Privacy Policy for Stores

Last updated: 22 November 2022

Introduction

Orpay Ltd. (“our”, "we", "us", “Orpay”) is committed to protect the privacy of individuals (“Orpay Partner Representatives”) who are representatives of a company which has a corporate relationship with Orpay, or is a prospective business partner of Orpay, including restaurant partners (“Orpay Partner”). This includes Orpay Partner Representatives who use technology provided by or on behalf of Orpay, including the Business Account where Partners can register, access and manage their account, menus, stores, team and view live orders and any related services, mobile apps and websites (together the “Partner Web Apps”) . Orpay is the "data controller" of the information we process, unless otherwise stated.

This Privacy Policy applies to users of Orpay’s services anywhere in the world and describes the personal information we collect and explains how we use, share and protect this information, and your choices regarding this information. Therefore, while visiting our website, registering or placing orders, you agree to this privacy policy.

We recommend that you read this under the following headings

1. Orpay Contact Details

In case you have any queries or requests about this privacy policy or the ways we handle your data in general, please get in touch with us using the following contact details.

Customer services team at: support@orpay.co.uk

2. Ways we collect your information

We collect your information in various ways, such as when we onboard a restaurant as a new partner and you use the Partners Web Apps. Further details on the ways we collect your information are listed below.

We collect information for:

Lead generation - In some cases we may be searching for opportunities with new Orpay Partners which may possibly be interested in our services. For this reason we may have obtained your contact details from a third party source, such as Google, LinkedIn, a publicly available source or a business data provider, or a business contact may have provided us with your details, in order to inform you about our services.

Contract negotiation and onboarding a new Orpay Partner - When we negotiate a contract with an Orpay Partner and when we are onboarding a new Orpay Partner, we ask you as an Orpay Partner Representative to provide information about yourself including your name, contact details and business address. During the onboarding process, we create a business profile for the Orpay Partner and we will ask you to provide information in order to create and maintain this partner profile, which may include business payment data.

Account Management - Once a new Orpay Partner has been onboarded we process your personal information as an Orpay Partner Representative, for the purposes of managing the Orpay Partner’s relationship with Orpay. When an Orpay Partner chooses to register through the Partners Web Apps, we will collect your personal information as an Orpay Partner Representative, for the purposes of registering on the Partners Web Apps and to enable the Orpay Partner to participate on the Partners Web Apps, including when you interact with Orpay for the Partners Web Apps. We may collect technical information from your mobile device or computer, such as its operating system, the device and connection type and the IP address from which you are accessing the Partners Web Apps. We may also collect technical information about your use of our services through technology, for instance when you use the Partners Web Apps and Orpay Partner Representative.

Processing Payments - When we make payments to or receive payments from Orpay Partners we produce payment files (which are transferred to third party providers for the purposes of processing payments), which include Orpay Partner payment data and as an Orpay Partner Representative this will include your name.

Accessing location - When you have provided permission at a device level, we may process location data obtained from your use of the Partner Web Apps and via our security providers. This is collected for the reasons explained in section 3 below.

Support - We collect certain information when an Orpay Partner requires support from us (“Support”), such as information about your query, including notes regarding the issue, your use of the Partners Web Apps (if relevant) and your contact details, as an Orpay Partner Representative. When you interact with our Support team via email, phone, post, chat or on the Partner Web Apps, including when you report any incident, our team may collect and use information about you. Your communications with us may be stored. If you contact the support team by phone, your calls may be recorded for internal support training and improvement purposes.

Cookies - We may use cookies or other similar technologies to enable auto-login for you into the Partner Web Apps and to obtain technical information about your device that may affect the technical functionality of the Partner Web Apps, for instance, characteristics of and performance data about your device, Partner Web Apps and operating system, including your device type, network connection type, app version, phone language, screen size and platform. You have the right to use your device settings to reject or remove these functional technologies, however please be aware that if you do this, the Partner Web Apps may not function correctly and you may lose the ability to carry out certain functions on the Partner Web Apps.

Information about the services - We may collect information about you from the feedback you send us or provide to us through focus groups or surveys. When you use websites or applications of third parties in connection with the services being provided by Orpay, including during the onboarding process, those sites or applications may collect and process your information independently of Orpay. We recommend that you check and read their privacy policies to understand how they process your personal data.

3. How We Use Your Information and Why

We will only process the information we collect about you if there is a reason for doing so, and if that reason is permitted under data protection law.

We will have a lawful basis for processing your information if:

we need to process your information for the performance of a contract with you, or at your request before we enter into a contract;
we have your consent; we have a justifiable reason for processing your data;
it is in the public interest for us to process your data; or
we are under a legal obligation to do so.

