Privacy Policy

Orderli B.V.
Schiekade 189, 3013 BR Rotterdam, The Netherlands
Chamber of Commerce: 77435877
Email: [email protected]

Last updated: 18 October 2026

This Privacy Policy explains how Orderli B.V. ("Orderli", "we", "us", or "our") processes personal data in connection with its QR ordering platform and related services, in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and other applicable data protection legislation.

1. Roles in Data Processing

Orderli operates in two distinct roles depending on the context of the data processing:

• Data Processor – when processing personal data of restaurant guests on behalf of our client restaurants. In this role, the restaurant is the Data Controller and determines the purposes and means of processing.
• Data Controller – when processing personal data relating to client restaurants, their employees, visitors to our marketing website (orderli.com), and our own internal operations.

2. When Orderli Acts as Data Processor

When a guest scans a QR code and places an order, Orderli processes personal data on behalf of the restaurant. The restaurant determines the purposes and means of this processing, and a Data Processing Agreement (DPA) governs the relationship between Orderli and the restaurant.

Categories of personal data processed

• Name
• Email address
• Phone number
• Table number and location identifier
• Order details and payment status
• IP address and device information (browser type, operating system)
• Free-text order notes

Special category data

Orderli does not intentionally collect special category data (such as health data). If a guest voluntarily includes health-related information (for example, allergy details) in order notes, the restaurant remains responsible as Data Controller for this data. We recommend that restaurants inform guests not to include sensitive personal data in free-text fields unless necessary.

3. When Orderli Acts as Data Controller

Orderli processes personal data of client restaurants (including their employees and representatives), visitors to our marketing website (orderli.com), and other individuals who interact with us directly, for the following purposes:

• Providing and maintaining our services
• Billing and invoicing
• Internal administration and business operations
• Compliance with legal obligations, including VAT-related recordkeeping
• Improving and developing our platform
• Communicating with clients about their accounts and our services
• Responding to demo requests, contact requests and chat messages you send us through our website
• Measuring and improving the use of our marketing website and the effectiveness of our advertising

Legal bases for processing (Article 6 GDPR)

• Performance of a contract – processing necessary to deliver our services to client restaurants, or to take steps at your request before entering into a contract, such as handling a demo request or scheduling a meeting (Art. 6(1)(b)).
• Legal obligation – processing required to comply with tax, accounting, and other regulatory requirements (Art. 6(1)(c)).
• Legitimate interests – processing necessary for our legitimate business interests, such as fraud prevention, platform security, service improvement, answering questions you ask us (for example through the chat) and cookieless measurement of the use of our own website, provided these interests are not overridden by the data subject’s rights and freedoms (Art. 6(1)(f)).
• Consent – where applicable, for example when subscribing to our newsletter or accepting analytics cookies, marketing cookies or visitor identification on our website (Art. 6(1)(a)). Consent may be withdrawn at any time.

Payments are processed by licensed Payment Service Providers. Orderli does not store credit card details.

Demo requests, contact forms and meetings through our website

When you request a demo, a quote or an integration on our website, contact us, or share a QR design with us, we process the information you enter. This information is sent directly to our CRM system at HubSpot. It consists of:

• your name, company name, email address and phone number;
• any message you include, such as a description of the integration or the POS system you are asking about;
• the context of your request: the page from which you sent the form and, where applicable, the selected plan, modules and settings, or a summary of and a link to the QR design you created in our design tool;
• technical data sent along with the submission, such as your IP address.

The form itself sets no cookies. If you have previously accepted marketing cookies, we include the HubSpot cookie (hubspotutk), so that HubSpot can link your request to the pages you visited on our website. We use this information to contact you, handle your request and prepare a possible contract. The legal basis is taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to business enquiries (Art. 6(1)(f) GDPR).

If you choose a time for a demo yourself, you use HubSpot’s meeting scheduler, which is shown in a window on our website. The information you enter there (such as your name, email address and the chosen time) is processed by HubSpot to schedule and confirm the meeting. The scheduler sets no cookies on our own domain; on HubSpot’s domains, a Cloudflare security cookie (__cf_bm) may be set to prevent abuse of the booking form.

