Personal Data Processing Policy

Who processes which data in Orlika, why, and what you may require them to do about it.

Version 1.0, effective from August 28, 2026

This Policy is drawn up under the Law of the Republic of Armenia No. HO-49-N of 18 May 2015 on the Protection of Personal Data (the "Law"). It describes which personal data are processed in the Orlika service, on what legal basis, for how long they are kept, and what rights the data subject has.

1.Who processes the data

The processor of personal data within the meaning of Article 3 of the Law is Evgenii Petrov, a natural person (not registered as a sole proprietor) (the "Processor").

Orlika is at the stage of a free pilot launch on the market of the Republic of Armenia. No legal entity has been incorporated and no sole proprietorship has been registered, so the party to every relationship — both the processing of data and the service contract — is the natural person named above. This is stated plainly so that a partner restaurant is in no doubt about whom it is dealing with.

Detail	Value
Processor	Evgenii Petrov
Legal status	a natural person (not registered as a sole proprietor)
Email	info@orlika.net
Phone	+77773467591
Messenger	Telegram: https://t.me/evgencode
Website	https://orlika.net
Application	https://app.orlika.net

This Policy applies to the website https://orlika.net, the web application https://app.orlika.net, the application programming interface https://api.orlika.net and all of their subdomains.

2.Definitions

Terms are used as defined in Article 3 of the Law.

Personal data — any information relating to a natural person that allows, or may allow, that person to be identified directly or indirectly.
Special categories of personal data — information on racial or ethnic origin, political views, religious or philosophical beliefs, trade union membership, health and sex life.
Biometric personal data — information on a person's physical, physiological and biological characteristics.
Processing — any operation or set of operations performed on personal data: collection, recording, input, systematisation, organisation, storage, use, alteration, restoration, transfer, rectification, blocking and destruction.
Processor — a state or local self-government body, a legal person or a natural person that organises and (or) carries out the processing of personal data.
Data subject — the natural person to whom the personal data relate.
Blocking — the temporary suspension of the possibility to collect, record, systematise, transfer or use personal data.
Destruction — an operation as a result of which restoring the content of the personal data becomes impossible.

3.Whose data are processed

The service has two categories of data subjects, and their regimes differ.

Restaurant administrator — a natural person who registers a company in the service on their own initiative, using an email address, and gives consent to the processing themselves.
Restaurant employee — a waiter, kitchen or bar worker. The employee's account is created by the restaurant administrator; the employee does not register themselves.

Restaurant guests are not data subjects in the service. An order in Orlika is linked to a table and to the employee who took it, not to a guest: the service neither requests nor stores a guest's name, phone number or any other identifier.

4.Division of responsibility with the restaurant

This section matters to a partner restaurant and is worth reading before adding employees.

For the administrator's data, the purposes and means of processing are determined by the Processor: the administrator registers on their own initiative and enters into a direct relationship with the Processor.

For employees' data the position is different. It is the restaurant that decides whom to add to the system, under which login, with which role, and when to remove them. In that part the Processor acts on the restaurant's instructions and merely provides the technical means.

That said, an employee who contacts the Processor directly will not be turned away: requests under section 11 are honoured regardless of who created the account. Where a request touches a decision that belongs to the restaurant (for example, deleting the account of a current employee), the Processor notifies both the restaurant and the data subject.

5.What data are processed

The list is exhaustive. It matches how the service's database is actually built, rather than being padded out just in case.

Category of subjects	Data	How obtained
Restaurant administrator	email address (which also serves as the login); display name; password as an irreversible cryptographic hash; the number of the chosen profile icon or an uploaded photograph; role; active flag; account creation date; the company’s interface language and time zone	provided by the subject at registration and in profile settings
Restaurant employee	login (an arbitrary string, not an email address); display name; password as an irreversible cryptographic hash; role (waiter, kitchen, bar); active flag; profile icon number or an uploaded photograph; creation date	entered by the restaurant administrator
Any user who contacts support	subject of the request; message text (up to 2,000 characters); phone number, if the user chooses to give one (the field is optional); attached images; link to the account and the company; date of the request	provided by the subject when submitting the request
Any user of the service	security event log records: date and time, event type and outcome, request identifier, user identifier and role, the login at the time of the event, company and session identifiers, IP address, browser User-Agent string, type and identifier of the affected object, number of affected records	generated automatically while the service is used

An employee's login is deliberately not an email address. This is a conscious choice in favour of minimisation: an employee's email is personal data in its own right, and without it the information held about each waiter is limited to a name and a role.

Surnames of employees and administrators are not stored. The name field is meant for the display name that is convenient to see on a shift.

