PRIVACY POLICY

1. About This Privacy Policy

ŌDER360 ("ŌDER360", "we", "us", "our") provides restaurant, café, food and beverage ("F&B") consultancy, business advisory, operational, strategic, marketing and related professional services.

This Privacy Policy applies to Personal Data collected through:

• our website;
• consultancy engagements;
• enquiry and contact forms;
• email and telephone communications;
• WhatsApp Business;
• social-media channels;
• meetings and events;
• marketing activities; and
• other interactions with ŌDER360.

"Personal Data" means information relating to an identified or identifiable natural person and includes equivalent concepts such as "personal information" where applicable.

We process Personal Data in accordance with applicable privacy legislation, including the UAE Federal Decree-Law No. 45 of 2021 concerning the Protection of Personal Data ("UAE PDPL") and, where applicable, the EU General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA").

2. Data Controller

Unless otherwise stated in a client agreement:

In some consultancy engagements, ŌDER360 may process Personal Data on behalf of a client. In such circumstances, the client may be the controller and ŌDER360 may act as a processor/service provider, subject to the applicable agreement.

3. Personal Data We Collect

Depending on your relationship with us, we may collect:

Identity and Contact Data

• Name
• Company
• Job title
• Email address
• Telephone number
• WhatsApp number
• Business address
• Country or region

Client and Business Data

• Project requirements
• Business plans
• Operational information
• Restaurant/café information
• Financial and costing information
• Supplier information
• Employee information supplied as part of consultancy work
• Contracts and project records
• Meeting notes
• Communications
• Invoices and payment records

Technical and Usage Data

• IP address
• Browser
• Device information
• Operating system
• Cookie identifiers
• Referring URL
• Pages viewed
• Approximate geographic information derived from IP
• Website interaction information
• Advertising/conversion identifiers

Marketing Data

• Marketing preferences
• Campaign interactions
• Advertisement interactions
• Website conversion events
• Social-media interactions

We ask clients not to provide sensitive or special-category Personal Data unless it is genuinely necessary for an agreed service and appropriate safeguards have been established.

4. How Information Is Collected

We collect Personal Data:

1. directly from you;
2. through our website and online forms;
3. through WhatsApp Business;
4. through email, telephone and meetings;
5. through consultancy agreements and project documentation;
6. through social-media platforms;
7. automatically through cookies and tracking technologies;
8. from clients, authorized representatives and business partners; and
9. from lawful publicly available sources.

5. Technologies and Third-Party Services

Google Analytics

We may use Google Analytics to understand how visitors use our website. Depending on configuration, Google Analytics may receive information including:

• IP-related information;
• device/browser information;
• page views;
• session information;
• approximate location;
• referral source; and
• website interactions.

We use this information for analytics, website optimization and measurement.

Meta Pixel

We may use Meta Pixel on our website to measure advertising performance and conversions. Depending on configuration, Meta may receive:

• IP address;
• browser/device information;
• pages visited;
• advertising identifiers;
• cookie identifiers;
• conversion events; and
• interactions with advertisements or website content.

Meta may process information under its own privacy terms. Where legally required, Meta Pixel and similar non-essential advertising technologies will not be activated until appropriate consent has been obtained.

CRM Software

We may use customer relationship management ("CRM") software to manage enquiries, client details, communications, proposals, consultancy projects, sales opportunities, follow-ups, and client relationships. Our CRM provider may process Personal Data on our behalf as a data processor/service provider.

WhatsApp Business

We use WhatsApp Business for client and prospective-client communications. Information may include telephone number, profile information, messages, documents, images, voice communications, and other information voluntarily shared through WhatsApp. WhatsApp/Meta may independently process certain information in accordance with their own terms and privacy policies. Clients should avoid transmitting highly sensitive information through WhatsApp unless necessary and appropriate.

Online Forms

Our website may use online forms for enquiries, consultation requests, recruitment, subscriptions or other purposes. Forms may collect name, telephone number, email address, company, service required, message content, and information voluntarily supplied by the user.

Cloud Storage

We may use cloud-based storage and collaboration systems for client documents, consultancy deliverables, contracts, project files, operational reports, internal records, and backups. Cloud providers may process or store information outside the UAE.

Social Media

We may operate profiles or distribute content through social-media services. Where you interact with our posts, advertisements or accounts, the applicable social-media provider may collect information independently under its own privacy policy.

Overseas Service Providers

Certain hosting, CRM, analytics, cloud, communications, advertising or technology providers may operate outside the UAE. Accordingly, Personal Data may be processed in other jurisdictions.