Chat

On our website you can chat with us through Trengo. The chat is only loaded if you have accepted marketing cookies, because Trengo stores data in your browser to recognise your conversation. We process the messages you send and the information you share in them, such as your name or email address, to answer your question. The legal basis is our legitimate interest in answering questions (Art. 6(1)(f) GDPR) or, if your question relates to a (possible) contract, Art. 6(1)(b) GDPR.

4. Marketing

Orderli does not use identifiable guest personal data for its own marketing purposes. We may occasionally send service-related communications to our client restaurants.

If a restaurant collects marketing consent from its guests through the Orderli platform, the restaurant is solely responsible for ensuring compliance with applicable data protection laws, including obtaining valid consent where required.

5. SMS and Mobile Information

If a guest provides a mobile phone number and opts in to receive SMS notifications through the Orderli platform, that mobile number and the related messaging consent data are used solely for sending transactional order-related text messages and for operating, supporting, and securing the messaging service.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be sold or shared with any third parties, except with service providers that support the delivery of the messaging service, such as SMS platform providers, acting on our behalf and under appropriate contractual safeguards.

6. Subprocessors and International Data Transfers

Orderli engages the following subprocessors and service providers to deliver its services and its marketing website (orderli.com):

• DigitalOcean – hosting and infrastructure (EU/US)
• Backblaze – cloud storage and backups (EU/US)
• Cloudflare – hosting of our marketing website, security, DDoS protection and content delivery, including the videos and images on our website (global)
• Sentry – error monitoring and diagnostics (US)
• Mailchimp – transactional and service email delivery (US)
• Spryng and MessageBird – SMS notification services (EU/NL)
• PostHog – website analytics for orderli.com (EU, Frankfurt)
• HubSpot – CRM, website forms, meeting scheduler and marketing cookies on orderli.com (data stored in HubSpot’s EU data centre; HubSpot Inc. is based in the US)
• Google – Google Tag Manager, Google Analytics and Google Ads conversion measurement on orderli.com (US/global)
• Microsoft – Microsoft Clarity, usage analytics and session recordings on orderli.com (US; the contracting party in the EU is Microsoft Ireland Operations Ltd.)
• Trengo – chat on orderli.com (EU)
• rb2b and Warmly – visitor identification on orderli.com, only with your consent (US)

Where personal data is transferred outside the European Economic Area (EEA), Orderli ensures that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or the recipient’s participation in a recognised adequacy framework. Data Processing Agreements are in place with all subprocessors.

An up-to-date list of subprocessors is available upon request by contacting [email protected].

7. Cookies and Tracking Technologies

When Orderli acts as Data Processor (ordering platform)

When guests use the Orderli ordering platform on behalf of a restaurant, Orderli uses only first-party cookies that are strictly necessary for the platform to function, such as session management and order processing. Orderli does not place any third-party cookies in this context.

Client restaurants may choose to add their own third-party cookies or tracking technologies to the Orderli platform. In such cases, the restaurant is responsible as Data Controller for ensuring compliance with applicable cookie consent and data protection laws.

When Orderli acts as Data Controller (marketing website)

On our marketing website (orderli.com), we use cookies and similar technologies (such as your browser’s local storage and session storage), grouped into the following categories:

• Necessary and functional cookies – needed for the website to work and to remember your choices, such as your cookie preferences. We do not ask for consent for these.
• Analytics cookies – Google Analytics (through Google Tag Manager), Microsoft Clarity and PostHog, to understand how our website is used. Only with your consent.
• Marketing cookies – HubSpot, Google Ads conversion measurement and the Trengo chat. Only with your consent.
• Visitor identification – rb2b and Warmly, which try to work out which company or person is visiting our website. Only with your separate consent.

On your first visit, our cookie banner asks for your consent per category. Non-necessary categories are off by default, and the related services only load after you have given consent. You can change your choice or withdraw your consent at any time through the ‘Cookie preferences’ link at the bottom of every page. If you withdraw consent, we reload the page without the services concerned and delete the related cookies on our own domain. You can also delete or block cookies through your browser settings.

