Privacy Policy

Ordrji respects your privacy and is committed to protecting personal data processed through our website, applications, software, devices and related services.

This Privacy Policy explains how SYNCKRAFT TECHNOLOGIES PVT LTD, operating under the brand name “Ordrji”, collects, uses, stores, discloses and protects personal data when you interact with:

• ordrji.com and related webpages;
• the Ordrji restaurant POS and billing application;
• Ordrji web dashboards and mobile applications;
• QR menus and online ordering pages powered by Ordrji;
• KOT, kitchen display and table-ordering systems;
• CRM, loyalty, feedback and customer-engagement features;
• inventory, reporting, staff and multi-outlet modules;
• technical support, onboarding, installation and migration services;
• integrations made available through Ordrji; and
• any other service that links to this Privacy Policy.

Collectively, these are called the “Services.”

In this Privacy Policy:

• “Ordrji,” “we,” “our” or “us” means SYNCKRAFT TECHNOLOGIES PVT. LTD.
• “Restaurant Customer” means a restaurant, cafe, bakery, cake shop, cloud kitchen, QSR, food court, franchise, chain or other business subscribing to Ordrji.
• “Authorised User” means an owner, administrator, manager, cashier, waiter, kitchen employee, accountant, inventory manager or other person authorised to use a Restaurant Customer’s account.
• “End Customer” means a person who places an order, scans a QR code, makes a payment, joins a loyalty programme, provides feedback or otherwise interacts with a Restaurant Customer through Ordrji.
• “Personal data” means information relating to an identified or identifiable individual.

Ordrji may have different privacy roles depending on the circumstances.

2.1 When Ordrji acts as the Data Fiduciary

Ordrji generally determines why and how personal data is processed when we collect information directly for our own purposes, including:

• website enquiries;
• demo requests;
• Restaurant Customer account creation;
• subscription and billing administration;
• sales and marketing;
• customer support;
• security monitoring;
• product analytics; and
• recruitment or vendor management.

For such processing, Ordrji acts as the Data Fiduciary, controller or equivalent responsible entity under applicable law.

2.2 When a Restaurant Customer is the Data Fiduciary

A Restaurant Customer generally determines why and how personal data relating to its End Customers, staff, suppliers and business operations is processed.

Examples include:

• customer names and mobile numbers collected during billing;
• delivery addresses;
• order histories;
• customer preferences;
• loyalty programme information;
• employee profiles and shift information;
• restaurant invoices and transaction records;
• customer feedback; and
• marketing campaigns created by the restaurant.

For this data, the Restaurant Customer normally acts as the Data Fiduciary or controller, and Ordrji processes the data on the Restaurant Customer’s documented instructions as a Data Processor or service provider.

End Customers or restaurant employees seeking to exercise rights relating to this data should ordinarily contact the relevant restaurant first. Ordrji will provide reasonable assistance to the Restaurant Customer as required by law and the applicable Data Processing Agreement.

The personal data collected depends on how you use the Services and which Ordrji modules are enabled.

3.1 Website, enquiry and demo information

When you visit ordrji.com, request a demo, submit a contact form, communicate through WhatsApp, call us or contact our sales team, we may collect:

• name;
• business or restaurant name;
• job title or role;
• email address;
• mobile or telephone number;
• city, state and country;
• restaurant type and number of outlets;
• current software or POS system;
• preferred demo date and time;
• business requirements and pain points;
• messages, enquiries and feedback;
• referral source; and
• any information voluntarily provided by you.

3.2 Restaurant Customer account information

When a Restaurant Customer creates or operates an Ordrji account, we may collect:

• legal business name and trading name;
• restaurant or outlet name;
• registered and operating addresses;
• owner, director or authorised representative details;
• email addresses and mobile numbers;
• GSTIN, PAN or other tax and registration information;
• subscription plan and account status;
• invoice and payment records;
• outlet, franchise and branch details;
• menu, pricing, tax and business configuration;
• restaurant logo, images and branding;
• support preferences; and
• contractual and onboarding records.

