Privacy Policy

Last updated: 1st August 2026

1. Data controller

The data controller for personal data processed through ordinia.net and the Ordinia platform services is:

Albert Kweku Ogoe Via don Bonsignori, 156, Prevalle, Brescia, Italy VAT number: IT 04653400988 Email: privacy@ordinia.net

For any matter related to the processing of your personal data you can contact us at the email address above.

2. Data Protection Officer

As of the effective date of this policy, Ordinia is not required to appoint a Data Protection Officer under Article 37 GDPR: as a core activity it does not carry out large-scale systematic monitoring of data subjects, nor large-scale processing of special categories of data (Article 9 GDPR) or data relating to criminal convictions and offences (Article 10 GDPR). Ordinia onboards tenants (restaurants) individually and processes ordinary contact and order data on behalf of those restaurants.

This position is stated as of the effective date above and will be reassessed if the scope of processing changes — for example, a significant increase in scale or the introduction of systematic monitoring. Regardless of whether a DPO is appointed, every privacy matter can be addressed to privacy@ordinia.net, which is monitored as the dedicated privacy contact.

3. Categories of data processed

Ordinia processes the following categories of personal data:

Browsing data (the ordinia.net site itself): the institutional site collects no personal data. We do not use cookies, we do not use analytics tools, we do not use third-party tracking pixels.

Tenant administrator account data (platform): when a customer (restaurant) signs up for the Ordinia platform, we collect name, email address, and a Google OAuth identifier through Google’s authentication provider.

Restaurant end-customer data (a tenant’s webstore): when an end customer orders through a restaurant’s webstore hosted on the platform, we process name, phone number, email address, and order contents. The data controller for this data is the restaurant itself; Ordinia acts as data processor under Article 28 GDPR.

WhatsApp ordering data: when an end customer sends an order via WhatsApp, we receive the phone number, the WhatsApp display name, and the message contents. Here too Ordinia acts as data processor on behalf of the restaurant.

4. Purposes and legal bases

We do not perform consent-based processing (Art. 6(1)(a)) on the institutional site, because we do not use cookies or direct-marketing tools.

5. Recipients of data

Your data may be communicated to the following categories of recipients, all bound by data processing agreements under Article 28 GDPR:

• Hetzner Online GmbH (Germany, EU) — hosting and storage provider
• Google Ireland Limited (Ireland, EU) — OAuth authentication, and the Google Business Profile APIs where a restaurant connects its listing (see section 6)
• Meta Platforms Ireland Limited (Ireland, EU) — when a restaurant enables the WhatsApp Cloud API integration
• PostHog Inc. (United States; data processed and stored in the EU region — Frankfurt, Germany) — product analytics for the platform and tenant webstores. Privacy notice: https://posthog.com/privacy
• Anthropic, PBC (USA) — AI provider used only for optional Pro/Scale plan features; data is transmitted only if the restaurant enables those features
• Legal, tax, and administrative advisors bound by professional secrecy

We do not sell, rent, or transfer your personal data to third parties for marketing purposes.

6. Google Business Profile data (Google API Services Limited Use)

Where a restaurant chooses to connect its Google Business Profile listing to Ordinia, the connection is authorised by the listing’s own Google account through Google’s consent screen, and can be withdrawn at any time from the Ordinia admin or from the Google account’s own permissions page.

What we read. Only what the two connected features need:

• the email address of the Google account that granted the connection, kept solely so that a later disconnection revokes the correct grant and never another restaurant’s;
• the identifier and display name of the connected listing;
• aggregate performance counters for that listing (views, searches, calls, direction requests, website clicks) and the monthly search terms Google reports for it;
• the listing’s existing ordering action links, so that ours can be published or updated without destroying one the restaurant already had.

What we write. A single “Order online” action link on the connected listing, pointing to that restaurant’s own Ordinia storefront. Nothing else on the listing is modified.

What we never access. Reviews and replies to reviews, messages, photos or other media, menu content, and any data concerning the restaurant’s own customers. Google grants Business Profile access as a single broad permission rather than one per feature, so the connection technically carries more reach than we use; we read and write only the items listed above, and the Limited Use commitments below apply to everything the connection makes available.

Limited Use. Ordinia’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

• we use this information only to provide features that the restaurant can see in its own Ordinia administration area and in its weekly report — the performance figures and the ordering-link button;
• we do not transfer it to third parties except as necessary to provide those features (our hosting provider, listed in section 5), to comply with the law, or in connection with a merger or acquisition;
• we do not use it for advertising, and we do not sell it;
• we do not allow humans to read it, except where the restaurant has expressly requested our support, where it is necessary for security or to comply with the law, or where the information has been aggregated and anonymised.

Storage and deletion. Google access and refresh tokens are encrypted at rest (AES-256-GCM) and are never displayed, exported, or written to logs. When a restaurant disconnects, the stored tokens are destroyed and the authorisation is revoked at Google in the same operation. A connection that is begun but never confirmed expires within 30 minutes and can no longer be completed; a recurring job then revokes its authorisation at Google, normally within the following hour. Performance figures are retained for the duration of the restaurant’s contract and are deleted together with its account.

7. Transfers outside the EU

Transfers to Anthropic (USA) take place under the Standard Contractual Clauses approved by the European Commission (Implementing Decision (EU) 2021/914) and within the framework of the EU-US Data Privacy Framework.

WhatsApp message content traverses Meta’s global infrastructure during delivery; Meta is contractually our sub-processor under the Standard Contractual Clauses (Implementing Decision (EU) 2021/914), and message content is encrypted in transit.

PostHog analytics data is processed and stored in PostHog’s EU region (Frankfurt, Germany), so no transfer outside the EU arises in normal operation; where PostHog Inc. (United States) provides support or technical access, that access takes place under the Standard Contractual Clauses (Implementing Decision (EU) 2021/914).

Further details on any of the above are available on request at privacy@ordinia.net.

8. Retention periods

After these periods data is deleted or irreversibly anonymized.

9. Your rights

Under Articles 15–22 GDPR you have the right to:

• Access your personal data (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure (“right to be forgotten”, Art. 17) — see also the dedicated /en/data-deletion page
• Restriction of processing (Art. 18)
• Portability of data (Art. 20)
• Object to processing (Art. 21)
• Withdraw consent at any time, where applicable

To exercise these rights write to privacy@ordinia.net. We will respond within 30 days of receipt of the request.

You also have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali — garanteprivacy.it) or the supervisory authority of your country of residence within the EU.

10. Security

We adopt technical and organizational measures appropriate to the risk, including: encryption in transit (TLS 1.3), encryption of credentials at rest, role-based access control, per-tenant data isolation enforced by the database itself (PostgreSQL row-level security), audit logging, daily backups.

11. Changes

Any changes to this policy will be published on this page with the “Last updated” date refreshed at the top. For substantial changes we will notify tenant administrators via email.

12. Contact

For questions about this policy or the processing of your data: privacy@ordinia.net