We process your data where we have a justifiable reason for doing so. These reasons are listed below:

To facilitate the contract between Orpay and the Orpay Partner:

to enable and manage the Orpay Partner registration, your account, and the onboarding process, including to execute the agreement between the Orpay Partner and the relevant Orpay entity (the “Agreement”);
to give you access to and use of the Partner Web Apps as a means of Orpay providing the business with services, including to enable the business to get, accept and fulfill live orders;
to issue an invoice for orders;
to enable Support to communicate with you to help with the the provision of services to the Orpay Partner;
to communicate with you regarding operational information related to any services provided to you by Orpay, such as any major changes, developments or new features to the Partner Web Apps; and
to enable us to process payments to the Orpay Partner.

To communicate with you in various ways including:

to assist you with completing the Orpay Partner registration;
to support you with live operations.
to get in touch with you for your feedback on your experience;
to inform you of Orpay product updates; and
to provide you with information and news regarding Orpay and to assist you in understanding more about Orpay, by phone or email.

For onboarding and managing our relationship with Orpay Partners:

to create and maintain the information of an Orpay Partner account;
to enable our Support, engagement and tech teams to help you with any issues, complaints and enquiries more effectively. This might include fixing bugs and repairing any technical issues in a Partner Web Apps using technical information relating to your device;
to use location data for the purposes of confirming the position of your restaurant (if relevant) when app users search for Partners nearby their location through the app;
For any arrangements regarding visits required at your premises for the Orpay app or website, such as taking photographs of meals; and
to maintain a list of Partners that Orpay has onboarded.

To help us develop our systems, services and business such as:

to understand from your data what attributes to a positive or negative customer, restaurant experience with Orpay and what might cause inefficiencies or damage to Orpay, and use this data to responsibly update, design, develop, test and implement new tools, features, processes, and relationships to improve our business, systems and services;
to analyse data to make certain assumptions about your position within the Orpay Partner entity so that we send you the types of promotional offers that may be particularly relevant to your area of your business;
to use basic location data on an aggregate basis to develop and improve our business;
to analyse your activity on the Partners Web App in order to be able to administer, support, improve and develop our business and for statistical and analytical purposes and to help us to prevent fraud.

To protect Orpay such as:

to exercise or defend of legal claims and to exercise and protect the rights of Orpay, Orpay Partners, customers, or others, including determining our liability;
to enforce the terms of the Agreement and to keep records of such enforcement, including using your data to analyse whether you have breached the Agreement (such as by misusing the Partner Web App or acting fraudulently), which may result in us disabling or terminating the Agreement if we have the right to do so; and
to investigate any complaints or incident reports relating to Orpay ‘s relationship with Orpay Partners and to prevent fraud or other misuse of our systems and services.

We also process your personal data where we are under a legal obligation to do so we may use your information:

to keep a record of payments made to or from the Orpay Partner, to the extent they include your personal data; and
to comply with any other legal obligation or regulatory requirement to which we are subject.

Where we rely on our justifiable reasons for processing as a basis for processing your personal information, we carry out a ‘balancing test’ to ensure that our processing is necessary and that your fundamental rights of privacy are not outweighed by our justifiable reasons for processing. You can find out more information about these balancing tests by contacting us using the details above

4. Direct marketing

Where you have given your consent or where we have a legitimate interest for doing so (and are permitted to do so by law) we will use your information to let you know by email about Orpay’s products and services and/or any promotions from third parties relevant to your business (such as broadband and telecommunications services, payment processing, and customer review platforms), except where local law requires us to obtain your consent, in which case we will obtain your consent prior to sending the relevant communication. You always have the option to unsubscribe from these emails. You can always control your marketing preferences by and have the option to unsubscribe from these emails.

5. Sharing Your Information

The information we collect about you will be transferred to and stored on our servers located within the EU.

We share your information with third party service providers who will store your information on their servers and which provide services on our behalf. The types of third party service providers whom we share your information with includes:

IT service providers: including cloud, software, analytics, communications and data storage providers and SDKs.
Operational service providers: including feedback and survey providers, onboarding providers, our support service providers, payment providers, user research partners, professional advisors, financial services providers and other suppliers, business partners, contractors and subcontractors.