We do not require government identification documents unless they are necessary for account verification, payments, legal compliance, fraud prevention or a separately disclosed feature.

3.3 Authorised User and staff data

Restaurant Customers may create accounts for owners, managers, cashiers, waiters, kitchen employees and other staff. Depending on the modules enabled, we may process:

• name;
• mobile number or email address;
• employee or staff ID;
• account username;
• password hash or login PIN;
• role and permissions;
• outlet and department;
• login and logout information;
• shift opening and closing details;
• attendance information, where enabled;
• actions performed in the system;
• discounts, refunds, cancellations and approvals;
• device and session information;
• support communications; and
• audit-log records.

Ordrji does not collect biometric information unless a separately enabled attendance or authentication module requires it and a separate notice and lawful basis are provided.

3.4 End Customer and ordering information

When an End Customer places an order, uses a QR menu, requests delivery, joins a loyalty programme or provides feedback, the Restaurant Customer may collect and process through Ordrji:

• name;
• mobile number;
• email address;
• delivery or billing address;
• table number;
• order details;
• order notes and customisation requests;
• dietary preferences;
• allergy information voluntarily provided for an order;
• visit and purchase history;
• favourite or frequently purchased items;
• birthday or anniversary, where voluntarily provided;
• loyalty points, rewards, wallet balance or membership tier;
• coupon and referral details;
• feedback, ratings and complaints;
• communication preferences;
• payment status and transaction reference;
• delivery instructions; and
• records of interactions with the restaurant.

Restaurants should not use Ordrji to collect unnecessary medical, financial, identity or other highly sensitive information.

3.5 Billing, order and operational data

Ordrji may process restaurant operational records such as:

• dine-in, takeaway, pickup and delivery orders;
• KOT and kitchen-display information;
• invoices, tax records and receipts;
• discounts, refunds and void transactions;
• payment method, amount and status;
• table assignments and order status;
• item prices, variants and modifiers;
• inventory and stock movements;
• recipes and ingredient usage;
• supplier and purchase records;
• wastage and expiry records;
• staff activity and approvals;
• day-opening and day-closing records;
• cash-hand-over records;
• sales, margin and performance reports; and
• outlet and channel-level analytics.

Some of this information may constitute personal data when it is linked to a customer, staff member, supplier or other identifiable individual.

3.6 Payment information

When payments are enabled, Ordrji may process:

• payment amount;
• payment method;
• transaction reference or payment ID;
• payment status;
• refund information;
• settlement information; and
• limited information received from the payment service provider.

Ordrji is not designed to collect or store your full card number, CVV, UPI PIN, online-banking password or similar payment credentials. Such credentials should be entered only into the secure interface of the relevant bank or payment service provider. Payment service providers may process personal data under their own privacy policies.

3.7 Device, application and technical information

We may automatically collect technical data when a person uses the Services, including:

• IP address;
• browser and operating-system information;
• device type and device identifier;
• POS terminal or activated-device identifier;
• application version;
• language and time-zone settings;
• screen size;
• login and session information;
• page or feature usage;
• error, crash and diagnostic logs;
• API and synchronisation logs;
• printer status and print-error information;
• approximate location inferred from IP address;
• network and connectivity status;
• date and time of activity; and
• security-event information.

Precise location, Bluetooth, camera, local-network or notification permissions are accessed only where required by an enabled feature and subject to device settings.

3.8 Offline POS information

Ordrji may operate as an offline-first or local-first POS system. This means that certain information may be temporarily or persistently stored on an authorised restaurant device before being synchronised with Ordrji’s cloud systems. Local information may include:

• menu and outlet settings;
• user and role information;
• customer information;
• orders and KOTs;
• invoices;
• payment records;
• printer configurations;
• audit logs;
• pending synchronisation events; and
• local backups.

Restaurant Customers are responsible for maintaining appropriate physical security, user access controls, operating-system updates, antivirus protection and secure disposal or transfer of devices on which Ordrji is installed.

