Data Processing Terms

Data-processing terms for restaurants using OrderNow modules. Effective from: 05.05.2026

Informational Notice: This English translation is provided for informational purposes. In the event of any discrepancy, the Polish version prevails. (requires qualified legal review before production publication)

These data-processing terms form part of the individual restaurant agreement. They set out the processing framework required by Article 28 GDPR and apply to the OrderNow modules selected by the restaurant.

1. Parties and roles

The processor is: Robert Dziak, operating an unregistered business activity under the OrderNow brand, Warsaw, Poland, unregistered business activity (not entered in CEIDG), contact: kontakt@ordernow.pl, +48 514 192 425.

The restaurant is the controller for personal data it enters into restaurant modules or collects through its own storefront, including guest, customer, staff, courier and supplier data.

OrderNow remains a separate controller for its own account administration, support, security, billing, legal claims and product analytics described in the Privacy Policy.

2. Processing scope

Subject matter: providing OrderNow software for QR menu, online ordering, reservations, delivery operations, loyalty, KDS, staff and restaurant administration.
Duration: for the term of the restaurant's use of OrderNow and afterwards only for deletion, export, mandatory retention, legal claims or documented restaurant instructions. Retention periods follow the individual agreement, product settings and the applicable retention policy.
Nature and purpose: hosting, storing, displaying, transmitting, securing and supporting data processed in restaurant workflows.

3. Data categories

Depending on enabled modules, processing may include names, email addresses, phone numbers, delivery addresses, table or order identifiers, reservations, order history, loyalty balances, feedback, staff accounts, roles, shifts, courier assignments, supplier contact data and uploaded operational documents.

4. Processor obligations

OrderNow processes entrusted data only on documented instructions from the restaurant, including these Terms, the commercial agreement and product settings selected by authorised restaurant users.
OrderNow limits access to authorised persons and requires confidentiality from persons involved in providing the service.
OrderNow applies technical and organisational safeguards appropriate to the service, including access control, encrypted transport and separation of restaurant workspaces where supported by the system. Backup, logging, incident and audit details are documented in B2B documentation or the individual agreement where appropriate.

5. Sub-processors

OrderNow uses the following providers solely to operate the service. The table identifies the current subprocessor scope and purpose for the restaurant agreement.

Provider	Purpose	Documentation
Vercel	Application hosting, deployments, logs, Vercel Blob, optional Vercel Analytics and Speed Insights after consent.	Regional, transfer and contractual information is available to the restaurant on request.
Supabase	Application database.	Regional, transfer and contractual information is available to the restaurant on request.
Supabase Storage	Private operational file storage.	Regional, transfer and contractual information is available to the restaurant on request.
Upstash Redis	Rate limiting and cache.	Regional, transfer and contractual information is available to the restaurant on request.
Pusher	Realtime POS/KDS/order/reservation/courier channels.	Regional, transfer and contractual information is available to the restaurant on request.
Resend	Transactional email.	Regional, transfer and contractual information is available to the restaurant on request.
DeepL	Admin-requested product/menu text translation.	Regional, transfer and contractual information is available to the restaurant on request.
Leaflet / OpenStreetMap / Nominatim	Map tiles and delivery-address geocoding where the delivery module sends an address query to Nominatim/OpenStreetMap.	Regional, transfer and contractual information is available to the restaurant on request.

Material changes to sub-processors are communicated through the Privacy Policy, product notice, email or another durable channel, with an objection option where required by law or contract.

6. Assistance and end of service

OrderNow assists the restaurant, within reasonable technical possibilities, with data-subject requests, security incidents, DPIA-related information and audits.
After service termination, OrderNow deletes or returns entrusted personal data according to product capabilities, retention rules and legal requirements.
If OrderNow believes an instruction infringes data-protection law, it should inform the restaurant unless prohibited by law.

Back to Home