Privacy Policy

1. Who Ordit Is and How to Get in Touch

Ordit International Ltd runs ordit.co.uk and the Ordit ordering service. It is registered in England under company number 12020646, at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ.

Ordit is not required to appoint a Data Protection Officer and has instead designated a contact person for data protection matters. Any question or request about this policy, or about how Ordit handles personal data, can go to [email protected] or to the registered address above.

Anyone unhappy with how Ordit handles personal data can complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk. Raising it with Ordit first is welcome, but not required.

2. Who Is Responsible for Your Data

Ordit serves two kinds of customer: people who sign up themselves, and people whose employer runs a meal programme. Responsibility for personal data is split differently in each case, and it decides who to approach about your rights.

• Ordit is the controller for your Ordit account, the orders you place, your support conversations and any marketing you have agreed to receive. Ordit decides how that data is used, and this policy describes it.
• Your employer is the controller for the parts of a corporate meal programme it administers. Its administrators decide who is enrolled and can remove them, set and change budgets, apply expense codes, choose which restaurants the workforce may order from, restrict which addresses orders may go to, reset an account password, and see the order activity described in section 10. Ordit carries out those instructions under a data processing agreement.

One caveat worth stating plainly: because your order history is also used to run and improve the Ordit service itself, as section 7 describes, Ordit is a controller for that use even where your account came from an employer programme. If you would rather it were not, section 14 explains how to object.

In practice this means requests about your account, your orders or your marketing preferences should come to Ordit. Requests about your enrolment, your budget or your expense codes should go to your employer. If you send one to Ordit instead, it will be passed to your employer within five working days and you will be told that it has been.

3. What This Policy Covers

This policy applies to the Ordit website at ordit.co.uk, the Ordit ordering app on web and mobile, and the administration portal used by corporate customers.

Ordit links to other websites, including those of restaurants and delivery partners. Those sites are outside Ordit's control and set their own terms, so it is worth reading their privacy notices before sharing anything with them.

4. What Personal Data Means

Under the UK GDPR and the Data Protection Act 2018, personal data is any information relating to an identifiable person. That covers the obvious identifiers such as a name or an email address, and the less obvious ones such as an account number, a delivery address, a device identifier or an IP address.

5. The Data Ordit Collects

Ordit collects only what the service needs to work:

• Account data. Your first name, last name, email address and phone number, when you last signed in, and a referral code.
• Programme data, where an employer has enrolled you: your department or team, a cost centre, an employee reference, a company reference, the budget set for you, the balance remaining, and any expense code applied to an order.
• Address data. The delivery addresses you save or enter, including a work address, the map coordinates of each one, and any note you add to help a courier find you.
• Order data. What you ordered, including each item and any options chosen, when, from which restaurant, what it cost, the delivery or collection method, and the progress of the delivery.
• Payment data. Card payments are processed by Stripe, and card details are entered directly into Stripe rather than passing through Ordit's systems. Ordit does not store card numbers. It holds only the payment reference, the card brand and the last four digits, so a saved card can be recognised.
• Technical data. IP address, sign-in records, browser type and version, time zone, operating system, the device used to reach the service, and, if you turn on push notifications, a token identifying that device.
• Usage data. How the website and app are used, including which pages and menus are viewed.
• Communications data. Support messages, the contents of chats with the Ordit team, ratings and reviews you leave, and anything you send through a contact form on this website.
• Preferences. Your notification and marketing settings, and your display settings.

A few corporate customers ask Ordit to hold an extra field or two so their own systems can reconcile orders, such as an internal staff reference. Where that applies to you, your employer will have told you.

Ordit does not ask for special category data, such as information about health, and does not knowingly collect data about children. Allergen information shown against a menu item describes the food and is supplied by the restaurant. It is not information about you. Some fields are free text, though, including delivery notes, support messages and reviews. If you choose to put health information into one of those, it is used only to answer you and is deleted with the record it sits in.