3.9 Support, installation and migration information

When providing onboarding, installation, troubleshooting or data migration, we may receive:

• menu files and images;
• exports from another POS system;
• customer, order or inventory records;
• device and printer configuration;
• screenshots;
• screen-sharing or remote-support session information;
• chat and email communications;
• telephone-call recordings, where notice is provided;
• diagnostic files; and
• support-ticket history.

We will use migrated data only to provide the requested migration and related support, subject to the Restaurant Customer’s instructions.

3.10 Information from integrations and third parties

We may receive data from:

• Restaurant Customers;
• payment service providers;
• online ordering or delivery platforms;
• messaging and communication providers;
• accounting or ERP integrations;
• referral or distribution partners;
• social-media platforms;
• analytics and security providers;
• publicly available business listings; and
• other services connected by the Restaurant Customer.

The data received depends on the integration, permissions granted and the third party’s terms.

3.11 Derived, aggregated and de-identified information

We may generate information such as:

• sales trends;
• item popularity;
• customer-repeat rates;
• stock forecasts;
• order-preparation times;
• outlet comparisons;
• fraud or anomaly indicators;
• product usage statistics; and
• system-performance measurements.

Where reasonably possible, we aggregate or de-identify information before using it for benchmarking, research, product development or service improvement.

We collect personal data:

• directly from you;
• from a Restaurant Customer;
• when an End Customer uses a restaurant’s QR or ordering page;
• from authorised POS devices and applications;
• through cookies and similar technologies;
• from integrations selected by the Restaurant Customer;
• from service, referral and distribution partners;
• during onboarding, support and migration;
• from publicly available sources; and
• when required or permitted by law.

We may use personal data to:

5.1 Provide and operate the Services

This includes:

• creating and maintaining accounts;
• authenticating users and activating devices;
• processing orders, invoices, KOTs and payments;
• enabling QR menus and online ordering;
• managing tables, menus, inventory and outlets;
• producing reports and dashboards;
• providing CRM, loyalty and feedback tools;
• synchronising offline and cloud data;
• supporting integrations; and
• providing technical support.

5.2 Manage our relationship with Restaurant Customers

We use information to:

• provide demonstrations;
• complete onboarding;
• manage subscriptions;
• issue invoices;
• collect fees;
• communicate about renewals;
• provide training;
• handle complaints and support requests; and
• administer contracts and service-level commitments.

5.3 Maintain security and prevent misuse

We may process information to:

• authenticate users;
• control permissions;
• detect unauthorised access;
• investigate fraud or misuse;
• maintain audit trails;
• protect restaurant and End Customer data;
• diagnose failures;
• prevent duplicate or altered transactions;
• maintain backups; and
• respond to security incidents.

5.4 Improve and develop Ordrji

We may analyse usage and feedback to:

• improve user experience;
• identify commonly used features;
• improve billing, KOT and printing reliability;
• develop new modules;
• improve performance on low-end devices;
• train support teams;
• test updates;
• understand restaurant workflows; and
• develop aggregated benchmarks and insights.

5.5 Provide analytics and intelligent insights

Where enabled, Ordrji may analyse operational data to provide:

• sales summaries;
• inventory alerts;
• menu-performance insights;
• item-margin analysis;
• suspicious discount or cancellation alerts;
• customer-repeat analysis;
• demand forecasts;
• campaign suggestions; and
• other restaurant business insights.

Such insights are intended as operational assistance and should be reviewed by the Restaurant Customer before business decisions are made. Unless separately disclosed and contractually authorised, Ordrji will not use Restaurant Customer or End Customer personal data to train third-party general-purpose artificial-intelligence models.

5.6 Send service and marketing communications

We may send:

• account and security notifications;
• order or payment-related communications;
• product updates;
• support messages;
• renewal and billing reminders;
• service announcements;
• training information;
• newsletters;
• promotional offers; and
• invitations to demos or events.

Marketing messages will be sent subject to applicable consent and communication rules. Recipients can opt out of promotional communications, although essential service messages may continue.

