pre-loader

OrderZ Privacy Policy

Last updated: 3 August 2026

This Privacy Policy explains how OrderZ ("we", "us") — operated by Zaroid Pte Ltd collects, uses, discloses, and protects personal data across our cloud platform, mobile applications, point-of-sale (POS) systems, and online storefronts.

Dual Data Protection Roles: OrderZ operates under two distinct legal capacities depending on whose data is being processed:

1. OrderZ as Data Controller: We act as the Data Controller for direct merchant and staff personal data collected during account sign-up, subscription billing, account management, support tickets, and platform telemetry logs.

2. OrderZ as Data Processor / Data Intermediary: We act strictly as a Data Processor (or Data Intermediary under Singapore PDPA) for end-customer (diner/shopper) order details, delivery addresses, and reservation records processed on behalf of a merchant's store. The merchant remains the Data Controller for their own customers' data. See our Data Processing Agreement for details.

Defined Roles & Categories

Depending on how you interact with OrderZ, your personal data is handled under specific legal frameworks:

  • Merchants and Staff: Store owners and team members using OrderZ to run business operations. OrderZ acts as Data Controller for your account, billing, and access data.
  • End-Customers / Diners: Shoppers or restaurant diners ordering from or booking with an OrderZ-powered merchant store. The merchant acts as Data Controller, and OrderZ acts as Data Processor.
  • Website Visitors: Individuals browsing the public OrderZ website. OrderZ acts as Data Controller for visitor telemetry and contact inquiries.
Information We Collect

Merchant Account & Billing Data: When you register as a merchant or staff user, we collect your name, email address, mobile phone number, business address, and subscription payment details. We also log your administrative actions (e.g. settings updates, catalog edits, and order management) for security and audit purposes.

Device & POS Telemetry Disclosure

For merchants operating OrderZ POS applications (Android/iOS terminals, tablets, and self-service kiosks), we collect device telemetry and operational diagnostic logs, including:

  • Device Identifiers & Serial Numbers: Hardware serial numbers, MAC addresses, device models, and operating system versions for device licensing and terminal authentication.
  • Network & Peripheral Logs: Local IP addresses, Wi-Fi connection status, receipt printer status, cash drawer connection status, and Bluetooth peripheral logs to maintain offline POS caching and device stability.
  • App Diagnostics & Crash Logs: Application crash diagnostics, memory usage metrics, and error stack traces to troubleshoot system issues and optimize POS performance during peak trading hours.
How We Use Your Information

We use merchant personal data to provide cloud and POS software services, process subscription payments, deliver technical support, send operational alerts (e.g. order alerts, billing notices), enforce security controls, and prevent fraud. We do not sell your personal data or trade it with third-party advertisers.

Data Retention & Active Service Obligations

We retain merchant and customer personal data for as long as an active account, registered membership, loyalty rewards balance, or purchased service package exists. Specifically:

  • Active Memberships & Accounts: Customer data remains active and retained for the duration of an ongoing registered account or active membership.
  • Loyalty & Rewards Systems: Data associated with customers enrolled in store loyalty or reward programs is retained while unredeemed points, tier status, or rewards remain valid.
  • Service Packages & Prepaid Credits: For service-based businesses (e.g., wellness packages, salon sessions, or dining vouchers), customer records are preserved until all purchased packages, sessions, or credits are fully redeemed or expired.
  • Post-Closure Buffer Period: Following account closure, cancellation, or package expiration, personal data enters a 30-day retention buffer period before being permanently purged or anonymized, except where longer retention is strictly mandated by statutory tax, accounting, or audit laws.
Overseas Data Processors

We utilize trusted third-party cloud infrastructure and service providers to operate parts of the platform. Some providers process data outside your home country:

  • Cloud Infrastructure Providers: Application servers and encrypted database hosting
  • Messaging & SMS Gateways: SMS, WhatsApp, and push notification delivery
  • Transactional Email Services: Account alerts and receipt delivery
  • Payment Gateways: Stripe, HitPay, PayNow, GrabPay, Allinpay, and card processing networks

Where overseas transfers occur, we require third-party service providers to protect personal data to a standard comparable to the protection required under the Singapore PDPA and applicable privacy laws.

Cookie & Local Storage Disclosure

OrderZ utilizes essential browser cookies and local storage tokens on both merchant administrative portals and customer-facing storefronts:

  • Essential & Session Cookies: Encrypted session identifiers (e.g. orderz_session, CSRF-TOKEN) to maintain secure staff authentication and prevent cross-site request forgery.
  • Storefront & Local Storage Tokens: Local storage keys to preserve cart state, diner table preferences, language selections, and offline POS transaction caches during temporary network disconnects.
  • Analytics Cookies: Aggregated, privacy-focused usage metrics to analyze platform performance. You can manage cookie preferences via browser settings, though disabling essential cookies may impact store and POS functionality.
Security Arrangements

We implement robust technical and organizational security arrangements, including SSL/TLS transport encryption, database encryption at rest, role-based access controls, and continuous audit logging to protect personal data against unauthorized access, loss, or disclosure.

We process personal data based on explicit consent or deemed consent under the Singapore PDPA — such as when you voluntarily provide contact or payment details to register an account or subscribe to services.

Your Rights Under the PDPA

Under the Singapore PDPA, you have the right to request access to your personal data, request corrections to inaccurate records, or withdraw consent for data processing. Merchants and staff can view and update profile information via the Profile Settings page, or submit a request to our Data Protection Officer.

Data Breach Notification

If a data breach affecting your personal data is assessed to be likely to result in significant harm or impacts $\ge 500$ individuals, OrderZ will notify the Personal Data Protection Commission (PDPC), Singapore (PDPC) and affected individuals within 3 calendar days of assessment, as mandated by the Singapore PDPA.

Data Protection Officer (DPO) Contact

For any questions, privacy inquiries, consent withdrawals, or data access requests under the Singapore PDPA or applicable privacy laws, please contact our appointed Data Protection Officer ("DPO"):

Data Protection Officer (DPO)
Email: dpo@zaroid.com
Address: 11 Mandai Estate, #11-02Z, Singapore 729908
Regulatory Authority: Personal Data Protection Commission (PDPC), Singapore

Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our platform or statutory privacy requirements. Material changes will be communicated via dashboard alerts or email notices.