Privacy Policy for Users

Last updated: 22 November 2022

Dear Customer

Orpay Ltd. (“our”, "we", "us" or “Orpay”) is committed to protect the privacy of all users of our mobile application and website (together the "sites"). Orpay is the "data controller" of the information we process, unless otherwise stated.

This Privacy Policy applies to users of Orpay’s services anywhere in the world, including users of Orpay’s app, website, features, or other services, unless covered by a separate privacy policy. Therefore, while visiting our website, registering or placing orders, you agree to this privacy policy.

This Privacy Policy describes the personal information we collect and explains how we use, share and protect this information, and your choices regarding this information.

We recommend that you read this under the following sections:

1. Orpay Contact Details

We are Orpay Ltd and we usually just use the name Orpay. In case you have any queries or requests about this privacy policy or the ways we handle your data in general, please get in touch with us using the following contact details.

Customer services team and data protection officer at: support@orpay.co.uk

2. Ways We Collect Your Information

Your personal information is collected when you interact with us or use our services, such as when you use our Sites to place an order or when you contact us. In addition, we may look at how visitors use our Sites, to help us optimise and improve our services and customer experience.

We collect information:

when you create an account with us or when you change your account settings;
when you place an order with us and during the process of the order (including for payment, order table service, order pickup and order delivery);
when you contact us directly through email, phone, message, post, through our chat function or through a social media page we manage (Facebook, Instagram);
when you give us your consent to contact you through email, phone, SMS, post, push notifications or through our chat function to send you marketing material, or to invite you to participate in surveys about our services, or our partners’ services;
when you participate in a competition or promotion about our services, or our partner’s services; and
when you visit, browse and use our Sites (including before and after you create an account with us).

We may also collect information from third party sites, such as advertising platforms and from our fraud detection providers if applicable.

3. Kind of Information We Collect From You

The kind of information we collect from you can be clearly found in this section, as part of our commitment to the privacy of our visitors and customers to our Sites.

The information we ask for to provide about yourself when you visit the Sites or make an order through the app or the Sites include: your name, contact details (phone number, email), delivery address, order details and payment information such as credit or debit card information. Also, we may ask you to provide your date of birth and we collect that information to verify your age when you want to place an order for age restricted items.

In addition, we collect information about your usage of the Sites and information about you such as: any messages you post to the Sites or when you contact us or provide us with feedback, including via email, phone, letter or chat function. In case you contact us by phone, we may record the call for training and service improvement purposes, and make notes in relation to your call.

We collect technical information from your mobile device or computer, such as its operating system, the device and connection type and the IP address from which you are accessing our Sites. Also, we may collect technical information about your use of our services through a mobile device, for example, carrier, location data and performance data such as mobile payment methods, interaction with other retail technology such as use of NFC Tags, QR Codes and/or use of mobile vouchers. This information is collected and used by us automatically, unless you have elected to remain anonymous through your device and/or platform settings, if you use the service through your mobile device(s) through any Orpay mobile application, through your mobile's browser or otherwise.

We process health information about you only where you volunteer and consent to this, for example if you specify any food allergies or dietary requirements.

Where we need to collect information by law, or under the terms of a contract we have with you, and you fail to provide that information, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with our services). In this case, we may have to cancel our service to you but we will notify you if this is the case at the time.

4. How we Use Your Information

We will only process the information we collect about you if there is a reason for doing so, and if that reason is permitted under data protection law.

Where we need to in order to provide you with the service you have requested or to enter into a contract, we use your information:

to enable us to provide you with access to the relevant parts of the Sites; we collect necessary cookies from your device;
to supply the services you have requested; we collect your name, contact details, delivery address and order details;
to enable us to collect payment from you;we collect your credit or debit card information; and;
to contact you where necessary concerning our services, such as to resolve issues you may have with your order, we collect the information listed above and any additional information we may need to resolve your issue;
to enable riders and stores to reach you on the basis of the service agreement when they deliver your order quickly; we transfer your delivery information; and
to enable stores and restaurants to reach you by a call to resolve an issue with your order quickly, for example when a product is not available.