6. Purposes of Processing

We process Personal Data to:

• respond to enquiries;
• provide consultancy services;
• prepare proposals and quotations;
• perform contracts;
• manage client projects;
• communicate with clients;
• issue invoices and administer payments;
• maintain business records;
• improve our website and services;
• analyze website usage;
• measure advertising performance;
• conduct lawful marketing;
• prevent fraud and misuse;
• maintain information security;
• establish or defend legal claims; and
• comply with applicable law.

7. Legal Bases

Where GDPR or another law requiring a lawful basis applies, processing may be based upon:

• consent;
• performance of a contract;
• steps taken before entering into a contract;
• compliance with legal obligations;
• legitimate interests, where permitted; or
• another lawful ground recognized by applicable law.

Where consent is relied upon, it may be withdrawn without affecting processing lawfully undertaken before withdrawal.

8. Cookies and Advertising

We may use essential, functional, analytics and advertising cookies.

Where applicable law requires consent, non-essential analytics and advertising cookies will be activated only after appropriate consent.

9. Disclosure of Personal Data

Personal Data may be disclosed to:

• hosting providers;
• CRM providers;
• Google Analytics;
• Meta and related advertising technologies;
• cloud-storage providers;
• communications providers;
• professional advisers;
• accountants;
• contractors and consultants;
• payment providers;
• governmental/regulatory authorities where required; and
• prospective purchasers or successors in connection with a lawful corporate transaction.

We do not sell Personal Data for monetary consideration.

Certain advertising activities involving third-party tracking technologies may constitute "sharing" for cross-context behavioural advertising under the CCPA where that law applies. Where legally required, applicable opt-out mechanisms will be provided.

10. International Transfers

Personal Data may be transferred outside the country where it was collected.

Where required, we implement appropriate safeguards, which may include:

• adequacy mechanisms;
• contractual safeguards;
• Standard Contractual Clauses;
• data-processing agreements;
• transfer assessments;
• contractual confidentiality obligations; or
• another legally recognized transfer mechanism.

11. Data Retention

We retain Personal Data only for as long as reasonably necessary for the purposes for which it was collected and for legal, tax, accounting, contractual and dispute-resolution requirements.

Retention periods depend on the category of information, legal requirements and nature of the client relationship.

When Personal Data is no longer required, we will delete, anonymize or securely dispose of it where reasonably practicable and legally appropriate.

12. Security

We use reasonable technical and organizational measures designed to protect Personal Data, including where appropriate:

• access controls;
• password protection;
• role-based access;
• secure cloud services;
• backup procedures;
• confidentiality obligations;
• vendor controls; and
• restricted access to project information.

No system can guarantee absolute security.

13. GDPR Rights

Where GDPR applies, you may have rights to:

• access Personal Data;
• correct inaccurate data;
• request erasure;
• restrict processing;
• object to processing;
• receive portable data;
• withdraw consent;
• object to certain direct marketing; and
• lodge a complaint with an applicable supervisory authority.

14. California Privacy Rights

Where CCPA applies, California consumers may have rights including:

• the right to know;
• the right to access;
• the right to delete;
• the right to correct;
• the right to opt out of sale or sharing;
• the right to limit certain uses/disclosures of sensitive Personal Information; and
• the right not to receive discriminatory treatment for exercising applicable privacy rights.

We do not knowingly sell Personal Information for monetary consideration.

Where our use of advertising technologies constitutes "sharing" under the CCPA, eligible consumers may exercise applicable opt-out rights.

We will recognize legally required opt-out preference signals, including Global Privacy Control, where applicable to our processing.

15. UAE Privacy Rights

Individuals may exercise rights available under applicable UAE data-protection legislation (including UAE Federal Decree-Law No. 45 of 2021 concerning the Protection of Personal Data), subject to applicable statutory conditions and exceptions.

Requests should be directed to our Privacy Contact.

16. Direct Marketing

You may unsubscribe from marketing communications at any time by using an unsubscribe mechanism where available or contacting us.

Service communications necessary to an active consultancy engagement are not marketing communications.

17. Children

Our services are directed to businesses and adults.

We do not knowingly solicit Personal Data directly from children for consultancy or marketing purposes.

18. Automated Decision-Making

ŌDER360 does not ordinarily make decisions producing legal or similarly significant effects solely through automated processing.

If this changes, we will provide disclosures required by applicable law.

19. Third-Party Websites

Our website may contain links to third-party websites. We do not control their privacy practices and recommend reviewing their policies separately.

20. Changes

We may update this Privacy Policy to reflect operational, technological or legal developments.

The revised policy will show an updated "Last Updated" date.

21. Contact and Requests

Privacy enquiries and requests should be sent to:

We may request reasonable information to verify identity before fulfilling a rights request.

© 2026 ŌDER360. All Rights Reserved.