6. Where the Data Comes From

Most of it comes from you. Some does not, and it is worth being clear about that:

• From you, when you create an account, place an order, save an address or contact support.
• From your employer, where it runs a corporate meal programme. To enrol you, an employer gives Ordit your name and work email address, and sometimes a work phone number, a team, a cost centre, a staff reference and an expense code. Some employers send this as a scheduled encrypted file rather than entering it by hand, and some connect their own single sign-on so that an account is created the first time you log in. Ordit uses this to create or link your account and to apply the budget your employer has set. If your account was created any of these ways, this section is how your data reached Ordit, and none of it came from a public source.
• From Google or Apple, if you choose to sign in with one of those accounts. Ordit receives an account identifier and your email address, and nothing else.
• From your device, automatically, when you use the website or app. Section 9 covers the cookies involved.
• From restaurants and delivery partners, about the progress of an order and anything that affects it.
• From Stripe, confirming whether a payment succeeded and which saved card was used.
• From an expense system, such as SAP Concur, if you connect one to your Ordit account so that orders reach it automatically.

Where your account was created from information your employer supplied, Ordit sends you this notice when the account is set up, and in any event within one month of receiving your details.

7. How Ordit Uses Your Data, and Why

Every use below is tied to a lawful basis under the UK GDPR. Where that basis is a legitimate interest, the interest is named, because a general claim is not much use to anyone weighing it.

• Creating and running your account, and taking and delivering your orders. Lawful basis: performance of a contract with you.
• Taking payment, issuing refunds, and applying a budget or expense code. Lawful basis: performance of a contract, and Ordit's legal obligation to keep accurate accounting records.
• Reporting your order activity to your employer where you order against a corporate budget, so that your employer can run and pay for the programme. Section 10 sets out exactly what it can see. Lawful basis: performance of the contract under which that budget is provided to you.
• Keeping you posted on an order, and telling you about changes to these terms. Lawful basis: performance of a contract, and legal obligation.
• Answering support questions and handling complaints. Lawful basis: performance of a contract, and Ordit's legitimate interest in resolving problems properly and learning from them.
• Running, testing and securing the platform, including troubleshooting faults and watching for misuse. Lawful basis: Ordit's legitimate interest in keeping the service available, working and secure for everyone using it.
• Understanding how the service is used so it can be improved. Lawful basis: Ordit's legitimate interest in building a service people find quick and easy to use.
• Suggesting menu items. Ordit compares what you have ordered before against a restaurant's menu to put likely choices near the top. Lawful basis: Ordit's legitimate interest in making the service faster to use. The suggestions are only suggestions, and the full menu is always available.
• Meeting legal, tax and accounting duties, and establishing or defending legal claims. Lawful basis: legal obligation, and Ordit's legitimate interest in protecting its position.

You can object to any use that rests on a legitimate interest. Section 14 explains how.

8. Marketing and Your Choices

Ordit sends marketing only to people who have asked for it. Lawful basis: consent. You can withdraw that consent whenever you like, using the unsubscribe link in any marketing email or the settings in your account, and it takes effect without affecting anything sent beforehand.

Messages about an order, a change to your account, or a change to these terms are not marketing. They are part of the service, and they continue whatever your marketing preferences are.

You may also want to register with the preference services operating in the UK: the Telephone Preference Service, the Corporate Telephone Preference Service, and the Mailing Preference Service.

9. Cookies and Similar Technologies

Ordit uses cookies and similar technologies to keep you signed in, hold a basket together, remember your settings, and understand how the service is used.

Which cookies are set, what each one does, how long it lasts, which third parties are involved and how to control them are all set out in the Cookie Policy.

11. Where Your Data Is Stored

The main platform database, holding your account, addresses and order history, is on Google Cloud servers in Frankfurt, Germany. It is accessed by Ordit teams in London and Budapest. Public website images and files are stored in London.

The website itself is served from Google Cloud in Frankfurt, behind Cloudflare's network. The services listed in section 10 run on their own providers' infrastructure, not necessarily in Frankfurt. Where that is outside the UK and the European Economic Area, the transfer safeguards below apply.

Ordit International Ltd is part of the same group as Ordit Hungary Kft, which develops and operates the platform. The Budapest access described above is by that company, under an agreement covering how it handles your data.

The European Economic Area is covered by UK adequacy regulations, so no additional safeguard is needed for data held in Frankfurt or accessed from Budapest.

Several of the providers in section 10 are based outside the UK and the EEA, mainly in the United States. Where personal data reaches them, Ordit relies on the UK International Data Transfer Agreement or the UK Addendum to the standard contractual clauses. These are contracts approved under UK law that require the provider to protect your data to a UK standard. A copy of the mechanism used for a particular provider is available on request from [email protected].

