1. Controller and contact
The controller for the central Kwikorder platform and public platform website is:
SinghWeb
Represented by: Ravinder Singh
Winkelstraße 3
46117 Oberhausen
Deutschland
Email: info@singhweb.de
Website: https://www.singhweb.de
This policy covers the central platform, restaurant and reseller registrations and accounts, billing, support, domain management and the public platform website. The relevant restaurant is generally the controller for processing on its restaurant website; its privacy policy also applies.
2. Roles for restaurant, order and reservation data
SinghWeb is controller under Article 4(7) GDPR for contract, account, security, billing and platform administration data.
Where SinghWeb processes guest, order, reservation or restaurant-customer data solely on a restaurant’s instructions, it acts as processor under Article 28 GDPR. The restaurant determines purposes and essential means, informs guests and handles data-subject requests. A data processing agreement must be concluded before production use.
3. Categories of data
Depending on use, we process identity and contact data; restaurant, reseller, staff and account data; login, password-hash, IP, device, browser, timestamp, two-factor and trusted-device data; contract, package, trial, invoice, tax and payment-status data; domain, DNS, SSL and registration data; support messages and attachments; consent and legal-version evidence; consent-based usage and analytics data; and, for restaurants, guest, order, delivery, reservation and payment-method data.
4. Purposes and legal bases
We process data for pre-contractual measures and contract performance (Article 6(1)(b) GDPR); legal obligations, including commercial and tax law (Article 6(1)(c)); security, abuse prevention, troubleshooting, stability, claims management and proportionate product improvement based on legitimate interests (Article 6(1)(f)); optional cookies, audience measurement and session analysis based on consent (Article 6(1)(a) GDPR together with Section 25 TDDDG); and processing for restaurants according to their documented instructions and legal bases.
Our legitimate interests are a secure, economical and auditable platform, prevention of fraud and establishment, exercise or defence of legal claims.
5. Website access, server logs and hosting
When pages are accessed, the IP address, date and time, requested URL, referrer, browser, operating system, device, response status and transferred volume are processed to deliver content, detect attacks and troubleshoot. The legal basis is Article 6(1)(f) GDPR.
The platform is hosted by a provider that processes data for operation, security, logging and backups on our behalf. Where required, a processing agreement is concluded. Provider selection takes account of location, security, deletion arrangements and appropriate safeguards for potential third-country transfers.
6. Contact, applications and support
For contact, restaurant registration, reseller applications and support, we process submitted details, messages, attachments, security metadata and correspondence. The basis is Article 6(1)(b) GDPR for contractual requests, Article 6(1)(f) for other requests and abuse prevention, and Article 6(1)(c) where correspondence must be retained by law.
7. Registration, accounts and acceptance records
We process identity, contact, company, restaurant, language, role and credential data to create and administer accounts. Acceptance of terms and privacy notices is recorded with version, time, IP address and browser information to evidence contract formation. Legal bases are Article 6(1)(b), (c) and (f) GDPR.
8. Account security, two-factor codes and trusted devices
We process failed logins, lock periods, IP and device data, security codes and encrypted trusted-device identifiers. Codes are time limited. Trusted-device records remain until expiry, revocation or the device limit is reached. The basis is Article 6(1)(f) GDPR. Passwords are stored as cryptographic hashes rather than required in plain text.
9. Packages, billing and Stripe
For paid packages we process customer, restaurant, plan, price, tax, term, billing address, payment status and Stripe customer, price, subscription and transaction identifiers. Full card or bank data is normally processed directly by Stripe.
Where displayed at checkout, payment services are provided by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, together with affiliated Stripe companies. Stripe may act as independent controller or processor and may process data outside the EEA with appropriate safeguards. See https://stripe.com/de/privacy and https://stripe.com/de/legal/dpa. Bases are Article 6(1)(b), (c) and legitimate interests in fraud prevention and reconciliation under (f) GDPR.
10. Restaurant guests, orders and reservations
Depending on configuration, orders and reservations contain name, contact details, delivery address, items, notes, time, payment method, status and reservation details. The relevant restaurant is controller. SinghWeb processes these data on its behalf to provide ordering, notifications, app display, printing, interface transfer and status communication.
Guests should first address access, deletion or correction requests to the restaurant. We assist the restaurant under the processing agreement.
11. Email and system messages
Registration, security, contract, invoice, payment, support and system messages are sent through the configured email service. Recipient, subject, content, timestamp, delivery status and technical logs are processed. The email or hosting provider receives data as a category of recipient only where needed for delivery, security and troubleshooting. A processing agreement is concluded where required.
Marketing messages are sent only with a separate legal basis. Consent can be withdrawn for the future; necessary contractual and security messages are unaffected.
12. Domains and OpenProvider
For domain searches, registration, renewal or transfer, we process the requested domain, availability, status, intended registrant or administrative contact data and technical DNS and billing data. Depending on configuration, registration is manual or handled through Openprovider B.V., Kipstraat 3c-5c, 3011 RR Rotterdam, Netherlands. Registry and registrar rules also apply. See https://www.openprovider.com/legal/privacy-policy. A search may transmit the entered domain and connection metadata. Bases are Article 6(1)(b) and (f) GDPR.
