends to OpenAI only names and descriptions of dishes, categories and ingredients of the menu. No customer or staff data.
New sub-processors. Before engaging one, the Processor informs the Controller at least 30 days in advance. Within that period the Controller may object on legitimate grounds; if the service cannot otherwise be provided, the Controller may terminate without penalty. Every sub-processor is bound by obligations equivalent to those of this agreement.
7. Data subjects' rights
Requests for access, rectification, erasure, restriction, objection and portability must be addressed to the Controller, i.e. the venue. The Processor assists through the functions of the Service and, where necessary, with technical support. A request received directly by the Processor is forwarded to the Controller without delay.
8. Personal data breaches (Articles 33-34)
Upon becoming aware of a breach affecting data processed on behalf of the Controller, the Processor informs the Controller without undue delay and in any case within 48 hours, stating the nature of the breach, the categories and approximate number of data subjects concerned, the likely consequences and the measures taken. Notification to the supervisory authority and communication to data subjects remain the Controller's responsibility.
9. Audits
The Controller may request in writing the information needed to verify compliance with this agreement, which the Processor provides within 30 days.
10. End of the relationship
Upon termination of the subscription the Controller may export its data. The Processor retains it for a further 30 days, then deletes it together with any copies, except where retention is required by law. On written request, the Processor confirms the deletion.
11. Language and contacts
This agreement is also available in Italian. In case of any discrepancy between the versions, the Italian version prevails.
Hestia Properties S.r.l. — Viale Certosa 218, 20156 Milan, Italy — VAT IT10649831210
Email: privacy@ordoapp.cloud — PEC:
hestiapropertiessrl@pec.it