Privacy Policy
1. Controller and contact
Edward Alejandro Azuaje Rojas, CUIT 23-96013276-9, proprietor of Ordera Food, with a publishable address in the Autonomous City of Buenos Aires, Argentine Republic, and email [email protected], is the controller of data concerning SaaS accounts, contracting, subscription billing, security, support, Ordera communications, and platform operation.
The full street address may be disclosed individually where required by law or a competent authority, while protecting security and personal data.
2. Roles for buyer and employee data
When a Merchant uses Ordera to manage its buyers’, employees’, or contacts’ data, the Merchant determines the essential purposes and means and normally acts as controller; Ordera acts as processor or service provider on the Merchant’s behalf under its instructions and the DPA. Ordera may act as an independent controller for security, fraud prevention, legal compliance, SaaS relationship management, and legal claims. The role depends on the actual processing and applicable law.
Buyers should initially direct order-data requests to the Merchant. Ordera will assist the Merchant and respond directly where required by law.
3. Data processed and sources
We may process identification and contact data; credentials and permissions; Merchant, location, and personnel data; subscription, receipt, and SaaS payment data; orders and buyers; products, inventory, and operations; support and communications; IP address, device, browser, technical logs, security, and activity; and preferences, language, and consents. Data comes from users, Merchants, platform use, enabled integrations, and payment providers. Sensitive data that is not strictly necessary and lawful should not be uploaded.
For enabled SaaS subscriptions, Ordera sends the Merchant email, an authorization reference, product or reason, amount, currency, frequency and return URL to the provider. It receives identifiers, statuses and subscription, cancellation and transaction dates. Mercado Pago or Creem collect payment details on their payment page; this integration does not give Ordera the full card number or security code. Providers may request additional data directly. When acting as the seller of the transaction, Creem processes purchase data as an independent controller for payments, taxes, fraud prevention and its legal obligations, under its privacy policy (https://www.creem.io/privacy). Ordera is the controller for its own account, access and support processing; the Ordera-Creem agreement distinguishes processing on behalf of another party from controller-to-controller sharing. Creem rights, retention and transfers are explained in its policy; no unverified locations or safeguards are claimed. Creem participates only after approval and enablement. Providers Merchants use to collect order payments are separate and identified according to their configuration. Ordera inquiries: [email protected]; Creem own processing inquiries: its privacy channels.
4. Purposes and legal grounds
We process data to create and administer accounts; provide modules; process orders for Merchants; authenticate and secure; provide support; charge the SaaS subscription; maintain accounting and legal records; prevent abuse and fraud; diagnose and improve performance; communicate changes and operational messages; establish or defend legal claims; and comply with obligations.
Depending on jurisdiction, legal grounds include contract performance or pre-contract steps, consent where required, legal compliance, and legitimate interests such as security, support, and improvement balanced against individual rights. The Merchant is responsible for having a valid basis for data it instructs us to process.
5. Recipients and subprocessors
Access is limited to those who need it: authorized Merchant personnel; Ordera personnel and providers under appropriate duties; authorities where applicable; and providers actually contracted and enabled. Currently confirmed providers are Cloudflare for DNS/CDN and perimeter security, Deonweb for infrastructure and hosting, and Resend for transactional email delivery. Mercado Pago Argentina and Creem may participate in SaaS payments only when actually enabled. Merchant checkout providers depend on their configuration. Before a new provider processes data in production, Ordera will confirm its identity, service, and role in a current inventory that it will publish or otherwise make available. Its role may be processor, subprocessor, or independent controller depending on the service and specific data.
This policy does not claim unverified locations, certifications, transfer mechanisms, or encryption methods. If processing entails an international transfer, safeguards and notices required by the relevant law will be applied. The list may change; material changes will be communicated where appropriate.
6. Retention
We keep data while the account is active and as necessary to provide the service, perform contracts, resolve disputes, and meet tax, accounting, regulatory, and security obligations. At the end of the SaaS relationship, the Merchant may request a reasonably available manual export for thirty (30) days. Data may then be erased from active systems. Residual backup copies may remain for up to ninety (90) days, except for legal retention, security, fraud, or legal claims. Mandatory legal periods prevail.
