Privacy policy

1. Data controller

Ordeli Technologies, S.L. (“Ordeli”) is the controller of the personal data collected through this website and the Ordeli platform.

2. Data we collect

The data we collect depends on how you interact with the platform:

• Restaurants (admin account): venue name, contact email, billing details (tax ID) and platform usage data.
• Diners at the restaurant: order and payment data during your visit to the table. We do not create any account or persistent identity — we do not ask for your name or email unless you choose to provide them, for example to receive the receipt by email.
• Takeaway orders: name and contact phone number, together with the order details.
• Table reservations: name, contact phone or email and, if you provide them, food allergies (special category data, GDPR art. 9).

3. Purpose

The data is used to manage your account, process payments, improve the service and, where you consent, send you commercial communications.

4. Legal basis

Processing is based on performance of the service contract (GDPR art. 6.1.b), compliance with legal obligations (tax and billing) and, where applicable, your explicit consent for commercial communications.

For a diner ordering and paying from the table, processing is strictly limited to what is needed to provide that service (art. 6.1.b): no consent is requested or recorded.

5. Your rights

You may exercise your rights of access, rectification, erasure, portability, restriction and objection over your personal data. Self-service mechanisms exist for takeaway orders and reservations; for any other case — including a dine-in diner — write to privacidad@ordeli.app and we will handle your request within one month at most (GDPR art. 12.3).

• Restaurant account holder: export your data and request account closure (with re-authentication) from the admin panel itself.
• Takeaway order: view or request deletion of your order data by providing the turn number and the 4-digit PIN you received, with no need to contact us.
• Table reservation: view or request deletion of your reservation data by providing the confirmation code you received.
• Dine-in diner (no account): we keep no identity of yours once the visit ends, so there is no self-service access: write to privacidad@ordeli.app.

6. Retention periods

We keep personal data only for as long as needed for its purpose:

• Operational data (table sessions, takeaway orders): 12 months from closure, a period each restaurant can configure.
• Special category data (allergies given on a reservation): 30 days (GDPR art. 9).
• Audit and third-party review data: 12 months.
• Fiscal records (invoices, payments, VeriFactu/TicketBAI, SEPA mandates): 5 years without exception, per Spanish Royal Decree 1619/2012 — this period applies even if you exercise your right to erasure.

7. Contact

For any privacy enquiry: privacidad@ordeli.app.