We also process your data where we have a legitimate interest for doing so — for example personalisation of our service, including processing data to make it easier and faster for you to place orders. We have listed these reasons below:

personalise our services, including to make it easier and faster for you to place orders;
to improve the effectiveness and quality of service that our customers can expect from us in the future;
to tailor content that we or our third party restaurant or advertising partners display to you, for example so that we can show you restaurants which are in your area or make sure you see the advertising which is most relevant to you, based on characteristics determined by us;
to enable our customer support team to help you with any enquiries or complaints in the most efficient way possible and to provide a positive customer experience;
to contact you for your views and feedback on our services or our partners’ services and/or products and to notify you if there are any important changes or developments to the Sites or our services, including letting you know that our services are operating in a new area, where you have asked us to do so;
to send you information by post about our products, services and promotions (if you do not want to receive these, you can let us know by getting in touch (see Contact Details));
to analyse your activity on the Sites so that we can administer, support, improve and develop our business and for statistical and analytical purposes and to help us to prevent fraud; and
detect, investigate, report and seek to prevent fraud or crime.

We also process your data to enforce our contractual terms with you and any other agreement, and for the exercise or defence of legal claims and to protect the rights of Orpay Ltd, restaurant partners, or others (including to prevent fraud).

If you submit comments and feedback regarding the Sites and the services, we may use such comments and feedback on the Sites and in any marketing or advertising materials. We will only identify you for this purpose by your first name and the city in which you live. Where you have chosen to receive push notifications from us through our mobile application (if available), we may send you push notifications relating to the services that you have requested from us and information about our services and offers. You can choose to stop receiving push notifications from us at any time by changing your preferences on your mobile device or by getting in touch (see Contact Details).

We will also analyse data about your use of our services from your location data to create profiles relating to you and for you. This means that we may make certain assumptions about what you may be interested in and use this, for example, to send you more tailored marketing communications, to present you with restaurants that we think you will prefer, or to let you know about special offers or products which we think you may be interested in. This activity is referred to as profiling. You have certain rights in relation to this type of processing. Please see the section below for more information regarding your rights on your information.

Where we are under a legal obligation to do so we may use your information to create a record of your order(s) and comply with any legal obligation or regulatory requirement to which we are subject.

5. Cookies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of the Site may become inaccessible or not function properly.

6. Direct Marketing

Where you have given your consent or where we have a legitimate interest for doing so (and are permitted to do so by law) we will use your information to let you know about our other products and services that may be of interest to you and we may contact you to do so by email, post or phone. You can control your marketing preferences by:

visiting our mobile application;
clicking on the "Account" icon; and
scrolling down to "Profile Details"

7. Social Media Fan Pages

We have profiles on social media platforms on which we advertise our product, services, partners and we interact with customers. Since we operate these profiles on third-party platforms, each time you visit these social media channels the operators collect different personal data from you.

We and the respective operators of the social media platforms act as joint controllers. Where two or more controllers jointly determine the purposes and means of processing, they shall be joint controllers.

The social media platforms Facebook and Instagram are operated by Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland.

We are responsible for all interactions on our own platforms. The operators of the social media platforms themselves are data controllers for general interactions and interactions outside our profiles. An exception applies to the data processing described below for the usage analysis (page insights); we are jointly responsible with Facebook for this.

The following links will show you exactly which data is collected by the respective social media operators:

For pages, Facebook provides page administrators with statistics and insights that help them understand the types of actions people take on their pages ("Page Insights"). When you visit or interact with a Page or its content, information such as the following may be collected and used to create Page Insights:

Viewing a Page, or a post or video from a Page
Following or unfollowing a Page
Liking or unliking a Page or post
Recommending a Page in a post or comment
Commenting on, sharing or reacting to a Page post (including the type of reaction)
Hiding a Page's post or reporting it as spam
Clicking a link to a Page from another Page on Facebook or from a website off Facebook
Hovering over a Page's name or profile picture to see a preview of the Page's content
Clicking on the website, phone number, Get Directions button or other button on a Page
Whether you're on a computer or mobile device while visiting or interacting with a Page or its content

We and Facebook are jointly responsible for the processing of your data for the provision of page insights.