13. Cloudflare for DNS, SSL and protection
Where enabled, services of Cloudflare, Inc. and its affiliates are used for DNS, TLS/SSL, custom hostnames, delivery and attack protection. IP address, domain, device, browser and security data may be processed. The basis is our legitimate interest in secure and fast delivery under Article 6(1)(f) GDPR. Third-country transfers use Cloudflare’s safeguards. See https://www.cloudflare.com/privacypolicy/.
14. Cloudflare Turnstile
Cloudflare Turnstile may protect the contact form, restaurant registration and reseller application. It evaluates technical signals to distinguish people from automated access and may transmit IP, browser, device and interaction data to Cloudflare. The basis is Article 6(1)(f) GDPR and our interest in preventing spam and abuse. See https://www.cloudflare.com/turnstile-privacy-policy/.
15. Necessary cookies and local storage
Necessary cookies or similar storage are used for sessions, language, login, security, load distribution and consent status. Access to the device is based on Section 25(2) TDDDG; subsequent processing relies mainly on Article 6(1)(b) and (f) GDPR.
The “kwikorder_cookie_consent” cookie stores choice, version and update time, generally for up to 180 days. Session and security cookies end according to purpose, logout and configured duration. Blocking necessary cookies may limit functions.
16. Consent management
Non-essential analytics are loaded on the public platform only after consent. Choices can be changed for the future in cookie settings. Withdrawal does not affect earlier lawful processing. We attempt to remove known analytics cookies on our domain; data already transmitted remains subject to the provider’s deletion rules.
17. Google Analytics and Google Tag Manager
If enabled by the superadmin and accepted by the visitor, Google Analytics may measure page views, approximate region, device, browser, interactions and pseudonymous identifiers. IP anonymisation is configured. Provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; affiliates may process outside the EEA. The basis is consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. See https://policies.google.com/privacy and https://support.google.com/analytics/answer/12017362.
Google Tag Manager may alternatively manage scripts and can load further services. In the current platform it loads only after analytics consent. Any new tags require a review of consent logic and this policy before publication. See https://www.google.com/intl/en/tagmanager/use-policy.html.
18. Microsoft Clarity
If enabled and accepted, Microsoft Clarity analyses pseudonymous usage such as clicks, scrolling, pointer movements and session replays to identify usability issues. Provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Data may be processed outside the EEA. The basis is consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. See https://privacy.microsoft.com/privacystatement and https://learn.microsoft.com/clarity/faq.
19. Recipients and processors
Data is disclosed only where needed, including to hosting, email, support, payment, accounting, domain, DNS, SSL, security, analytics, app and interface providers and to authorities where required. Processing agreements under Article 28 GDPR are concluded where applicable. A current list of material subprocessors is available on request unless security or confidentiality interests prevent disclosure.
20. Third-country transfers
Some providers have companies or servers outside the EEA. Transfers occur only under Articles 44 et seq. GDPR, for example based on an adequacy decision, the EU-US Data Privacy Framework, Standard Contractual Clauses and supplementary safeguards, or a statutory exception. Service-specific information is provided above.
21. Retention
Data is kept only as long as needed for purpose and contract or required by law. Criteria include account term, limitation periods, security, open claims and commercial or tax duties.
Typically, the restaurant account and non-personal configuration are archived after contract end and are not automatically deleted solely because of cancellation. Personal guest, order and reservation data normally remains available for an export requested through support for 30 days and is anonymized after normally twelve archive months and a due-date review unless another legal basis or documented instruction applies. Security and technical logs are normally retained for no more than 90 days unless a security incident requires longer purpose-limited retention. Support and contract correspondence remains for applicable evidence periods; accounting records and invoice data generally eight years; commercial correspondence generally six years; claim data commonly three years from year end; consent and acceptance evidence while needed.
Backups are overwritten on a rolling cycle of normally no more than 90 days. Deleted or anonymized production data may remain protected until that cycle expires and is used only for restoration, security or legal purposes.
22. Required information
Contract and registration data are necessary to create an account and provide services. A contract cannot be concluded without required fields. Analytics consent is voluntary and not required to use the website.
23. Data-subject rights
Subject to legal requirements, individuals have rights of access, rectification, erasure, restriction, portability and objection. Consent can be withdrawn for the future. Contact info@singhweb.de. We may request reasonable proof of identity.
Where processing relies on Article 6(1)(f) GDPR, you may object for reasons relating to your particular situation. Direct marketing can be opposed at any time without restriction.
24. Complaint
You may complain to a supervisory authority. The authority for our registered office is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestraße 2–4
40213 Düsseldorf, Germany
Email: poststelle@ldi.nrw.de
Website: https://www.ldi.nrw.de
25. Automated decisions
No solely automated decisions with legal or similarly significant effects under Article 22 GDPR are made. Automated security and spam checks may temporarily restrict access; support can review the matter.
26. Security and changes
We use proportionate technical and organisational measures including access controls, encryption in transit, password hashing, roles, logging, rate limits, security codes and backups. No system is entirely risk-free.
This policy is updated when services, processing or law changes. The current version and version number are published here. Registered users will be informed appropriately about material changes.