Privacy Notice for the Moloni Orders app
This Privacy Notice aims to help you understand how Moloni processes your personal data when using the Moloni Orders app, available for iOS and Android, as a catering order management solution.
Roles and responsibilities
Moloni Unipessoal, Lda. is part of the Visma group, a Norwegian group of software development companies. Moloni acts as the data controller for the processing of personal data related to your account and app usage (authentication, support, security, and subscription billing). When you use the app to process personal data of third parties in the course of managing your business (e.g. employees, customers), Moloni acts as a data processor, under the terms of the service agreement and data processing agreement entered into with your organisation, which remains the data controller.
Contact us
If you have any comments or questions about this Privacy Notice, or any privacy concerns, including potential data breaches or inappropriate processing, please contact us through our support channels for further routing or, if you wish to contact Moloni's Data Protection Officer, send an email to dpo@moloni.com.
You can also contact us at the following operational address:
Av. José Malhoa, n.º 2 - Tardoz
Ed. Malhoa Plaza, Escritório 1.5
1070-325 Lisboa, Portugal
Processing activities
Data processed for service delivery
The app allows table orders to be collected and managed in the kitchen, featuring an inter-team notification system, syncing in real time with your Moloni account. It processes information required for orders (items, table/dining area, amounts), which may include customer data when associated with an order, for instance, for invoicing purposes.
The lawfulness of this processing is based on the performance of the service contract you have with Moloni, pursuant to GDPR Article 6(1)(b), and may also be based on legal obligations regarding tax and invoicing matters, pursuant to point (c) of the same article, where applicable.
This data is retained under the terms of the Moloni Service Privacy Notice and our Data Retention Policy available at https://www.moloni.pt/legal/?file=retencao-dados.
Device permissions
The app may use the device camera as an item barcode scanner and the location feature to discover nearby Bluetooth devices.
App improvement and security
We strive to ensure that the app operates correctly and securely. In this context, we note that this app does not collect diagnostic data, usage data, or device identifiers for its own analytics, advertising, or error detection purposes, separate from the data processed for service delivery described above.
Categories of data processed by the app
The following table summarises, by category, whether the app processes personal data falling under that category, based on the app's functionality and current declarations in application stores:
How your personal data may be shared
Within the Visma Group
The Visma Group consists of several subsidiaries. In order to ensure a coherent overview and consistent learning within an integrated knowledge framework, we may share your personal data among companies in the Visma Group. The intent is to optimise operations and provide you with a more integrated and seamless experience.
Outside the Visma Group
We may also share your personal data with external third parties, with sharing limited to the following contexts:
Data Processors (Subcontractors)
We use data processors to process personal data. These processors are typically cloud-based service providers. When using data processors, we enter into a data processing agreement in order to safeguard your privacy rights. If processors are located outside the EU/EEA, we ensure the legal basis for such international transfers, for example through the implementation of EU Standard Contractual Clauses. Should you require more detailed information about our processors, please contact us at dpo@moloni.com.
Public authorities
The police and other authorities may request access to information we hold. This may include personal and non-personal data.
In all such cases, we follow strict internal policies and procedures to evaluate access requests and seek legal advice whenever necessary. We only share information strictly required by law, and only share information based on court orders or other binding documents.
To prevent unauthorised access to any information we hold, we also implement technical measures such as encryption and access controls. The Visma Security Programme ensures high standards of security and confidentiality.
Furthermore, we ensure legal obligations in contracts with our processors that guarantee they also implement organisational and security measures similar to ours.
If we receive access requests from authorities outside the EEA, we ensure our compliance with Article 32 of the Data Act. Internal policies and routines are in compliance with this regulation.
Your rights
You may exercise the following rights regarding our processing of your personal data:
- Access: You have the right to request a copy of the personal data we process about you.
- Rectification: You also have the right to request the rectification of inaccurate personal data concerning you.
- Erasure: You may request the erasure of personal data concerning you.
- Restriction: You can ask us to restrict the processing of your personal data.
- Portability: You can ask us to provide you or others with your personal data in a structured, commonly used, and machine-readable format.
- Objection: You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes. You also have the right to object to the processing of your personal data based on public interest grounds or in the exercise of official authority or based on legitimate interests.
Please note that there may be exceptions or limitations to the rights mentioned above that may apply depending on the specific circumstances of your situation. In such cases, we will provide detailed information about the applicable exception or limitation and help you exercise your rights to the fullest extent possible, in accordance with applicable laws and regulations.
If you wish to exercise any of your data protection rights, please submit a support request on the website Moloni or send an email to dpo@moloni.com.
Finally, you also have the right to lodge a complaint with data protection authorities regarding our processing of your personal data. In Portugal, the supervisory authority is the National Data Protection Commission (Comissão Nacional de Proteção de Dados - CNPD), which can be contacted via geral@cnpd.pt.