orderbird and the GDPR

Your data is important to us! That is why we follow the requirements of the GDPR so that we can guarantee you control and clarity over the processing of personal data.

This page is intended to inform our customers about how we handle their data when they use orderbird products.

Under the EU General Data Protection Regulation (GDPR), as a business owner you have to ensure that the personal data of your employees and customers (for example name, address, telephone number) is processed and protected in line with data protection law.

What is the GDPR? The most important facts at a glance!

On 25 May 2018 the General Data Protection Regulation (GDPR) came into force. It replaces Data Protection Directive 95/46/EC, which applied until then. That directive had governed data protection in the EU for more than 20 years. Above all, the GDPR is intended to unite the differing data protection approaches that applied until then into a single set of rules across Europe. This is intended to ensure that the personal data of citizens in the EU is appropriately protected.

Protection against manipulation
Your data is safe with us! We protect it against unauthorized access.
Storage in Germany
All personal data is secured on servers in Germany.
High availability
Full control! You have access to your data at all times and from anywhere!

The data processing agreement (DPA)

When you use the orderbird PRO app, orderbird MINI or MY orderbird, orderbird processes personal data about you and, to a certain extent, about your employees and customers as well. That is why the law requires you, as the controller, to conclude a data processing agreement (DPA) with orderbird.

What do I have to do?

You can view and download the data processing agreement (DPA) here:

Download the data processing agreement (DPA)

Then send the completed and signed contract back to us.

The DPA explains exactly which personal data we process in the context of our services (orderbird PRO and MY orderbird), for what purpose, on what legal basis and with which technical and organizational measures we protect this data against unauthorized access.

It's this easy:

Open the DPA with the free Adobe Acrobat Reader.
Enter your details and sign the document digitally.
Save the completed version and send it by email to [email protected].

Alternatively, you can also print out the DPA, fill it in by hand, scan it and send it to us by email.

What happens if I do not sign the DPA?

You can continue to use our service. As a business owner, however, you are legally obliged to conclude a DPA with us if we process personal data on your behalf. The GDPR expressly requires such a contract to be concluded, setting out the mutual rights and obligations for the data processing. The absence of a DPA can therefore lead to a fine from the supervisory authorities.

My company is in Switzerland. Does the GDPR apply to me too?

Yes. Even if your company is based in Switzerland, the GDPR may apply, for example if EU citizens are among your customers or you specifically target EU markets.

What exactly does the GDPR govern?

The GDPR ensures that, among other things, the principles of purpose limitation, transparency and data minimization are observed when personal data is processed. It strengthens the rights of data subjects and increases the obligations for controllers and processors.

You can find the full text of the GDPR here.

What data does orderbird process about me?

Revenue data (statutory retention obligation: 10 years)
Personal data about you, your employees and, where applicable, your customers (for example name, address, contact details, contract data)
Data connected with the use of the POS (for example shift changes, bookings, cancellations), which is logged in accordance with GoBD
Your data is protected against unauthorized access by technical and organizational means
Only service providers under contract are given access to data, exclusively in the context of providing the service and with the obligation to comply with the provisions of the GDPR

Is my data stored abroad?

orderbird's servers are located in Germany. The orderbird service data processing relating to the POS data processed is not outsourced to what are known as third countries.

For internal work processes, however, third-party software may be used (for example for team communication or support tickets). In doing so we make sure that any data transfers take place exclusively on the basis of suitable safeguards in accordance with Article 44 et seq. GDPR, in particular standard contractual clauses of the EU Commission or providers certified under the Data Privacy Framework.

We regularly check that the tools used comply with data protection law. Should a provider not offer a sufficient guarantee of maintaining the level of data protection, we end the cooperation.