ECOCEE DEMO · ORDATO
How we collect, process, and protect your personal data under United Arab Emirates's privacy regulations.
Last Updated: August 16, 2026 • Region: United Arab Emirates
Draft Document
This policy outlines our data handling practices under UAE Federal Decree-Law No. 45 of 2021 (Personal Data Protection Law - PDPL). It has not yet been reviewed by qualified legal counsel and may be subject to updates.
At Ordato, we believe guest data is sacred. We process your personal information with the highest standards of care and transparency, in full compliance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.
This policy explains what data we collect, how we use it, your rights, and how you can exercise those rights. We apply data minimization principles to every process—we collect only what is necessary, retain it only as long as needed, and delete it securely once its purpose is fulfilled.
Applicable Law
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data
Regulatory Authority
UAE Data Office
Implementation Timeline
Enacted: November 2021 • Effective: Fully effective from the date of publication
To provide our AI waiter and order management services, we collect only the minimum personal data required:
Guest Information
Session & Technical Data
Chat & Order Data
Service Improvement Data
Your data is processed exclusively for the following purposes:
Our AI capabilities are powered by Azure OpenAI. Before any data is transmitted to the language model:
🔍 Data Stripping
Personally Identifiable Information unrelated to order fulfillment is automatically removed from the context before transmission.
🛡️ No Model Training
Under our enterprise agreement with Microsoft, your chat transcripts and order data are never used to train or improve OpenAI's foundational models. Data remains in isolated processing environments.
🚫 Content Filtering
Asynchronous content filters and strict system prompts prevent inappropriate responses and hallucinated menu prices.
📍 Geographic Isolation
Data processing occurs in secure cloud regions complying with United Arab Emirates's data residency requirements.
Data shall be retained for no longer than necessary to fulfill the specified purpose. Once the purpose is fulfilled, data must be deleted or anonymized.
Specifically:
Under UAE Federal Decree-Law No. 45 of 2021 (Personal Data Protection Law - PDPL), you have the following rights:
→Right to access personal data
→Right to correct or update inaccurate data
→Right to request deletion or erasure (Right to be Forgotten)
→Right to restrict processing
→Right to data portability
→Right to withdraw consent at any time
→Right to lodge a complaint with the UAE Data Office
→Right to clarity on data processing purposes
→Right to be informed about data breaches
To submit a data subject request (access, correction, deletion, or restriction), please contact us:
privacy@ordato.ae
Phone
+971-4-XXX-XXXX
Data Protection Officer
dpo@ordato.ae
We aim to respond to all requests within 30 days. We may request proof of identity to verify your request.
We implement industry-standard security measures including:
In the event of a data breach, we will notify affected data subjects and regulatory authorities as required by law, typically within 3 business days of discovery.
Data transfers outside the UAE are permitted only where the recipient country provides adequate protections equivalent to the UAE PDPL, or when explicit, documented consent is obtained from the data subject.
We do not sell or rent your personal data. We share data only with service providers under Data Processing Agreements that impose privacy and security obligations equivalent to this policy. Currently, data is processed by:
We may update this privacy policy to reflect changes in law, regulatory guidance, or our practices. Significant changes will be communicated via email or through notice on our platform. Your continued use of the service constitutes acceptance of the updated policy.
If you have concerns about your data or how we handle your privacy, our team is here to help.
Contact Our Privacy Team