Website analytics with PostHog

To analyse how our marketing website is used, we use PostHog, a service of PostHog Inc. PostHog processes this data on our behalf as our processor, under a data processing agreement, and the data is stored in the EU (Frankfurt, Germany). We measure:

• the pages viewed and the page on which your visit starts;
• the referring website or medium through which you arrived (for example a search engine, a shared link or UTM parameters in the link);
• clicks on buttons and links;
• form submissions, as an event (for example that a demo request was sent), without the content of the fields;
• technical data such as device type, browser, screen size and an approximate location (country or city) derived from the IP address.

As long as you have not consented to analytics cookies, or if you choose only necessary cookies, PostHog counts your visit without cookies: nothing is stored on your device (no cookies, no local storage). PostHog’s server computes a hashed visitor code from your IP address and browser data, using a key that changes every day, and the IP address is then discarded (IP anonymisation). This lets us count visits per day, but not follow you across days, and no profile of you is created. The legal basis is our legitimate interest in measuring the use of our own website (Art. 6(1)(f) GDPR).

If you accept analytics cookies, PostHog sets a first-party cookie (ph_…_posthog) and uses your browser’s local storage and session storage, so we can see that visits belong together, for example across several pages and days. The legal basis is then your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the cookie settings on our website; the PostHog cookie and the stored data are then removed from your browser.

Google Analytics and Microsoft Clarity

If you accept analytics cookies, we load Google Tag Manager from Google. Through Google Tag Manager we use Google Analytics to measure how visitors use our website, for example which pages are viewed and how visitors arrive; Google Analytics sets cookies such as _ga and _gid for this. Through Google Tag Manager we also measure whether a visit after a click on one of our Google Ads advertisements leads to a request. Google advertising cookies (such as _gcl_au) are only set if you also accept marketing cookies; we use Google Consent Mode for this. Without that consent, Google may still receive cookieless signals, for example that a conversion has taken place.

In addition, also only with your consent to analytics cookies, we use Microsoft Clarity. Clarity records how visitors interact with our pages, such as mouse movements, clicks and scrolling, and creates session recordings and heatmaps from this. Clarity sets cookies such as _clck and _clsk on our domain and may use cookies on Microsoft domains (such as MUID). The legal basis for Google Analytics and Clarity is your consent (Art. 6(1)(a) GDPR). Google and Microsoft may process data in the United States; see section 6 for the safeguards for transfers.

Marketing cookies: HubSpot, Google Ads and Trengo

If you accept marketing cookies, we load HubSpot’s tracking code. HubSpot then sets cookies (such as hubspotutk and __hstc) to recognise that visits come from the same device and to keep track of which pages you view. If you later fill in a form, these visits can be linked to your request in HubSpot, so that our sales team knows what you are interested in. With the same consent, Google may set advertising cookies for the conversion measurement of our Google Ads advertisements, and we load the Trengo chat (see section 3). The legal basis is your consent (Art. 6(1)(a) GDPR).

Visitor identification: rb2b and Warmly

Only if you give separate consent to ‘Visitor identification’ in our cookie banner do we load the scripts of rb2b and Warmly. Based on, among other things, your IP address, browser data and data available to the provider itself, these services try to work out which company, and in some cases which person, is visiting our website and which pages are viewed. Our sales team uses this information to contact companies that show an interest in Orderli. Both providers are based in the United States. Which cookies or other storage they use in your browser is determined by these providers themselves. The legal basis is your consent (Art. 6(1)(a) GDPR). If you decline, these scripts are not loaded and you remain anonymous to us.

Overview of cookies and local storage

Below are the cookies and storage keys that we or the services named use on our website. The retention periods of third-party cookies are the default periods according to the provider’s documentation; the provider may change them.