For all data processing on this website, we are solely responsible for processing your data in accordance with data protection regulations. As part of our agreement with Facebook, we have determined that Facebook is primarily responsible for fulfilling its information obligations in connection with the Page Insight data and for ensuring that you exercise your rights under the GDPR. For more information about your data subject rights on Facebook, please see Facebook's Page-Inside Privacy Policy

8. Automated Decision Making

Fraud checks may be undertaken on all customers. Where we believe we may identify fraudulent activity we may deactivate you from placing an order and using our Sites.

Fraud checks are conducted on all customers because this is necessary for us to perform our contracted services to customers, by ensuring that the services we (and restaurants) provide are duly paid for, and also so that individuals themselves are protected from fraudulent transactions on their cards. In some cases, such as when a user is detected to be abusing Orpay’s referral program, such activity may result in deactivation.

We may deal with large volumes of customers and orders therefore, automated systems may be used such as a third party fraud detection provider, which is responsible for analysing your order data in order to make automated decisions as to whether or not we will accept an order. We believe this is a fairer, more accurate and more efficient way of conducting fraud checks given that human checks are not possible within the timeframes and the volumes of customers that we deal with.

The checks and decisions that are made may look at various components including known industry indicators of fraud which our expert fraud detection provider makes available to us, as well as past fraud patterns we may have detected on our Sites. Combining these parameters, these generate an automated score indicating the likelihood of a fraudulent transaction. If a high score is indicated by the system for you, then we may decline an order or a payment or even block you from our services. The specific fraud indicators are dynamic so will change depending on what types of fraud are being detected in the wider world, country and our Sites at any particular time.

You have certain rights in respect of this activity. Fraud detection may be in place to protect all of our customers as well as Orpay Ltd. You have the right to contest any fraud decision made about you and to be given more information about why any such decision was made by contacting us as set out in section 1 above.

9. Retention and Deletion Of Your Information

Orpay retains user information for as long as necessary for the purposes described and stated in this policy.

Users may request deletion of their accounts at any time. Orpay may retain user information for a period after a deletion request due to legal or regulatory requirements, for purposes of safety, security, and fraud prevention, or because of an issue relating to the user’s account such as an outstanding credit or an unresolved claim or dispute.

When determining the relevant retention periods, we will take into account factors including:

our contractual obligations and rights in relation to the information involved;
legal obligation(s) under applicable law to retain data for a certain period of time;
statute of limitations under applicable law(s);
our legitimate interests where we have carried out balancing tests (see section on how we use your personal information above);
(potential) disputes; and
guidelines issued by relevant data protection authorities.

Otherwise, we securely erase your information where we no longer require your information for the purposes collected.

10. Disclosure Of Your Information

The information we collect about you will be transferred to and stored on our servers located within the EU. We are very careful and transparent about who else your information is shared with.

We share your information with third party service providers which provide services on our behalf. The types of third party service providers whom we share your information with include for example:

Payment providers (including online payment providers and fraud detection providers);
IT service providers (including cloud providers);
Restaurant partners;
Customer support partners; and
Marketing and advertising partners.

Orpay Ltd will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy when it is transferred to third parties.

If our business enters into a joint venture with, purchases or is sold to or merged with another business entity, your information may be disclosed or transferred to the target company, our new business partners or owners or their advisors.

We may also share your information:

in order to enforce our contractual terms with you and any other agreement;
to protect the rights of Orpay Ltd, restaurant partners, or others, including to prevent fraud; and
with such third parties as we reasonably consider necessary in order to prevent crime, e.g. the police or for health and safety purposes;
if we are under a duty to disclose or share your information in order to comply with (and/or where we believe we are under a duty to comply with) any legal obligation or regulatory requirement of the local state. This includes exchanging information with other companies and other organisations for the purposes of fraud protection and prevention.

