Privacy Policy
Effective Date: 1 October 2026 | Last Updated: 8 August 2026
This Privacy Policy explains how personal data is collected, used, shared, protected, and retained when you use the Orderly website, mobile application, and related services. The published version must reflect the Platform’s actual operations, service providers, and the legal entity responsible for the relevant processing.
1. Scope and Responsible Entity
This Policy applies to personal data processed through the Platform. Before publication, identify the legal name, official address, and contact details of the entity acting as the controller or otherwise legally responsible for the processing under the actual operating structure.
2. Data We Collect or May Collect
This may include account and contact data; authentication information and verification codes; addresses and location where enabled; orders, reservations, and preferences; payment status and transaction references; device, app, IP address, technical, and crash data; support communications; reviews and content; and cookie or similar-technology data.
3. Sources of Data
We receive data directly from users, from devices with user permission, from participating venues and payment or delivery providers when a transaction is fulfilled, and from technical service providers to the extent necessary to operate and secure the Platform.
4. How We Use Data
We use data to create and verify accounts, process reservations, orders, Group Order, payments and delivery, provide location-based features, manage support, complaints and refunds, send operational notifications, personalize certain features, protect accounts and the Platform, prevent fraud, understand performance, improve the service, and comply with legal or regulatory requirements.
5. Legal Basis for Processing
Processing is carried out on the legal basis appropriate to each purpose and under applicable law, which may include performing a service requested by the user, complying with a legal obligation, protecting rights and interests permitted by law, or obtaining consent where required. Where consent is the basis, it should be capable of withdrawal in accordance with applicable law without affecting prior lawful processing.
6. Location and Addresses
Precise location is used only where permission is enabled or a user-requested feature needs it, such as discovering nearby venues or setting a delivery address. Location permission can be managed through device settings, and some features may be affected if access is disabled. Users may also add and save addresses where the Platform supports this.
7. Orders, Reservations, and Group Order
Order and reservation data is processed to fulfil the service, manage status, support, refunds, and disputes. In Group Order, limited information needed for the group experience may be visible to participants, but unnecessary financial or personal data should not be exposed to other participants.
8. Payment Data
An independent payment provider may process card or wallet data directly. Orderly should not store full card details or security codes unless that is genuinely part of a compliant and authorized payment design. Before publication, identify the payment provider actually used and clarify what payment data Orderly receives from that provider.
9. Sharing Personal Data
The minimum necessary data may be shared with the venue receiving an order or reservation, delivery and payment providers, hosting, messaging, support, analytics and security providers, professional advisers, and public authorities where legally required. Personal data is not sold to advertisers.
10. Marketing and Advertising
Limited data may be used for offers, recommendations, or campaign measurement where permitted. Consent should be obtained where required, and appropriate controls should be available for marketing communications. Opting out of marketing does not stop essential order, reservation, or account-security messages.
11. Analytics and Service Improvement
Technical and usage data may be used to understand performance, errors, stability, and user experience. Aggregated or less-identifiable data should be used where appropriate, and no more data should be processed than reasonably needed for the purpose.
12. International Processing and Transfers
If technical infrastructure requires data to be processed outside Egypt or transferred to an entity in another country, applicable legal requirements and appropriate safeguards must be addressed before the transfer or access occurs.
13. Data Retention
Data is retained for as long as reasonably necessary for the purpose collected, account and transaction administration, disputes, fraud prevention, and legal obligations. Once there is no longer a legitimate need, data should be deleted, anonymized, or appropriately isolated under the approved retention policy. Actual internal retention periods should be defined before implementation.
14. Data Security
Appropriate technical and organizational measures are used to protect data against unauthorized access, use, disclosure, alteration, or loss in a manner proportionate to the data, risks, and technology involved. No electronic system can be guaranteed completely secure.
15. Security Incidents
If a security incident affects personal data, reasonable steps will be taken to contain, investigate, and remediate the issue, and notices will be made to authorities or affected individuals where legally required.
16. Your Rights
Subject to applicable law, users may have rights to request access, correction, updating, deletion, restriction of certain processing, objection, or withdrawal of consent where consent is the legal basis. Some requests may be subject to lawful limitations, which should be explained when responding.
17. Account Deletion
A clear route should be provided to request account deletion through the app or a published support channel. Deletion should remove or anonymize data that no longer needs to be retained, while allowing retention of information required by law or reasonably necessary for transactions, disputes, or fraud prevention.
18. Children
The Platform is not intentionally directed to children who lack legal capacity to use the relevant services or provide required consent without a parent or legal representative. If data is identified as having been collected from a minor in a manner inconsistent with law, appropriate verification, correction, or deletion steps should be taken.
19. Cookies and Similar Technologies
Website cookies and similar technologies are governed by the Cookies Policy. Non-essential technologies should not be activated before consent where consent is required, and users should be given a way to manage their choices.
20. Changes and Privacy Contact
This Policy may be updated when Platform features, service providers, data practices, or legal requirements change. The update date should be published and additional measures taken for material changes where required by law. Privacy requests may be sent to [approved privacy email], or support@orderly-eg.com if formally designated for this purpose.