Passwords are not stored in clear text and cannot be recovered — neither by the Processor nor by anyone else. The database holds the result of an irreversible transformation (bcrypt); a forgotten password can only be replaced with a new one.

6.What data are not processed

This section matters as much as the previous one: it caps the scope of processing and makes the claims checkable.

Special categories of personal data — health, racial or ethnic origin, political views, religious and philosophical beliefs, trade union membership, sex life — are neither collected nor processed.
Biometric personal data are neither collected nor processed. A profile photograph is used solely as an image in the interface and is not subjected to biometric processing: the service performs no face recognition, template extraction or image matching.
Restaurant guests' data — name, phone, address, visit history — are not collected.
Payment data — bank card and account numbers — are not collected: during the pilot the service is provided free of charge and no payments are accepted.
Location data are not collected.
Advertising and analytics trackers are absent: no visitor counters, advertising pixels or behavioural analytics systems are installed on the website or in the application.
Profiling and automated decision-making producing legal effects for the subject are not carried out. Personal data are not used to assess an employee's personal qualities, performance or trustworthiness.
Personal data of persons under 16 are not knowingly processed. The service is intended for hospitality staff and is not addressed to children.

A separate caveat about free-text fields: the order note, the cancellation reason and the support message are intended for information about the order and about the service. The Processor asks that no personal data of guests or third parties be entered into them. The party that enters content into such a field is responsible for that content.

7.Purposes and legal bases of processing

Purpose	Data	Legal basis
Creating an account and granting access to the service	email address or login, name, password hash, role, company	consent of the subject (Article 9 of the Law); performance of the contract concluded by acceptance of the public offer
Confirming the email address and restoring access	email address, temporary confirmation code	consent of the subject; performance of the contract
Operating the service: taking orders, routing them to the kitchen and bar, showing who performed an operation	employee name and role, account identifier	performance of the contract
Handling support requests	subject, message text, images, phone number where voluntarily provided	consent of the subject, expressed by submitting the request
Ensuring security, detecting and investigating incidents, protecting against password guessing and unauthorised access	security event log records, including IP address and User-Agent	the Processor’s legitimate interest in protecting data and the duty to secure processing (Article 19 of the Law)
Service notices about the service, changes to terms and to legal documents	administrator’s email address and name	performance of the contract

Personal data are not used for marketing mailings. Data are not sold and are not transferred to advertising networks, data brokers or information intermediaries.

8.Retention periods

Data	Period
Account and company data	for as long as the service is used. Once the account is deleted by the subject or by the restaurant, they are destroyed within no more than three working days
Company data after the pilot ends without continued use	destroyed within 30 calendar days of the end date. The restaurant is notified by email beforehand
Order data	during the pilot — no more than 6 months from the creation of the order, after which orders are deleted or anonymised — the details of the employee who placed the order are removed from them (clause 4.5 of the Terms of Service)
Support requests	one year from the date of the request
Security event log	one year. A shorter period would defeat the purpose of the log: an incident is almost always detected later than it occurs
Authentication cookies	up to 7 days (see the Cookie Policy for details)
Database backups	up to 30 days. Data destroyed in the primary database leave the backups as those backups rotate naturally and are not restored

9.Transfer of data to third parties

Transfers are made under Article 26 of the Law and are limited to what the service cannot operate without.

Recipient	What is transferred	Why
Server hosting provider (the Netherlands)	all data held in the database and in file storage	physical hosting of the servers and storage of the data
Email delivery provider	the recipient’s email address and name, and the content of the service message	delivery of registration confirmation, password recovery and service notice emails
An external system connected by the restaurant itself through an integration	order details, including the name of the employee who placed the order and the table name	sending orders to the restaurant’s external system, at an address the restaurant itself specifies

Beyond the above, data may be disclosed to competent state authorities solely on the grounds and in the manner provided by the legislation of the Republic of Armenia.

10.Cross-border transfer of data

The service's servers and database are located in the Netherlands. Personal data collected in the Republic of Armenia are processed on those servers, which constitutes a cross-border transfer within the meaning of Article 27 of the Law.

the Netherlands is a party to the Council of Europe Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data (ETS No. 108) and to the Protocol amending it (CETS No. 223), and is a member state of the European Union where the General Data Protection Regulation (GDPR) applies. The receiving state therefore ensures an adequate level of protection of personal data, and the transfer is made under part 1 of Article 27 of the Law without a separate permission of the authorised body.

In addition, the subject consents to such a transfer at registration — see the Consent to the Processing of Personal Data.