International transfers of data:

in some cases the personal data we collect from you might be processed outside the European Economic Area ("EEA"), such as the United States, the Asia and the countries in which Orpay Ltd operates. These countries may not have the same protections for your personal data as the EEA has. However, we are obliged to ensure that the personal data that is processed by us and our suppliers outside of the EEA is protected in the same ways as it would be if it was processed within the EEA. Therefore, there are certain safeguards in place when your data is processed outside of the EEA.
we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
your personal data is transferred to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission;
we use the EU approved Standard Contractual Clauses; and
where your personal data is transferred to third party providers based in the US, data may be transferred to them if they have self-certified under the Privacy Shield framework in relation to the type of data being transferred, which requires them to provide similar protection to personal data shared between the EU and the US.

If you require more information on the countries to which personal data may be transferred and the specific mechanism used by us when transferring your personal data out of the EEA, get in touch by using the contact details above.

11. Your Rights Regarding Your Information

Under certain circumstances, you have rights under data protection law in relation to the information we hold about you.

These include:

The right of access. This is also known as a “data subject access request”. You have the right to receive a copy of the information we hold about you and to check that we are lawfully processing it.
The right to rectification. You are entitled to have any incomplete or inaccurate information we hold about you corrected, though we may need to verify the accuracy of the new information you provide to us. Users may request to change their email address on their profile by contacting support@orpay.co.uk. Users can edit their personal information from their account directly through the application.
The right to erasure. This is also known as “the right to be forgotten” which enables you to request the deletion or removal of certain of the information that we hold about you where there is no good reason for us continuing to process it. This right is not absolute and only applies in certain circumstances. Users can edit or delete their personal information from their account directly through the application.
The right to restrict processing. You have the right to block or suppress further use of your information in certain circumstances. When processing is restricted, we may still have a lawful reason to store your information, but we will not use it further.
The right to data portability. You have the right to receive your information in a structured, commonly used and machine-readable format which you can transfer to another service provider or other third party. This right is not absolute and only applies in certain circumstances.
The right to withdraw consent. Where we rely on consent to use your information, you have the right to withdraw that consent at any time. Withdrawing consent will not, however, make unlawful our use of your information before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain services to you.
The right to object to processing. You have the right to object to certain types of processing of your information, including processing for direct marketing purposes and profiling. You can object by changing your marketing preferences and disabling cookies as set out in the above sections or by contacting us.
You have the right not to be subject to a decision based solely on automated processing of your information, such as in connection with our fraud checks.

If you are unhappy with how we have handled your information you can contact your local data protection authority. In the UK, this is the Information Commissioner’s Office. We would, however, really appreciate the chance to deal with your concerns before you approach your local data protection authority and so we please ask that you contact us first. For additional information on your rights regarding your information we hold please contact your data protection authority and see below.
In the case you want to exercise any of your rights concerning the information we hold about you and subject to applicable law, please contact our Data Protection Officer of Orpay at support@orpay.co.uk.

12. Security Of Your Information

In order to ensure the personal information we hold about you is appropriately protected, we adopt robust policies and technologies. This means we take appropriate steps to protect your information from unauthorised access and against unlawful processing, destruction, accidental loss and damage.

You are responsible for keeping your password confidential where you have chosen a password that allows you to access certain parts of the Sites or apps. We advise you not to share your password with anyone.

The transmission of information through the internet is not completely secure. Even though we will take steps to protect your information, we cannot guarantee the security of your information transmitted to the Sites; any transmission is at your own risk. When we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

13. Changes To Our Privacy Policy

We may occasionally update this Privacy Policy. In case we make any significant changes, we will notify users in advance of the changes through the Sites, or by other means such as by push notification or email.

After such notice, use of our services by users in countries outside the European Union will be understood as consent to the updates to the extent permitted by law.

This privacy policy was last updated: 22/11/2022

14. Complaints

In the case you are not satisfied with our response to a complaint you made about your information or believe our processing of your information does not comply with data protection law, you can make a complaint to the Information Commissioner’s Office (ICO) using the following details:

Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Website: www.ico.org.uk