• Necessary and functional – ncc_c and ncc_e (your cookie choice, 1 year); orderli_exp_home_cta_copy_v1 (which of two texts you see on a button on the homepage, for an A/B test; contains no identifier, 30 days); local storage in your browser for, among other things, your sound preference for videos, your progress in the checklist and your cookie choice for PostHog; __cf_bm (Cloudflare security cookie on HubSpot’s domains when you use the meeting scheduler, 30 minutes).
• Analytics – _ga and _ga_… (Google Analytics, 2 years); _gid (Google Analytics, 24 hours); _gat (Google Analytics, 1 minute); _clck and _clsk (Microsoft Clarity) and the Microsoft cookies MUID, CLID, ANONCHK, MR and SM; ph_…_posthog (PostHog, 1 year) and the related local storage and session storage.
• Marketing – hubspotutk and __hstc (HubSpot, 6 months); __hssc (HubSpot, 30 minutes); __hssrc (HubSpot, until the end of the session); messagesUtk (HubSpot, 6 months); _gcl_au (Google Ads conversion measurement, 90 days); Trengo_Visitor, Trengo_VisitorToken and Trengo_Session in your browser’s local storage (Trengo chat).
• Visitor identification – cookies and local storage of rb2b and Warmly; their names and retention periods are determined by these providers.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Specific retention periods depend on the type of data and the applicable legal requirements:

• Guest order data (as Processor) – retained in accordance with the restaurant’s instructions and the applicable Data Processing Agreement.
• Client account data – retained for the duration of the contractual relationship and up to 12 months after termination, unless longer retention is required by law.
• Financial and tax records – retained for the statutory period required under Dutch law (generally 7 years).
• Log and diagnostic data – retained for up to 12 months for security and troubleshooting purposes.
• Website analytics data (PostHog) – retained for PostHog’s standard retention period for our paid plan (7 years). Visits counted without cookies cannot be linked to you across days.
• Microsoft Clarity – session recordings are retained for 30 days; heatmaps and a small selection of recordings for up to 9 months, in accordance with Microsoft’s standard policy.
• Google Analytics – retained in accordance with the retention setting of our Google Analytics account.
• Demo requests, contact requests, meetings, chat conversations and visitor identification – retained for as long as necessary to handle and follow up on your request or question. If you become a client, the periods for client account data above apply.
• Cookies – the retention periods of the individual cookies are listed in the overview in section 7.

After the applicable retention period expires, personal data is securely deleted or anonymised. Individuals may contact [email protected] to enquire about data retention for their specific situation.

9. Security Measures

Orderli implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or destruction. These measures include:

• HTTPS/TLS encryption for all data in transit
• Encryption of sensitive data at rest
• Role-based access controls with the principle of least privilege
• Restricted internal access on a need-to-know basis
• Regular security assessments and monitoring
• Contractual security obligations with all subprocessors
• Incident response procedures for data breach detection and notification

10. Data Breach Notification

In the event of a personal data breach that poses a risk to the rights and freedoms of individuals, Orderli will notify the relevant supervisory authority without undue delay, and where feasible within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR.

Where the breach is likely to result in a high risk to affected individuals, we will also notify those individuals directly, in accordance with Article 34 GDPR.

When acting as Data Processor, Orderli will inform the affected restaurant (Data Controller) without undue delay upon becoming aware of a data breach.

11. Children's Data

The Orderli platform is not specifically directed at children under the age of 16. However, the platform may be used by guests of all ages when placing orders at a restaurant. We do not knowingly collect personal data from children beyond what is necessary to process an order.

Parents or guardians who have concerns about data relating to a child may contact [email protected].

12. Automated Decision-Making

Orderli does not use automated decision-making or profiling that produces legal effects or similarly significantly affects individuals, as described in Article 22 GDPR.

13. Your Rights as a Data Subject

Under the GDPR, individuals have the following rights with respect to their personal data:

• Right of access – to obtain confirmation of whether your data is being processed and to receive a copy.
• Right to rectification – to have inaccurate or incomplete data corrected.
• Right to erasure – to request deletion of your data where it is no longer necessary or where consent is withdrawn.
• Right to restriction – to limit how your data is processed in certain circumstances.
• Right to data portability – to receive your data in a structured, commonly used, and machine-readable format.
• Right to object – to object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent – where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month, as required by the GDPR. In complex cases, this period may be extended by a further two months.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at www.autoriteitpersoonsgegevens.nl.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify our client restaurants and update the "Last updated" date at the top of this document.

We encourage you to review this Privacy Policy periodically.