Български

Privacy policy

Effective 2026-10-15

This explains what personal data byrzo processes, why, and what your rights are. It covers both the customers who order and pay through byrzo and the businesses that sell through it, and their teams.

1. Who we are

The controller is AR EM DIGITAL Ltd. („АР ЕМ ДИДЖИТАЛ" ООД), a limited liability company registered in Bulgaria, UIC 208452504. For anything about your data, write to support@qorder.me.

byrzo is a platform where customers order ahead from restaurants and cafés, pay online, and collect the order in person. The seller of every order is the business; byrzo provides the technology.

2. What data we process

2.1. When you order

  • Your order — the dishes, extras, quantities, total, and any notes you choose to add ("no onion", for example). For allergens, ask the business before ordering.
  • Your email address — you enter it when paying. We use it for emails about the order: that it's received, ready, or cancelled. We also pass it to the payment provider, which may email you a payment confirmation, depending on the business's settings. The fiscal receipt comes from the business itself.
  • Language — to show the menu and write to you in your language.
  • Notifications — if you turn them on for an order, your browser gives us an address at its own push service (Google's, Mozilla's, Apple's or Microsoft's, depending on the browser) and keys we encrypt the notification with. We keep them only until the order is over, or until you turn them off.
  • Payment data — you enter your card number in the payment provider's own form; it never passes through byrzo and we never see it. We receive the payment's outcome and an identifier and, if the payment is refunded or your bank disputes it, the amount, date, status and stated reason, for the business's statement.
  • Technical data — IP address and browser details in server logs and, if an email to you can't be sent, your address, for security and fixing errors.

We don't ask for your name, phone number or a delivery address — you collect the order yourself.

2.2. When you work for a business on byrzo

  • Account — email, name, role (owner, manager, staff), language and password. The password is stored only hashed, so nobody, us included, can read it. Every sign-in attempt, and creating an account, writes the email to the server log.
  • Business details — name, pickup address and how to collect, phone, map link, opening hours, menus, prices, portion sizes, allergens and photos; the seller's company name and UIC, which customers see on the menu and the order page (a sole trader's company name includes a person's name); the legal form, registered address, VAT number, the name on bank statements and the kind of place, with which we open the account with our payment provider; and the details for invoicing byrzo's fees — legal name, UIC, VAT number, address, accountable person (МОЛ) and invoice email, if you give them to us.
  • Payments — the business opens its own account with our payment provider, under its own direct agreement with that provider. To open the account, byrzo passes the provider the business details above, its phone and the owner's email. The business gives its bank account and its representative's identity straight to the provider. byrzo receives the account's identifier, whether the provider allows payments and payouts, how many details it still needs and by when.
  • Order handling — when each order was accepted, rejected, made ready, collected or cancelled, and why; when its fiscal receipt was marked as rung; and when someone last used a control on the Orders page ("Stop orders", "Busy"). We don't record which team member used a control or accepted, rejected or readied an order; only when an accepted order is cancelled and refunded does the server log keep which user cancelled it (for up to 30 days). With this the business can trace what happened, and byrzo can tell whether anyone is at the tablet and stop new orders after a missed one. We also record when a member of byrzo's staff signs in to the account as the owner for support.

2.3. When you write to us through the form for restaurants

  • Your request — name, restaurant, email and, if you give them, a phone number and a message. We send it by email to byrzo's inbox and don't save it in our database; the server log records only that a request arrived. We use it to reply to you and, if you decide to, to set up your restaurant's account.

3. Why we process it

  • To perform the contract (GDPR Art. 6(1)(b)) — to take your order, pass it to the business, process the payment and tell you about it — by email and, if you turn them on, by notification; to run the business's account.
  • Legitimate interest (Art. 6(1)(f)) — keeping the platform secure, preventing abuse and fixing errors; and answering a request from the form for restaurants and setting up the restaurant's account.
  • Legal obligations (Art. 6(1)(c)) — our accounting and tax obligations, such as for the fees byrzo charges businesses.

We don't send marketing emails and don't build advertising profiles.

4. Who we share it with

  • The business you order from — sees your order and your notes, to prepare it. The payment goes to its own account with the payment provider, where it also sees the amount and the email you paid with.
  • The payment provider — the company that handles card payments. It is established in the EU and handles the payment as an independent controller, not on our instructions, under its own privacy policy. Section 4 of the terms for customers names it, or you can ask us.
  • Your browser's push service — if you turn on notifications, we send them through it. It gets each notification encrypted and can't read it; it sees only that byrzo sent you one, when, and how long it is.
  • Providers that help us run byrzo — server and database hosting (in Frankfurt, in the EU), sending our email and hosting menu photos. They process data only on our instructions.

We don't sell personal data or give it to advertisers.

We describe these providers by what they do rather than by name. If you want to know exactly which companies they are, write to us at support@qorder.me and we'll tell you.

5. Transfers outside the EU

The providers that send our email and host the menu photos are based in the US, as is the company that hosts our servers — though the servers and the database are in Frankfurt, in the EU. When you open a menu, your browser loads the photos straight from the photo host, and byrzo's pages through the hosting provider's content delivery network (CDN), which has servers worldwide, so they see your IP address and browser details. Data goes to the US either because the European Commission has recognised the protection under the EU–US Data Privacy Framework as sufficient and the provider is certified under it, or under the Commission's standard contractual clauses. Write to us and we'll tell you which applies to which provider, and send you a copy.

If you turn on notifications, they pass through your browser's push service — depending on the browser, Google's, Mozilla's, Apple's or Microsoft's, all US companies. They arrive there encrypted and can't be read. The transfer happens because you asked for notifications; byrzo works the same without them.

6. How long we keep it

  • Orders and payments — as long as they're needed for the service, for the business's and byrzo's accounting, and to settle disputes; then deleted or anonymised.
  • Business accounts — for the length of the contract and up to 12 months after it ends.
  • Requests from the form for restaurants — in our inbox for up to 12 months after our last exchange if no contract follows; if one does, as long as the business's account.
  • The notification address — until the order is over, or until you turn them off.
  • Server logs — up to 30 days.

7. On your device

We don't use tracking or advertising cookies. Your browser keeps only what makes byrzo convenient: your basket (until you close the tab); the orders opened on this device — their code and number, business, time, status and a short list of the dishes, for "My orders" and "Order again"; at most 20 are kept, and ones older than 30 days are hidden and deleted the next time you open an order on this device; your email so you needn't type it again; your language; and which orders you turned notifications on for — they arrive through a small script (a service worker) your browser keeps for byrzo. For business teams, also the sign-in session (token, name, email, role and business), the language, and whether the new-order sound is on. Clearing the site's data in your browser removes them. Our payment provider's form may use its own cookies, needed only to keep the payment secure.

8. Your rights

You have the right:

  • to access your data;
  • to have inaccurate data corrected;
  • to have it erased when there's no ground to keep it;
  • to restrict its processing;
  • to data portability — to receive it in a machine-readable form;
  • to object to processing based on legitimate interest.

Write to support@qorder.me. We answer within one month.

9. Complaints

If you believe your rights have been infringed, you can complain to the Bulgarian Commission for Personal Data Protection — 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, www.cpdp.bg.

10. Security

Connections to byrzo are encrypted, passwords are stored hashed, each business sees only its own data, and card details never pass through us.

11. Changes

We may change this policy. The date above shows the latest change; we'll email businesses about significant ones.

See also the terms for customers and the terms for businesses.