12. How Long Ordit Keeps It

Order and invoice records are kept for six years. That period is set by the accounting and tax records Ordit has to be able to produce. Other record types follow the schedules in Ordit's data destruction policy, and a corporate customer can agree a shorter period by contract.

If you ask for your account to be deleted, Ordit removes your name, email address and phone number from it, and deletes the addresses and preferences attached to it. Three things survive, and it is fairer to say so than to promise a clean sweep:

• The order and invoice records described above, kept for the rest of the six years and used for nothing else.
• Billing details held for those invoices, and the reference identifying you to Stripe.
• Security and audit logs, which record who changed what and when. These cannot be edited, by design, because their value depends on it. They hold an email address, an IP address and a timestamp.

The same applies when someone leaves an employer running a meal programme. Ordit is reviewing how long security and audit logs should be kept, and will publish a period here once it is set.

In setting these periods Ordit weighs the amount, nature and sensitivity of the data, the harm that unauthorised use or disclosure could cause, whether the purpose could be achieved another way, and what the law requires.

13. How Ordit Protects It

Traffic between your device and Ordit is encrypted in transit using TLS 1.2 or later. Data at rest is encrypted on Google Cloud, and passwords are stored hashed rather than in a readable form. Access to personal data is restricted to the people who need it to do their job, and is logged.

Ordit maintains a data protection policy, a record of processing activities, and an incident response procedure, and carries out data protection impact assessments before starting anything high risk. The Ordit application is penetration tested each year by an external provider; the cloud infrastructure it runs on is tested by Google. Systems are monitored continuously.

No system is completely secure, and data sent over the internet always carries some risk. If a breach of personal data occurs and it is likely to result in a risk to your rights, Ordit will report it to the Information Commissioner's Office without undue delay and, where feasible, within 72 hours, and will tell you where the law requires it. Where the breach affects data Ordit holds for a corporate customer, that customer is told without undue delay so it can meet its own obligations.

14. Your Rights and How to Use Them

Under the UK GDPR you have the right to:

• Be informed about how your personal data is collected and used. This policy is how Ordit does that.
• Get a copy of the personal data Ordit holds about you.
• Have it corrected if it is wrong or incomplete. Most of it can be changed directly in your account.
• Have it deleted, subject to the records Ordit must keep for tax and accounting, or needs in order to defend a legal claim, as described in section 12.
• Restrict how it is used while a question about it is being resolved.
• Object to any use that rests on a legitimate interest, and to direct marketing at any time.
• Withdraw consent where consent is the basis, without affecting anything done beforehand.
• Receive it in a portable form, in a structured, commonly used, machine-readable format.

To use any of these, write to [email protected] or to the registered address in section 1. Ordit may ask you to confirm your identity first, so that data is not disclosed to the wrong person. There is no charge. Ordit responds within one month. If a request is complex, or if you have made several, that can be extended by up to two further months, and Ordit will tell you within the first month if that happens and why. A request that is manifestly unfounded or excessive may attract a reasonable fee, or be refused with an explanation.

Where your employer is the controller, as described in section 2, requests about that data should go to your employer. Send one to Ordit if it is easier and it will be passed on within five working days, and you will be told that it has been.

You can use parts of the website without giving any personal data. To place an order you need an account, and if you choose not to provide what an account requires, Ordit will not be able to provide the service.

15. Automated Decisions

Ordit does not make decisions about you by automated means alone that produce legal effects or otherwise significantly affect you. Three things do happen automatically, and none of them is a decision Ordit takes about you:

• Access ending when you leave. Where an employer sends Ordit a regular list of who is on its programme, an account missing from that list is switched off automatically. The decision is your employer's; Ordit is carrying out its instruction. If it happens in error, your employer can reverse it.
• Sign-in protection. Repeated failed sign-in attempts lock an account briefly. This guards the account rather than judging you, and it clears by itself.
• Menu ranking. The ordering app profiles what you have ordered before to put likely choices near the top, as described in section 7. It changes the order things appear in, nothing else: the full menu stays available and you can ignore the ranking entirely.

If an automated step has affected you and you want a person to look at it, write to [email protected].

16. Changes to This Policy

Ordit may update this policy as the service changes or the law does. The date at the top of the page shows when it was last revised. Where a change affects your rights or how your data is used, Ordit will tell you by email or in the app before it takes effect.