1. Data Controller
Hestia Properties S.r.l.
Viale Certosa, 218 — 20156 Milano
Email: privacy@ordoapp.cloud
Certified email (PEC): hestiapropertiessrl@pec.it
2. Data Collected
Venue Operator Data (Business Account)
- First name, last name, email, phone number
- Venue name, VAT number
- Login credentials (email, encrypted password)
- Access logs (IP address, date/time, user agent)
Visit Statistics (Public Website)
- Aggregated statistics of public pages (page visited, source/referrer, utm campaign parameters) with approximate geolocation of the IP address for statistical purposes. Collection is server-side and without profiling cookies. The IP address is recorded and deleted after 7 days; country and city are derived from a database installed on our own servers, without sending the address to external services. Legal basis: legitimate interest (Art. 6.1.f GDPR).
End-Customer Data
- Device identifier (device_id)
- Name, phone number and email (if provided)
- Delivery addresses, table number, order notes
- Order history
- Browser push notification subscriptions
- Marketing consent preferences
This data is processed on behalf of the venue, which is its controller (see the Data Processing Agreement).
3. Purposes and Legal Basis
| Purpose | Legal Basis | Retention |
|---|---|---|
| Provision of the service | Performance of contract | Account lifetime + 10 years |
| Security and fraud prevention | Legitimate interest | 12 months |
| Service communications | Performance of contract | Account lifetime |
| Direct marketing | Explicit consent | Until withdrawal |
| Tax obligations | Legal obligation | 10 years |
4. Data Recipients
Data may be disclosed to:
- Hosting and email provider (Aruba S.p.A., Italy)
- Payment services for the Ordo subscription (Stripe)
- Competent authorities where required by law
If the venue enables online payment of orders, the customer is redirected to the Paysera page linked to the venue's own account: card data never passes through our systems. The automatic menu translation feature sends to OpenAI only names and descriptions of dishes, never personal data.
We do not sell or transfer your data to third parties for commercial purposes.
5. Transfers Outside the EU
Some services (e.g. Stripe) may involve the transfer of data to non-EU countries. In such cases, the transfer takes place on the basis of Standard Contractual Clauses approved by the European Commission.
6. Rights of the Data Subject
Pursuant to Articles 15-22 of the GDPR, you have the right to:
- Access: obtain a copy of your data
- Rectification: correct inaccurate data
- Erasure: request the deletion of your data
- Restriction: restrict processing
- Portability: receive your data in a structured format
- Objection: object to processing
- Withdraw consent: withdraw your consent at any time
To exercise your rights, please write to: privacy@ordoapp.cloud
7. Complaint to the Supervisory Authority
You have the right to lodge a complaint with the Italian Data Protection Authority:
www.garanteprivacy.it
8. Data Security
We adopt technical and organisational measures to protect your data:
- Password encryption (bcrypt)
- HTTPS connections
- Restricted and logged access
- Periodic backups
9. Consent Register
We maintain a detailed register of all consents provided, including: date/time, version of the document accepted, IP address. This register is available on request.
10. Changes to this Policy
Any changes will be published on this page and communicated by email to registered users. The "last update" date indicates the current version.