7. Security and incidents
We apply technical and organizational measures that are reasonable and proportionate to risk, control access, and seek continuity and recovery. No system is absolutely secure. Following an incident, we will investigate, mitigate, and notify the Merchant, individuals, or authorities where legally required, without disclosing details that increase risk.
8. Rights and choices
Depending on applicable law, individuals may request access, information, correction, updating, deletion, objection, restriction, portability, withdrawal of consent, and review of automated decisions, and may complain to the competent authority. Withdrawal does not affect prior processing or legal grounds other than consent.
Requests may be sent to [email protected], stating the relationship with the Merchant and enough information to verify identity without excessive data. We may request reasonable verification, route requests to the controller Merchant, and keep minimal evidence of handling.
9. Children, changes, and contact
Ordera is a business tool and is not directed at children opening accounts. The Merchant must follow applicable rules if it processes orders involving children. We will update this policy for material changes and display its date and version; where necessary, we will request renewed affirmative consent and will not infer it from browsing.
Privacy inquiries: [email protected].
Optional analytics on the commercial website
This section applies only to https://orderafood.com and its commercial pages and blog, not to the application dashboard or merchants' sites. We use Google Analytics 4, provided by Google, only after the visitor accepts the optional analytics category. Rejecting does not prevent browsing, contacting us or using the service. Browsing alone is not consent.
The purpose is to understand visits and commercial actions, such as trial or contact clicks, to improve content. Google receives browser identifiers, visited pages without query parameters or fragments, interaction events and technical device, browser and connection data. We do not intentionally send names, emails, phone numbers, messages, form contents, order data or account identifiers. We do not enable Google Signals, advertising personalization or automatic form or search capture. These data are not fully anonymous.
The necessary ordera_cookie_consent cookie remembers the choice for 180 days. Optional _ga and _ga_* cookies distinguish browsers and sessions; we configure a maximum lifetime of 180 days without automatic renewal on visits. Cookies are installed only after acceptance. Visitors can open “Cookie preferences” in the footer and reject to withdraw consent; new transmissions stop and Analytics cookies accessible from this site are deleted. This does not automatically erase previously transmitted data. To exercise rights concerning earlier data, contact [email protected]. Cookies can also be deleted in browser settings.
Google processes data under the applicable Analytics and data processing terms and may process them outside the visitor's country. Retention at Google depends on property settings and service terms; it is not the cookie lifetime. More information: Google's use of data (https://policies.google.com/technologies/partner-sites), Google privacy (https://policies.google.com/privacy) and data processing terms (https://business.safety.google/adsprocessorterms/). Withdrawal does not affect prior processing or other necessary service processing.
Country-specific provisions
International customers and data
“Rest of the world” does not identify the country of residence or processing. Ordera processes the data needed for accounts, service delivery and billing for the purposes and roles described in this policy; the applicable basis depends on the processing and relevant law. Merchants introducing their customers’ data retain their controller obligations and must have a valid basis to share those data and use the service.
For USD payments, the necessary account identifiers, email, quote and payment references are shared with Creem. Card and tax information requested at its checkout is processed by Creem and its providers under their own policies. Creem is an independent controller for its payment, tax, fraud prevention and legal obligations; sharing data with Ordera does not make all of Creem’s processing a service performed on Ordera’s behalf.
International providers may process data outside the individual’s country. Where applicable law requires it, transfers must rely on the corresponding mechanisms and safeguards; this policy alone is neither a transfer authorization nor a declaration that every destination is adequate. Information about recipients, processing countries and safeguards can be requested at [email protected]. Requests concerning Ordera’s processing go to that email; requests concerning Creem’s own processing go to its privacy channels. Applicable rights and remedies before the competent authority are preserved, including access, correction, erasure, objection, restriction and portability where applicable. The commercial grouping does not restrict those rights.