5.7 Comply with law and protect rights

We may process information to:

• comply with tax, GST, accounting and company-law requirements;
• respond to lawful government or court requests;
• establish, exercise or defend legal claims;
• investigate violations of our agreements;
• protect the rights and safety of Ordrji, Restaurant Customers, End Customers and others; and
• meet regulatory and security obligations.

Depending on the context and applicable law, we process personal data where:

• you have given valid consent;
• you requested a service or action;
• processing is necessary to provide contracted Services;
• processing is permitted as a legitimate use or other lawful use;
• processing is necessary to comply with legal obligations;
• processing is necessary to protect legal rights or prevent fraud;
• processing is required for security and service reliability; or
• we have another lawful basis recognised by applicable law.

Where processing is based on consent, consent may be withdrawn through the available account settings or by contacting us. Withdrawal does not affect processing lawfully carried out before withdrawal.

Ordrji may use cookies, local storage, software development kits, pixels and similar technologies.

Essential technologies

These are required for:

• login and authentication;
• security;
• session management;
• remembering account settings;
• load balancing;
• fraud prevention; and
• core website or application operation.

Preference technologies

These remember settings such as:

• language;
• location or outlet;
• display preferences; and
• previously selected options.

Analytics technologies

These help us understand:

• website visits;
• feature usage;
• application performance;
• crashes and errors;
• user journeys; and
• service reliability.

Advertising or marketing technologies

Where used, these may help measure marketing campaigns or show relevant Ordrji advertisements. Non-essential technologies will be used subject to applicable consent requirements.

You can control cookies through our cookie banner, browser settings or device settings. Disabling essential cookies may prevent certain Services from working.

We may disclose personal data to the following categories of recipients.

8.1 Restaurant Customers and their Authorised Users

Information relating to restaurant operations may be accessible to the relevant Restaurant Customer and users authorised by that Restaurant Customer, based on configured roles and permissions.

8.2 Service providers and Data Processors

We may use vendors for:

• cloud hosting and storage;
• database and backup services;
• application monitoring;
• customer support;
• remote troubleshooting;
• email, SMS and WhatsApp communications;
• payment processing;
• analytics;
• cybersecurity;
• accounting and invoicing;
• document signing;
• CRM and sales administration; and
• software development and testing.

These providers are permitted to process data only for agreed services and are expected to maintain appropriate confidentiality and security protections.

8.3 Third-party integrations

When a Restaurant Customer enables an integration, we may exchange information with the selected provider. These providers may include payment services, delivery platforms, accounting systems, communication platforms and other restaurant technology services. The third party’s use of information is governed by its own privacy policy and the Restaurant Customer’s agreement with that provider.

8.4 Professional advisers

We may share information with lawyers, auditors, accountants, insurers, consultants and other advisers where reasonably necessary.

8.5 Government authorities and legal recipients

We may disclose information where required by law, court order, regulation or valid legal process, or where reasonably necessary to prevent fraud, investigate wrongdoing or protect legal rights.

8.6 Corporate transactions

Personal data may be disclosed in connection with an investment, financing, merger, acquisition, restructuring, sale of assets or similar transaction. Any recipient will be required to handle personal data consistently with applicable law.

8.7 With consent or instructions

We may share personal data for another purpose where you or the relevant Restaurant Customer has instructed or authorised us to do so.

Ordrji does not sell or rent personal data to data brokers or unrelated third parties.

Ordrji and its service providers may process information in India and in other countries where approved infrastructure or service providers operate.

When personal data is transferred outside India, we will take reasonable steps to:

• comply with applicable transfer restrictions;
• assess the recipient and purpose;
• use appropriate contractual and security safeguards;
• limit access to authorised persons; and
• comply with any country- or entity-specific restrictions notified by the Government of India.

Restaurant Customers requiring specific data-location arrangements should ensure those requirements are included in their contract or Data Processing Agreement.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, to provide the Services, resolve disputes, enforce agreements and comply with legal requirements.

