Consent to the Processing of Personal Data

1.To whom consent is given

Consent is given to Evgenii Petrov, a natural person (not registered as a sole proprietor) (the "Processor"), email info@orlika.net, phone +77773467591, messenger Telegram: https://t.me/evgencode.

The consent relates to the Orlika service: https://orlika.net, https://app.orlika.net, https://api.orlika.net.

2.Legal basis and purposes of processing

The legal basis for processing is the consent of the data subject (Article 9 of the Law), together with the necessity of performing the contract concluded by acceptance of the Terms of Service (Public Offer).

Purposes of processing:

1. creating an account and granting access to the service;
2. confirming the email address and restoring access to the account;
3. operating the service — taking orders, routing them to the kitchen and bar, and showing which employee performed an operation;
4. handling support requests;
5. ensuring security, detecting and investigating incidents;
6. sending service notices about the service and about changes to the legal documents.

Personal data are not used for marketing mailings, profiling, or assessment of the subject's personal qualities.

3.Categories of personal data

Consent is given to the processing of the following data:

• email address (for a restaurant administrator it also serves as the login);
• login (for a restaurant employee — an arbitrary string that is not an email address);
• display name;
• password — as an irreversible cryptographic hash;
• role in the service and the account’s active flag;
• the number of the chosen profile icon or an uploaded profile photograph;
• the restaurant’s (company’s) name, description and logo, its time zone and interface language;
• phone number — only where voluntarily provided when contacting support;
• the content of a support request and the images attached to it;
• technical security log data: date and time of an event, its type and outcome, the user, company, session and request identifiers, the login at the time of the event, the IP address and the browser User-Agent string.

4.Operations performed

Consent is given to the following operations, whether carried out by automated or non-automated means: collection, recording, input, systematisation, organisation, storage, use, alteration, restoration, transfer to the extent set out in section 5, rectification, blocking and destruction of personal data.

5.Recipients of personal data

Personal data may be transferred to:

• the server hosting provider that stores the data in the Netherlands;
• the email delivery provider — limited to the recipient’s address and name and the content of the service message;
• an external system connected by the restaurant itself through an integration — limited to order details, including the name of the employee who placed the order and the table name;
• competent state authorities — on the grounds and in the manner provided by the legislation of the Republic of Armenia.

Personal data are not sold and are not transferred to advertising networks, data brokers or information intermediaries.

6.Cross-border transfer

The subject consents to the cross-border transfer of their personal data to servers located in the Netherlands and to their processing there.

the Netherlands is a party to Council of Europe Convention ETS No. 108 and Protocol CETS No. 223, and is a member state of the European Union where the General Data Protection Regulation (GDPR) applies; it therefore ensures an adequate level of protection of personal data within the meaning of Article 27 of the Law.

7.Duration of consent and how to withdraw it

Consent takes effect when it is given and lasts until the purposes of processing are achieved or until the subject withdraws it, whichever occurs first. The end of the pilot period does not by itself terminate consent, but once it expires the company's data are destroyed as described in the Personal Data Processing Policy.

Consent may be withdrawn at any time without giving reasons. To withdraw it, send an email to info@orlika.net stating your name and the email address or login by which the service knows you. No special form is required.

Withdrawal does not affect the lawfulness of processing carried out before it. After withdrawal, processing ceases and the personal data are destroyed within 3 working days, except for information whose retention is expressly required by the legislation of the Republic of Armenia. The subject is notified of the destruction within the same period.

8.Rights of the data subject

The subject has the right to obtain information about their personal data, to require their alteration and rectification, blocking and immediate destruction, to withdraw consent, and to appeal the Processor's actions to the authorised body for personal data protection or to a court.

Information is provided within 5 working days; rectification, blocking and destruction are carried out, and the subject notified, within 3 working days. A full description of the rights, deadlines and procedure is set out in the Personal Data Processing Policy.

9.Consent on behalf of restaurant employees

Employee accounts are created by the restaurant administrator. By ticking the consent box at registration, the administrator confirms that:

1. before entering an employee’s data into the service they will notify that employee to the extent required by Article 10 of the Law and obtain their consent to the processing;
2. the employee data they enter are accurate and they will keep them up to date;
3. they will not enter into the service any special categories of personal data, biometric data or personal data of restaurant guests;
4. they will promptly delete the accounts of employees who have left the restaurant.

For its part, the Processor handles employees' requests directly and complies with them within the periods set out in section 8.

10.Confirmation

By ticking the consent box at registration, the subject confirms that they have read this document and the Personal Data Processing Policy, that the content of the consent is clear to them, that the consent is given freely, by their own will and in their own interest, and that they are at least 16 years old.

The Processor retains the text of the consent in the version in force at the time it was given. The number and date of the current version are shown at the top of the document.