11.Rights of the data subject

The Law grants the subject more than access and withdrawal of consent. All rights are listed below in full, with the deadlines within which the Processor must act on them.

Right to obtain information (Article 15 of the Law). You may find out free of charge whether your personal data are processed and obtain information about them: the purposes and legal basis of processing, the data held, the operations performed, the recipients, the retention periods, and you may inspect the data themselves. The response is due within 5 working days of receipt of the request (Article 20 of the Law).
Right to alteration and rectification (Articles 15 and 21 of the Law). You may require the correction of inaccurate, incomplete or outdated data. In addition, an administrator's data and an employee's name can be changed directly in the interface — immediately and without any request.
Right to blocking (Articles 3, 15 and 21 of the Law). You may require the temporary suspension of the collection, recording, systematisation, transfer and use of your data. Blocked data are retained, but no operation other than storage is performed on them. In the service, blocking is implemented among other things by deactivating the account, after which no login or operation under it is possible.
Right to immediate destruction (Articles 15 and 21 of the Law). You may require the destruction of data if they were obtained unlawfully, are no longer necessary for the purposes of processing, or if you have withdrawn your consent. Destruction is carried out, and the subject notified of it, within 3 working days. Destruction means that restoring the content of the data becomes impossible.
Right to withdraw consent (Article 9 of the Law). Consent may be withdrawn at any time without giving reasons. Withdrawal does not affect the lawfulness of processing carried out before it. After withdrawal, processing ceases and the data are destroyed, except for information whose retention is expressly required by law.
Right to object to processing and the right not to be subject to a decision based solely on automated processing (Article 16 of the Law). No such decisions are made in the service.
Right of appeal (Article 17 of the Law). The Processor's acts and omissions may be appealed to the authorised body for personal data protection or to a court. Applying to the authorised body does not require contacting the Processor first, although that is usually quicker.

12.How to submit a request

Send your request to info@orlika.net. No mandatory form is prescribed — an email is enough.

To get a quick and useful answer, please state:

your name and the email address or login by which the service knows you;
the name of the restaurant (company), if you are an employee;
what you are asking for: information, alteration, blocking, destruction of data, or withdrawal of consent;
the address to which the reply should be sent, if it differs from the sender address.

The reply is sent to the email address from which the request came, or to the address held in the account. If the request does not make it possible to establish the applicant's identity, the Processor may ask for further details — strictly to the extent needed for identification, and not to enlarge the database. In that case the response period runs from receipt of those details.

Providing information and handling requests are free of charge.

13.Security measures

Measures are taken under Article 19 of the Law and are aimed at protecting data against loss, unauthorised access, alteration, dissemination and destruction.

all traffic between the user’s device and the servers is protected by transport encryption (TLS/HTTPS);
passwords are stored solely as an irreversible cryptographic hash (bcrypt) and cannot be recovered;
access tokens are carried in secure cookies that are unavailable to page scripts, and are backed by separate protection against cross-site request forgery;
access to data is segregated by role, and each restaurant’s data are isolated: a user of one company cannot reach another company’s data;
request rates are limited, and password-guessing and server-scanning attempts are blocked automatically;
the type and size of uploaded files are validated and images are processed before storage;
security events and actions on personal data are recorded in a separate log kept in an isolated, append-only database: the application can add records to it but cannot read, alter or delete them;
passwords, tokens and confirmation codes are stripped from logs automatically and never reach them;
the database is backed up.

No system offers absolute protection, and it would be dishonest to promise it. These measures are reviewed as the service develops, and they are listed here so that what is claimed can be checked.

14.Action in the event of an incident

On discovering a leak of personal data or other unlawful access to them, the Processor notifies the authorised body for personal data protection and the law enforcement authorities in the manner prescribed by the legislation of the Republic of Armenia, remedies the breach within 3 working days or destroys the data concerned, and notifies the affected subjects where the incident is capable of causing them adverse consequences.

15.Supervisory authority

Compliance with personal data legislation is supervised by:

Detail	Value
Authority	Personal Data Protection Agency of the Ministry of Justice of the Republic of Armenia
Address	54b Komitas Ave., Yerevan 0051, Republic of Armenia
Phone	+374 10 594195
Website	https://dataprotection.moj.gov.am/

16.Changes to the Policy

The Processor may amend this Policy. The current version is always available at https://orlika.net/legal/en/privacy-policy.html. Every version carries a number and an effective date, shown at the top of the document.

Where a change affects the data processed, the purposes of processing, the recipients or the rights of subjects, administrators are notified by email no later than 10 calendar days before the change takes effect.

Previous versions are retained by the Processor and provided on request.