Our general retention approach is:

Retention periods may differ where:

• a Restaurant Customer has configured a permitted retention period;
• a contract or Data Processing Agreement requires a different period;
• litigation or investigation is pending;
• deletion would interfere with security or fraud prevention;
• legal obligations require continued retention; or
• the individual has requested deletion and no exception applies.

A Restaurant Customer may request account closure in accordance with its subscription agreement.

Before deletion, the Restaurant Customer should export data it is legally required to retain. Following termination:

1. access to the account may be suspended;
2. data may remain available for a limited export or recovery period;
3. production data will be deleted or de-identified after that period, subject to legal requirements;
4. residual copies may remain in encrypted backups until the backup cycle completes; and
5. limited records may be retained for tax, fraud prevention, dispute resolution, security and legal compliance.

Ordrji may request written authorisation and identity verification before processing an export or deletion request.

Ordrji uses reasonable technical and organisational safeguards designed to protect personal data. Depending on the Service and risk, these may include:

• encryption in transit;
• encryption, tokenisation or masking at rest where appropriate;
• role-based access controls;
• staff PINs and account authentication;
• secure password hashing;
• audit logs;
• device registration and activation;
• access monitoring;
• network and database controls;
• encrypted or access-controlled backups;
• security logging;
• vulnerability management;
• software update controls;
• synchronisation retry and idempotency controls;
• disaster-recovery procedures;
• employee confidentiality obligations;
• vendor security requirements;
• incident-response procedures; and
• regular review of access permissions.

No internet, cloud or device-based system can be guaranteed to be completely secure. Restaurant Customers must protect passwords, PINs, devices, printers, local networks and authorised-user accounts and must notify Ordrji promptly of suspected misuse.

If Ordrji becomes aware of a personal-data breach, we will investigate and take reasonable steps to:

• contain the incident;
• protect affected systems;
• identify the nature and extent of the breach;
• assess potential consequences;
• restore secure service;
• prevent recurrence; and
• notify affected persons, Restaurant Customers and regulatory authorities where required by applicable law.

Where Ordrji processes affected data on behalf of a Restaurant Customer, we will notify and reasonably assist that Restaurant Customer in meeting its legal obligations.

Subject to applicable law, you may have the right to:

• obtain information about personal data being processed;
• request a summary of the personal data and processing activities;
• ask for inaccurate or misleading data to be corrected;
• ask for incomplete data to be completed;
• ask for personal data to be updated;
• request erasure where retention is no longer required;
• withdraw consent;
• object to or opt out of direct marketing;
• raise a grievance;
• nominate another individual to exercise rights in the event of death or incapacity; and
• approach the relevant regulatory authority after using the available grievance process.

Rights are not absolute. We may retain or continue processing information where required for legal compliance, security, fraud prevention, contractual claims or another lawful purpose.

How to submit a request

Send a request to:

Privacy email: privacy@ordrji.com
Subject: Privacy Rights Request

Include:

• your name;
• registered mobile number or email;
• Restaurant Customer or outlet name, where relevant;
• description of the request;
• relationship with the restaurant; and
• information reasonably required to verify identity.

We will not ask for passwords, UPI PINs or CVVs.

Requests concerning restaurant-controlled data

When Ordrji processes data on behalf of a Restaurant Customer, we may:

• direct the request to the Restaurant Customer;
• notify the Restaurant Customer;
• act on the Restaurant Customer’s documented instructions; or
• assist the Restaurant Customer in responding.

Questions, complaints or grievances concerning this Privacy Policy may be sent to the Privacy and Grievance Officer.

Privacy and Grievance Officer: ASIYA IMRAN SHAIKH
Designation: Software Developer
Legal entity: SYNCKRAFT TECHNOLOGIES PVT. LTD
Registered office: 414, 4th Floor, Daga Plazzo Biyani Sqaure, opp. Dmart Camp, Amravati, Maharashtra 444602
Email: privacy@ordrji.com
General email: hello@ordrji.com
Phone: +91 90044 02006
Working hours: 11 AM-6PM, Monday to Saturday

We aim to acknowledge grievances promptly and respond within 30 days, unless a shorter or longer period is required or permitted by applicable law.

