Privacy policy
This privacy policy describes which personal data we collect on the sales point shop-dev.ordexa.rs, the purposes we process it for and the rights you have. The policy is an integral part of the Terms of use and payment. The data controller is Order Wave doo Novi Sad, PIB: 115072921, Bulevar kralja Petra I 24, Novi Sad, +381 61 2144514, office@ordexa.rs.
1. Data we collect
When creating an account: email address. When ordering: name, phone number and, for delivery, an address. When paying by card: card data is entered exclusively on the bank's secure page and is never available to our system; we only store a masked representation (first six and last four digits) so you can recognise the card in your account. Technical data: basic access records (logs) necessary for the operation and security of the system.
2. Purposes and legal basis
We process data to fulfil your order and the contract (receiving, preparing, delivering, charging, payment confirmation), to comply with legal obligations (fiscal, accounting and payment-services regulations), and on the basis of our legitimate interest in operating, securing and improving the sales point.
3. Cookies
We use only technical and functional cookies necessary for the site to work: session, account sign-in and language preference. We use no marketing cookies and no third-party tracking cookies.
4. Benefits and notifications within the platform
The platform offers restaurant loyalty programmes (coupons and rewards for registered customers) and promotional prices. Notifications we send relate to your orders (payment confirmation, order status). We do not send marketing messages without your prior consent, and any consent can be withdrawn at any time.
5. Who we share data with
Order data (name, phone, delivery address, order contents) is shared with the selling restaurant for preparation and delivery. Data necessary for payment execution is processed by the electronic money institution PaySpot doo Novi Sad and the acquiring bank. Data may be provided to competent state authorities where required by law. We do not sell data or share it with third parties for marketing purposes.
6. Retention
Account data is kept for as long as the account exists; order and transaction data is kept for the periods prescribed by fiscal, accounting and payment regulations of the Republic of Serbia, after which it is deleted or anonymised.
7. Your rights
You have the right of access, rectification, erasure, restriction of processing, portability and objection, as well as the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection. To exercise your rights, contact the controller using the details in the introduction of this policy.
8. Security
Data is transmitted over the public network in protected (encrypted) form using the SSL protocol. Access to data is limited to persons who need it to perform their work, and systems are regularly maintained and monitored.
9. Changes to this policy
We may amend or supplement this privacy policy; the current version is always published on this page. We will announce substantial changes on the sales point.