Version 2026-10-07 · Applies to www.ordfox.com and the OrdFox platform · The English version prevails
1. Who we are
OrdFox (the legal entity named in your Order Summary), a company established in Estonia (“OrdFox”, “we”), operates the website www.ordfox.com and the OrdFox online-ordering platform used by restaurants and food businesses. For the data described in sections 3 and 4 we are the controller. For restaurant customers (section 5) we act as processor for the restaurant. Privacy contact: [privacy contact address, to be confirmed], or by post to the registered address stated in the Terms of Service.
2. Who this notice is for
- Visitors and leads: anyone who browses www.ordfox.com, fills in a form, books a demo or asks about migrating from another provider.
- Restaurant users: owners, managers, staff and drivers who use the OrdFox Dashboard, apps and kitchen or dispatch screens.
- Restaurant customers: people who order from a restaurant’s website or app built on OrdFox. The restaurant is responsible for your data; see section 5.
3. Visitors and leads
What we collect. Contact details you give us (name, business name, email, phone, restaurant website, current ordering provider, message); demo and migration requests; newsletter sign-ups; and, subject to your cookie choices (section 7), technical data such as IP address, browser type and pages visited.
Why and on what basis. To answer your enquiry, run a demo or prepare a proposal (steps before a contract; our legitimate interest in responding to business contacts). To send occasional emails about OrdFox to business contacts who have enquired, with an opt-out in every message (legitimate interest, or consent where the law requires it). To understand how the site is used (consent, through analytics cookies). To keep the site secure (legitimate interest).
4. Restaurant users
What we collect. Account data (name, email, phone, role, login records); company details (legal name, registration number, VAT number and the result of its VIES check, address); billing data (invoices, payment-method token, SEPA mandate); the acceptance record for the Terms of Service (name and role of the person accepting, date and time, IP address, browser identifier, version hash and snapshot of the text); identity and business information needed to activate online payments, which we pass to Stripe (details of representatives, directors and beneficial owners, dates of birth, addresses and identity documents when Stripe requires them); support conversations; usage logs; and, for drivers, real-time location while on shift, which we process on the restaurant’s instructions (the restaurant is the controller for that data).
Why and on what basis. To provide the Services and run your account (performance of the contract). To invoice, keep accounting records and comply with tax and anti-money-laundering rules through Stripe (legal obligation). To keep the platform secure, prevent fraud, improve the product and prove what was accepted (legitimate interest). To send you service messages about your account, invoices, renewals and changes to the Terms (contract). We do not sell personal data.
5. Restaurant customers
When you order from a restaurant’s website or app built on OrdFox, the restaurant is the controller and OrdFox is its processor under a data processing agreement that follows Article 28 GDPR. On the restaurant’s instructions we host and store your order details (name, contact details, delivery address, order history, allergen notes you enter), send order confirmations and delivery-tracking messages, and, only if you ticked the consent box at checkout, send offers in the restaurant’s name with an opt-out in every message. We do not use your data for our own marketing, do not combine it across restaurants and do not sell it. Card details are entered directly into Stripe’s secure fields; we see only a payment token and the last four digits. To exercise your rights, contact the restaurant; we help it respond. The restaurant’s own privacy notice applies to its use of your data.
6. Payments and Stripe
Online payments on the platform are processed by Stripe. When you provide personal data in connection with your OrdFox account, Stripe receives that personal data and processes it in accordance with Stripe’s Privacy Policy (https://stripe.com/privacy). Stripe is an independent controller for the data it needs for payment processing, identity verification, fraud prevention and its regulatory obligations. Payment Method Acquirer is Stripe Technology Europe, Ltd. (https://stripe.com/legal/acquirer-disclosure).
7. Cookies and similar technologies
Strictly necessary cookies (session, login, security, your cookie choices) are always on and need no consent. Analytics and marketing cookies are set only with your consent, given through the cookie banner; you can change or withdraw your choice at any time through the “Cookie settings” link in the footer, and we honour that choice. The cookie settings panel lists each cookie, its purpose, provider and lifetime. Consent is asked again after 12 months at most. Ordering sites built on OrdFox use only strictly necessary cookies unless the restaurant enables analytics, in which case the restaurant’s cookie notice applies.
8. Who we share data with
We share data only as needed with: our service providers acting on our instructions — Stripe Payments Europe, Limited and Stripe Technology Europe, Limited (payments, identity verification, payouts); Google Cloud EMEA Limited (hosting, databases and backups in the Belgium and/or London regions); Vercel Inc. (web hosting and delivery); Twilio Inc., including SendGrid (email and SMS); Mapbox, Inc. (maps and tracking display, where used); and [analytics provider, to be confirmed] (only with your consent) — our professional advisers; public authorities when the law requires; and a buyer or successor of our business, under confidentiality. Apple and Google receive data under their own privacy policies when you use an app distributed through their stores.
9. International transfers
We host the platform in the European Union. Some providers process data in the United States or the United Kingdom. Transfers to the United States rely on the EU-US Data Privacy Framework (for certified providers) and the Standard Contractual Clauses (Commission Decision (EU) 2021/914); transfers to the United Kingdom rely on the European Commission’s adequacy decision. A summary of our transfer impact assessment is available on request.
10. How long we keep data
| Data | Retention |
|---|---|
| Leads and enquiries | 24 months after our last contact, unless you become a customer |
| Account and company data | Term of the contract plus 6 years (contract and tax records) |
| Acceptance record of the Terms | Term of the contract plus 6 years |
| Billing and accounting records | 7 years (Estonian accounting law) |
| Identity and business information for payments | Passed to Stripe and kept by Stripe under its obligations; we keep copies only as long as needed to complete verification |
| Usage and security logs | 12 months |
| Support conversations | 3 years |
| Restaurant customers’ data (as processor) | As instructed by the restaurant; deleted 90 days after the restaurant’s contract ends, backups within a further 90 days, unless the law requires longer |
| Cookies | As stated in the cookie settings panel; consent renewed at least every 12 months |
11. Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing (including to direct marketing at any time), to data portability, and to withdraw consent at any time without affecting earlier processing. Write to the privacy contact in section 1; we may ask you to confirm your identity and we reply within one month (extendable by two months for complex requests, with notice). Restaurant customers should contact the restaurant, which we assist.
12. Security
We protect data with encryption in transit and at rest, role-based access and multi-factor authentication for our staff, logical separation of each restaurant’s data, daily backups held in the EU, logging and monitoring, and vulnerability management. If a breach affects your data we notify the competent authority and, where required, you, within the legal deadlines.
13. Complaints and supervisory authorities
You may complain to us first and we will answer within one month. You also have the right to lodge a complaint with a supervisory authority. Our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, 10134 Tallinn, Estonia, www.aki.ee). In Ireland you may contact the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, www.dataprotection.ie (online complaint form and phone number on that site). You may also contact the authority in the country where you live or work.
14. Changes to this notice
We may update this notice; the version date at the top changes. Material changes are announced on the website and, for account holders, by email or in the Dashboard at least 30 days before they take effect.