UOrderly privacy notice

UOrderly is operated by Koryvo Ltd, a company registered in England and Wales under company number 17318644. Our registered office is 31 Thornlea, Manchester, M43 6WZ, United Kingdom. Koryvo Ltd is registered with the Information Commissioner's Office under registration reference ZC198369.

Koryvo Ltd is the controller for the merchant account, platform security, audit and support activities described in this notice. You can contact us about privacy at contact@uorderly.com.

This notice applies to personal information connected with:

• restaurant owner and staff accounts;
• Super Admin and platform operation accounts;
• restaurant onboarding and business contact details;
• security, authentication and platform audit records; and
• support, privacy and other communications sent to UOrderly.

Restaurant customer order information

A restaurant is normally the controller for personal information its customers provide when placing an order. Koryvo Ltd normally processes that information through UOrderly on the restaurant's instructions as its processor. Customers should read the privacy notice published on the relevant restaurant's ordering portal and contact that restaurant first about an order privacy request.

Where Koryvo Ltd uses limited order-related information for its own platform security, legal compliance, fraud prevention or the management of a support incident, it acts as a controller for that specific use.

Account and identity information

This may include your name, work email address, account role, restaurant association, account status and authentication information. Passwords are managed through our authentication provider and are not available to restaurant staff or platform operators in readable form.

Restaurant and business information

This may include restaurant contact details, business address, staff responsibilities, configured domain and operational account settings where these identify or relate to an individual.

Support and communications

If you contact us, we may retain your contact details, message, attachments, support notes and the steps taken to resolve your request.

Technical, security and audit information

This may include IP address, browser and device details, requested pages, timestamps, sign-in and security events, account changes, administrative actions and diagnostic records.

Information processed for restaurants

Depending on the order, UOrderly may process a customer's name, phone number, email address, delivery address, order contents, notes, allergy declaration, payment status and payment provider references for the restaurant. Complete card details are handled by the configured payment provider and are not stored by UOrderly.

Allergy and food intolerance information may reveal information about a person's health. It is therefore treated as special category personal data and receives additional protection.

We receive personal information:

• directly from you when an account is created or you contact us;
• from an authorised restaurant owner or platform administrator;
• automatically when you sign in or use the platform; and
• from service providers where needed to operate authentication, hosting, email, notifications, payments or security.

We use personal information to:

• create and administer authorised platform accounts;
• provide, secure and maintain the UOrderly service;
• authenticate users and manage access permissions;
• respond to support and privacy enquiries;
• investigate faults, misuse, fraud and security incidents;
• maintain appropriate operational and audit records; and
• meet legal obligations and establish or defend legal claims.

Where UK data protection law applies, we rely on performance of a contract or steps requested before entering a contract where appropriate. We rely on legitimate interests to operate and protect the platform, support users, maintain accountable business records and prevent misuse. We rely on legal obligation where the law requires us to process or retain information.

UOrderly does not currently send marketing emails to restaurant owners or staff. Service, security, account and support messages are operational communications, not marketing.

Providing allergy or food intolerance information during checkout is optional. If a customer chooses to provide it, the relevant restaurant processes it to prepare, check and manage that customer's order safely. The restaurant is normally the controller for this processing and Koryvo Ltd processes the information through UOrderly on the restaurant's instructions.

Legal bases

For the ordinary personal data processing needed to prepare and manage the order, the restaurant relies on Article 6(1)(b) of the UK GDPR: processing necessary to perform the customer's order contract or take requested steps connected with that order. For allergy information that is special category health data, the restaurant also asks for the customer's explicit consent under Article 9(2)(a) of the UK GDPR.

When allergy information is entered online, UOrderly presents a specific consent statement before the order is placed and records the time, wording version and source of the confirmation. If a restaurant employee enters the information during a telephone or staff-created order, the employee must first confirm that the customer expressly agreed to the restaurant using and storing the information for that order.

