Privacy Notice
Version 2026-08-29-v1 · Effective 29 August 2026
For restaurant owners, staff, diners, visitors and other people whose personal data is processed through OrderNow.al.
This notice explains how OrderNow.al processes personal data. It is information, not consent. Where consent is legally required—such as optional analytics, precise location or marketing—we ask for it separately and you may withdraw it without affecting earlier lawful processing.
1. Who is responsible
KAVIORA TECHNOLOGIES SHPK (NIPT M61628038K), Rruga Muhedin Llagani, Kompleksi Square 21, Shkallë 3, Ap. 11, Tiranë, Albania, operates OrderNow.al. Contact: hello@kaviora.tech.
Kaviora is the controller for platform accounts, subscriptions, security, service administration and its own consent-based product analytics. A restaurant is normally the controller for its staff, diner orders, bookings and restaurant communications; Kaviora processes that data for the restaurant under the Data Processing Addendum. In limited cases the parties may each have independent legal duties for the same transaction.
2. Data we process
Restaurant owners and staff
Name, work email, authentication identifiers, role and permissions; restaurant identity, NIPT/tax, contact, address, location, opening-hours and configuration data; menu, price, allergen, image and operational content; subscription, plan, invoice and manual-payment references; support communications; and security/audit records.
Diners and visitors
Menu and discovery activity where optional analytics is accepted; an opaque browser/session identifier; language choice; order, cart, table, bill-request and booking details; name, telephone number, email and notes where the relevant workflow requires them; approximate technical/request information; and precise location only after browser permission is granted. Payment-card data is not currently collected or processed by OrderNow.al.
Automatically generated and inferred data
Device/browser information, request timestamps, security logs, rate-limit records and a salted or truncated IP-derived hash may be used for security and abuse prevention. Raw IP addresses may appear temporarily in infrastructure logs but are not intentionally stored in behavioural analytics records. We do not infer nationality from language or location.
3. Purposes and legal bases
- Contract and pre-contract steps: create accounts, operate menus, orders, bookings, staff access, QR codes, billing and support.
- Legal obligations: accounting, tax, lawful requests, dispute records and regulatory compliance.
- Legitimate interests: secure the service, prevent fraud/abuse, diagnose faults, maintain audit trails and improve reliability, balanced against individual rights.
- Consent: optional behavioural analytics, precise device location and optional marketing or promotional communications.
- Restaurant instructions: fulfil diner and staff-data workflows where Kaviora acts as processor.
Required account, restaurant, order or booking fields are marked in the interface. Without them, we or the restaurant may be unable to create the account or fulfil that request. Optional fields may be left blank.
4. Recipients and service providers
Data is made available only as needed to the restaurant concerned, its authorised staff, Kaviora personnel with a business need, professional advisers, competent authorities, and service providers supporting hosting, authentication, database/storage, monitoring, email, messaging and AI-assisted menu processing. Current or optional providers include Vercel, Supabase, Sentry, Resend, Twilio, Telegram and Anthropic, only when the relevant service or integration is configured and used. Kaviora does not sell personal data.
AI-assisted menu import or translation is intended to send menu content or images, not diner order, booking or payment information. Restaurants must not upload unnecessary personal data in menu files.
5. International transfers
Some providers may process data outside Albania. Where the destination is not recognised as adequate, Kaviora uses an applicable lawful transfer mechanism, such as approved standard contractual clauses, together with supplementary safeguards where required. Information on the relevant safeguard is available on request, subject to protection of confidential details.
6. Retention
Data is kept only for the shortest period needed for the purpose, a restaurant's documented instruction, security/dispute handling and mandatory accounting or legal retention. Retention therefore depends on record type and the restaurant's configured retention period. Guest names, phone numbers, emails and notes on orders and bookings are removed after 3 months unless the restaurant chooses a longer period (at most 2 years); the order items and amounts remain. Account, order and booking data is deleted or returned after the service relationship when no legal or dispute hold applies; short-lived logs and rate-limit records expire on operational schedules; consent and contract evidence is retained for the period needed to demonstrate compliance. Backups age out on their protected rotation rather than being edited in place.
7. Security
Measures include role-based access, tenant scoping, encryption in transit, encryption of selected contact fields at rest, secret separation, audit logging, input validation, rate limiting and controlled backups. No system is risk-free. Restaurants must protect credentials, limit staff access and notify Kaviora promptly of suspected compromise.
8. Your rights
Subject to the conditions and exceptions in Albanian law, you may request access, correction, deletion, restriction, portability and information about processing; object to processing based on legitimate interests or direct marketing; and withdraw consent at any time. We normally respond within 30 days and may extend by up to 60 additional days for complex or numerous requests, with notice of the reason.
For an order or booking, contact the restaurant first because it is normally the controller. You may also contact Kaviora at hello@kaviora.tech; we will forward or assist with a processor-side request where appropriate. We may need to verify identity before acting.
9. Complaints
You may complain to the Albanian Information and Data Protection Commissioner (IDP), Rruga “Abdi Toptani”, Nd. 5, Tiranë 1001, Albania, at idp.al. Contacting Kaviora first is welcome but does not limit that right.
10. Automated tools and choices
AI tools may suggest menu extraction, translations or operational insights, but restaurant staff remain responsible for reviewing them. OrderNow.al does not currently make decisions about individuals that produce legal or similarly significant effects solely by automated means. Subscription expiry or security controls may restrict service under objective account rules; support can review an apparent error.
11. Children
Restaurant-owner accounts are for adults authorised to act for a business. OrderNow.al is not directed at children and restaurants should not intentionally use free-text fields to collect unnecessary information about minors.
12. Changes and contact
We will post a new version and effective date for changes. If a change materially affects a restaurant agreement or consent-based processing, we will provide an in-service notice or seek a new choice where required. Privacy questions and requests: hello@kaviora.tech.