Where applicable by circumstances, we may also share your information:

If our business enters into a joint venture with, purchases or is sold to or merged with another business entity, your information may be disclosed or transferred to the target company, our new business partners or owners or their advisors;
if we are under a duty to disclose or share your information in order to comply with (and/or where we believe we are under a duty to comply with) any legal obligation or regulatory requirement. This includes where we’re under a legal obligation to respond to police data requests or to exchange information with other companies and organisations for the purposes of fraud protection and prevention;
in order to enforce our contractual terms with the Orpay Partner;
in the event of a dispute relating to the Orpay Partner’s services to Orpay or the services provided to the Orpay Partner, or to protect the rights of Orpay , restaurants partners, customers, or others, including to prevent fraud; and
with such third parties as we reasonably consider necessary in order to detect or prevent crime, e.g. the police.

In some cases the personal data we collect from you might be processed outside of the country in which you reside, in the other countries in which Orpay operates. These countries may not have the same protections for your personal data as in your country. However, we are obliged to ensure that the personal data that is processed by us and our suppliers outside of your country is protected in the same way as it would be if it was processed within your country. There are therefore certain safeguards in place when your data is processed internationally.

Where your data is being transferred from within the European Economic Area to outside of it, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

your personal data is transferred to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission;
we use the EU approved Standard Contractual Clauses; or
where your personal data is transferred to third party providers based in the US, data may be transferred to them if they have self-certified under the Privacy Shield framework in relation to the type of data being transferred, which requires them to provide similar protection to personal data shared between the EU and the US.

Please contact us using the contact details above if you want further information on the countries to which personal data may be transferred and (if applicable to you country) the specific mechanism used by us when transferring your personal data out of your country.

6. Retention of Your Information

Orpay retains user information for as long as necessary for the purposes described and stated in this policy.

Information that we collect will be retained for as long as needed to fulfill the purposes outlined in the section above, in line with our justifiable reasons for processing or for a period specifically required by applicable regulations or laws, such as retaining the information for regulatory reporting purposes.

When determining the relevant retention periods, we will take into account factors including:

our contractual obligations and rights in relation to the information involved;
legal obligation(s) under applicable law to retain data for a certain period of time;
statute of limitations under applicable law(s);
our legitimate interests where we have carried out balancing tests (see section on 'How we use your personal information' above);
(potential) disputes; and
guidelines issued by relevant data protection authorities.

Otherwise, we securely erase your information where we no longer require your information for the purposes collected.

7. Your Rights Regarding Your Information

Under your local data protection law, you may have a number of rights concerning the data we hold about you. For additional information on your rights in your local country, please contact your data protection authority. In the case you want to exercise any of your rights concerning the information we hold about you and subject to applicable law, please contact us at support@orpay.co.uk. If you are in the EU, you have the following rights under EU data protection law:

The right to be informed. You have the right to be provided with clear, transparent and easily understandable information about how we use your information and your rights. This is why we’re providing you with the information in this policy.
The right of access. You have the right to obtain access to your information (if we’re processing it). This will enable you, for example, to check that we’re using your information in accordance with data protection law. If you wish to access the information we hold about you in this way, please get in touch (see Orpay Contact Details).
The right to rectification. You are entitled to have your information corrected if it is inaccurate or incomplete. You can request that we rectify any errors in the information that we hold by contacting us (see Orpay Contact Details).
The right to erasure. This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of the information that we hold about you by contacting us (see Orpay Contact Details). The right is not absolute and only applies in certain circumstances.
The right to restrict processing. You have rights to ‘block’ or ‘suppress’ further use of your information. When processing is restricted, we can still store your information, but will not use it further.
The right to data portability. You have the right to obtain your personal information in an accessible and transferrable format so that you can re-use it for your own purposes across different service providers. This is not a general right however and there are exceptions. To learn more please get in touch (see Orpay Contact Details).
The right to lodge a complaint. You have the right to lodge a complaint about the way we handle or process your information with a competent data protection authority (see Complaints section).
The right to withdraw consent. If you have given your consent to anything we do with your information (i.e. if we rely on consent as a legal basis for processing certain information), you have the right to withdraw that consent at any time. You can do this by contacting us (see Orpay Contact Details). Withdrawing consent will not however make unlawful our use of your information while consent had been apparent.
The right to object to processing. You have the right to raise an objection to certain types of processing, including processing for direct marketing and profiling. You can object by contacting us on the details above (Orpay Contact Details).

8. Changes to our privacy policy

We will be posting any changes to our privacy to the Orpay website and to the and, where appropriate, we may notify you of any changes for example by push notification or email.

This privacy policy was last updated: 22/11/2022

9. Complaints

In the case you are not satisfied with our response to a complaint you made about your information or believe our processing of your information does not comply with data protection law, you can make a complaint to the Information Commissioner’s Office (ICO) using the following details:

Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Website: www.ico.org.uk
Telephone number: 0303 123 1113