How the information is used

Allergy information may be shown to authorised restaurant staff, compared with declared menu allergens, stored with the relevant order and included on kitchen or operational print copies. It is not used by Koryvo Ltd for advertising, customer profiling or sharing between restaurants.

Withdrawing consent and requesting deletion

A customer may withdraw consent and ask the restaurant to delete stored allergy information through the tracked order page or by contacting the restaurant. The restaurant is responsible for reviewing the request and deciding when it can be carried out safely if the order is still being prepared or fulfilled. Withdrawal does not affect processing that took place before the withdrawal.

When the restaurant completes the request in UOrderly, the platform clears the stored allergy declaration, conflict and acknowledgement records, consent record and system-generated allergy note from the customer's linked order records. A minimal record that the request was received and completed may remain, without retaining the original allergy details. Printed tickets and allergy information manually copied into separate restaurant records must be handled by the restaurant under its own privacy and disposal procedures.

We do not sell personal information. We share it only where needed with authorised restaurant users, platform administrators and service providers that support UOrderly. Depending on the enabled features, these providers may support:

• database hosting, authentication and realtime services;
• website and application hosting;
• transactional and support email;
• device notifications and printing operations;
• payment processing selected for a restaurant; and
• security, professional advice and legal compliance.

Current technology providers may include Supabase, Vercel, Resend, Google Firebase and a restaurant's configured payment provider. Provider availability and use may change as the platform develops. We may also disclose information to professional advisers, courts, regulators, law enforcement or other authorities where required or appropriate.

Some providers may access or process information outside the United Kingdom. Where a restricted transfer occurs, we assess the transfer and use an applicable safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with additional measures where required.

Contact contact@uorderly.com if you would like more information about the safeguards relevant to your information.

• Merchant account information is retained while the account is active and needed to provide UOrderly.
• Authentication and security records are normally retained for up to 12 months. We may retain relevant records longer while a security incident is being investigated.
• Support communications are normally retained for up to 24 months after the matter is closed.
• When a restaurant stops using UOrderly, access is disabled and we may retain operational account information for up to 90 days to support recovery or an authorised data export. Information that is no longer needed is then deleted or anonymised.
• Limited contract, tax, fraud prevention, audit or legal claim records may be retained for up to six years after the relevant relationship ends where necessary.

Customer order and allergy information processed for a restaurant is retained under that restaurant's instructions and customer privacy notice. If the restaurant completes an allergy-information deletion request through UOrderly, the stored allergy fields are cleared as described above; the request completion record does not retain the original allergy details.

We may keep particular information for longer where required by law, a regulator, a court order, an active dispute or a security investigation. We may delete information sooner when it is no longer needed.

UOrderly uses cookies and similar browser storage that are necessary for authentication, session continuity, security and core platform functions. UOrderly does not currently use advertising cookies, analytics cookies or behavioural tracking. If this changes, we will update this notice and introduce any consent controls required by law before using non-essential cookies.

We use technical and organisational measures intended to protect personal information. These include authenticated access, tenant-scoped permissions, encryption in transit, restricted administrative access, audit records and service provider security controls. No online service can guarantee absolute security.

Depending on the circumstances, you may have rights to request access, correction, deletion, restriction or portability of your personal information, and to object to certain processing. These rights can vary according to the legal basis and applicable exemptions.

To exercise a right relating to your UOrderly merchant or platform account, email contact@uorderly.com. If your request concerns an order you placed with a restaurant, including a request to withdraw consent or delete allergy information, use the request option on your tracked order page or contact that restaurant first. We will assist the restaurant where it asks us to do so.

You also have the right to complain to the Information Commissioner's Office. Visit ico.org.uk or call 0303 123 1113.

UOrderly does not currently make solely automated decisions about merchant or staff users that produce legal or similarly significant effects.

UOrderly merchant and administration accounts are intended for authorised business users and are not directed at children.

We may update this notice as UOrderly, our providers or legal requirements change. We will publish the current version here and update the date above. We will provide additional notice where a material change affects how we use personal information.