Back to site
Privacy Policy

Privacy Policy

This Privacy Policy explains how OrderFlow collects, uses, stores, shares and protects personal information, and how it helps support compliance across India, the European Union, the United Kingdom, the United States and Australia.

Updated: August 2026

1. Scope and purpose

OrderFlow is a hospitality technology platform that may help restaurants, cafes, cinemas and hospitality businesses manage digital orders, QR-based menus, reservations, customer interactions and operational workflows. This policy applies to personal data processed through our website, mobile pages, customer ordering experience and internal systems.

2. Information we may collect

We may collect the following categories of information:

  • Contact details such as name, email address, phone number and billing information.
  • Business information such as restaurant or venue name, address, branch details and staff accounts.
  • Transaction details such as order content, table or seat identification, payment references and service history.
  • Device and technical information such as IP address, browser type, device identifiers, cookies and analytics data.
  • Customer support records, feedback, preferences and communications sent to us.

3. How we use personal data

We may use personal data for the following purposes:

  • To provide and improve ordering, reservations, menu management and operational services.
  • To confirm bookings, process orders and communicate order status.
  • To maintain security, prevent fraud, manage disputes and protect legal interests.
  • To fulfil legal, accounting and tax obligations.
  • To personalize customer experience and operational reporting.

4. Legal basis for processing

Depending on the jurisdiction and context, our lawful basis for processing may include:

  • Consent where required, such as marketing preferences or optional cookies.
  • Performance of a contract where we provide services to a restaurant or customer.
  • Legitimate business interests such as service improvement, security and operational efficiency.
  • Compliance with legal obligations, including tax, accounting, consumer protection and regulatory reporting.
  • Vital interests or legal claims, where necessary and permitted by law.

5. Indian privacy obligations

Where we process personal data of individuals in India, we aim to comply with the Digital Personal Data Protection Act, 2023 and applicable information technology and privacy requirements. This includes handling personal data fairly and lawfully, limiting collection to defined purposes, maintaining reasonable security safeguards, and providing clear notice about data processing activities.

6. European and UK compliance

Where we process data from individuals in the European Economic Area or the United Kingdom, we will seek to comply with the General Data Protection Regulation (GDPR) and UK GDPR. This includes respecting rights to access, rectification, erasure, restriction, objection, portability and complaint. Where required, we may rely on data protection impact assessments and legitimate-interest assessments for operational processing.

7. US privacy obligations

Where we process data of individuals in the United States, we aim to align with applicable state privacy laws, including California Consumer Privacy Act (CCPA/CPRA) and comparable state frameworks. In these circumstances, individuals may have rights to notice, access, deletion, opt-out of sale/sharing where applicable, and to request information about categories of data processed.

8. Australia privacy obligations

Where we process data of individuals in Australia, we aim to comply with the Privacy Act 1988 and the Australian Privacy Principles (APPs). This includes transparency, data minimisation, protection of personal information, secure handling, and the ability to address privacy complaints and access requests.

9. Data sharing and international transfers

We may share personal data with trusted service providers, payment processors, hosting providers, analytics providers, and operational partners, only where necessary. If personal data is transferred outside the country where it was collected, we will take reasonable steps to ensure appropriate safeguards are in place, including contractual protections and compliance with applicable data-transfer rules.

10. Security

We use reasonable administrative, technical and organisational measures to protect personal data against unauthorised access, misuse, disclosure, loss or alteration. However, no system is completely immune to risk, and we cannot guarantee absolute security of information transmitted over the internet.

11. Data retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, comply with legal obligations, resolve disputes and enforce agreements. Retention periods may vary by data category and relevant regulatory requirement.

12. Your rights

Depending on your jurisdiction, you may have rights to:

  • Request access to the personal data we hold about you.
  • Request correction or deletion of inaccurate or unnecessary data.
  • Object to or restrict certain processing activities.
  • Withdraw consent for optional processing where consent is used.
  • Request data portability where applicable.
  • File a complaint with the relevant data protection authority.

To exercise these rights, please contact our privacy team using the contact details in this policy.

13. Cookies and analytics

We may use cookies and similar technologies for security, site performance, analytics and user experience. Some cookies may be strictly necessary, while others may be optional and require consent depending on local law. You can manage cookie preferences through your browser settings or our cookie settings banner where available.

14. Children’s data

Our services are not directed at children under the age required by law to consent to data processing in their jurisdiction. We do not intentionally collect personal data from children without valid parental or guardian consent where required.

15. Contact details

If you have any questions, requests or complaints about this Privacy Policy or your personal data, please contact us at:

OrderFlow
Email: privacy@orderflow.example
Address: [Your registered business address]

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in law, technology or our practices. Material changes will be communicated through the website or direct notice where appropriate.