You may stop promotional communications by:

• using an unsubscribe link;
• replying with the stated opt-out instruction;
• changing communication preferences in your account;
• asking the Restaurant Customer to stop its campaigns; or
• contacting privacy@ordrji.com.

Opting out of marketing will not stop essential communications relating to orders, security, payments, subscriptions, support or legal matters.

Restaurant Customers using Ordrji’s WhatsApp, SMS, email or campaign features are responsible for:

• obtaining required consent;
• maintaining proof of consent where required;
• respecting opt-outs;
• maintaining accurate contact lists;
• following platform and telecom rules; and
• ensuring that messages are not misleading, unlawful or unsolicited.

Ordrji’s business accounts and administrative Services are intended for adults authorised by a Restaurant Customer. Ordrji does not knowingly permit children to independently create Restaurant Customer or staff-administrator accounts.

Where an End Customer under 18 uses a restaurant ordering service:

• the transaction should be completed by or with the involvement of a parent or lawful guardian;
• only information reasonably necessary to fulfil the order should be collected;
• the restaurant should obtain verifiable parental or guardian consent where legally required;
• Ordrji and Restaurant Customers must not conduct behavioural monitoring or targeted advertising directed at children where prohibited; and
• a parent or guardian may contact the relevant restaurant or Ordrji regarding the child’s data.

Do not enter the following information into free-text fields, order notes, support chats or other Ordrji areas unless it is strictly necessary and expressly authorised:

• passwords;
• card numbers or CVVs;
• UPI PINs;
• bank passwords;
• Aadhaar numbers;
• passport details;
• medical records;
• biometric templates;
• highly sensitive identity documents; or
• information unrelated to restaurant operations.

Where allergy or dietary information is provided for an order, it should be limited to what is reasonably necessary to fulfil that order safely.

Restaurant Customers using Ordrji are responsible for:

• providing appropriate privacy notices to End Customers and staff;
• identifying a lawful purpose for collecting personal data;
• collecting only necessary information;
• obtaining consent where required;
• configuring appropriate roles and permissions;
• keeping login details secure;
• reviewing staff access when employment or duties change;
• protecting local POS devices and networks;
• maintaining legally required restaurant and tax records;
• responding to privacy requests;
• honouring communication opt-outs;
• using CRM and marketing features lawfully;
• obtaining permission before migrating data from another system;
• notifying Ordrji promptly of suspected security incidents; and
• complying with applicable privacy, consumer, tax, labour and electronic-communication laws.

Restaurant Customers must not use Ordrji to unlawfully monitor employees, create discriminatory profiles or send unsolicited communications.

The Services may contain links to or integrations with third-party websites, payment providers, delivery platforms, messaging services, accounting software or other systems.

Ordrji does not control the privacy practices of independent third parties. You should review their privacy policies before providing information or enabling an integration. Disabling an integration may not automatically delete information already processed by that third party.

Ordrji may use aggregated or de-identified information to:

• understand restaurant-industry trends;
• measure product performance;
• improve reliability;
• develop reports;
• create benchmarks;
• improve fraud detection;
• develop forecasting models; and
• support research and product development.

We will take reasonable steps to prevent such information from being used to identify an individual or disclose the confidential business data of a Restaurant Customer.

We may update this Privacy Policy to reflect:

• changes to the Services;
• new features or integrations;
• changes in our vendors;
• legal or regulatory developments;
• security practices; or
• organisational changes.

The updated policy will display a revised “Last updated” date. Where a change materially affects how personal data is used, we will provide additional notice through the website, application, registered email, dashboard or another appropriate channel. Where required, we will obtain fresh consent.

For privacy questions, rights requests or complaints, contact:

SYNCKRAFT TECHNOLOGIES PVT. LTD., operating as Ordrji
414, 4th Floor, Daga Plazzo Biyani Sqaure, opp. Dmart Camp, Amravati, Maharashtra 444602
Email: privacy@ordrji.com
General enquiries: hello@ordrji.com
Phone: +91 90044 02006