Scanord

Privacy Policy

Updated 10 October 2026 · Shqip

Who we are

Scanord is a QR-code and online ordering platform for cafés, restaurants and hotels. Scanord is operated by RORKOS SHPK, unique identification number (NUI) 812067876, Kosovo. Contact: info@scanord.biz · +383 49 404 274.

This policy covers scanord.biz, the ordering pages opened by scanning a venue's QR code or its delivery link, and the Scanord Android app, which venue owners and staff use to manage orders.

For customer and venue accounts, Scanord is the controller. An order's details also go to the venue you ordered from, which uses them to prepare and deliver the order and keeps them as part of its sales records; for that data Scanord acts on the venue's behalf.

What we collect

You don't need an account to order at a table or in a room. An account (Google or Facebook) is required only for delivery orders.

Orders: the items, quantities, instructions you write for them (e.g. "no ketchup"), notes, the table or room, the time, the order status, the language you chose and the messages you write to the ordering assistant.
Customer payments: the payment method (cash or charge to room), the currency and, if you enter it, the amount you will pay with. Scanord does not take card payments from customers and never sees or stores card details.
Hotel guests: the name the room is registered under, when you charge an order to your room.
Customer account (Google or Facebook login): your name, email address and your Google or Facebook account identifier. We do not receive your password, friends, posts or any other profile data, and we never post anything on your behalf.
Deliveries: your name, phone number and delivery address, and the messages you exchange with the venue. Your last phone number is saved to your account, and the venue keeps your last number and address, so you aren't asked again.
Venue owners and staff: name, email, password (stored only as a hash), role, who collected a payment, and business details (name, address, tax number, logo, menu and the menu photos you upload). Subscription payments are made on Raiffeisen Bank's payment page; we never see or store card details.
Contact form: name, email, phone, business name and message. They are emailed to us and not stored on the platform.
Technical data: cookies that keep you signed in and hold your cart, a cookie that recognises your device for previous deliveries from the same venue, your device's registration for notifications (in the app or the browser, if you turn them on), and server logs (e.g. IP address and browser) for security and troubleshooting.
Visit statistics: only on the public pages (this page, the home page, signup, contact) and only if you accept cookies, through Google Analytics. The ordering pages and the staff app have none.

We do not collect your location, phone contacts or photos from your device, other than files you choose to upload.

Why we use it

to receive, prepare and deliver your order and show you its status — because you asked us to (contract);
to understand your messages and turn them into an order, and to translate the menu and your instructions for staff — contract;
to recognise you next time (your last name, phone and address are filled in) and to show the venue that the order comes from a verified account — contract;
for venue accounts, subscriptions and billing, and to notify staff of new orders — contract and legal (tax) obligations;
for platform security, abuse prevention and fixing errors — legitimate interest;
to understand how the public pages are used — your consent, which you can withdraw at any time.

The legal bases are those of Law No. 06/L-082 on the Protection of Personal Data (Kosovo), Law No. 124/2024 "On the protection of personal data" (Albania) and, for visitors from the EU, the General Data Protection Regulation (GDPR). We do not sell your data, do not use it for advertising and do not make automated decisions with legal effects on you.

Who we share it with

The venue you order from — the order and, for delivery, your name, phone and address.
Google and Facebook — only for login, when you choose one of them.
Anthropic (USA) — processes the messages you write to the ordering assistant, translates the menu and your instructions so staff can read them in their own language, and reads the menu photos an owner uploads.
DigitalOcean — where the data is stored and the app runs.
AppSignal — error and performance monitoring. It receives only technical data (which page or job failed and why), not your messages, addresses or order details.
Raiffeisen Bank (RaiAccept) — venue subscription payments.
SiteGround — sending email (account confirmation, contact messages).
Google (Analytics, Firebase Cloud Messaging and Google Play) — visit statistics with your consent, notifications in the staff app, and distribution of the app.
Authorities — only when the law requires it.

These providers use the data only to provide their service to us. If Scanord is sold or merged with another company, the data passes to the new owner under this policy and we will tell you in advance.

The Android app

The Scanord Android app is for venue owners and staff. It requests:

Notifications — to alert staff to new orders. Optional, but without it staff may miss orders.
Internet — to receive orders and updates in real time.

You can change permissions at any time in Android's settings.

How long we keep it

Customer accounts — until you delete them.
Orders, their messages and deliveries — they are the venue's sales records and are kept as long as the venue needs them and tax law requires, even after you delete your account, but no longer linked to it.
Venue and staff accounts — while the account is active; invoices as long as tax law requires.
Menu photos — deleted once the menu is imported, or after 7 days at the latest.
Staff notification history — 30 days.

Security and transfers

Data is encrypted in transit (HTTPS), passwords are stored only as hashes, each venue's data is kept separate from every other venue's, and staff access is limited by role. No system is completely secure; in the event of a data breach we notify the competent authority within 72 hours, and you when the breach poses a high risk to you.

Some of the providers above process data outside Kosovo and Albania, including in the European Union and the United States. For transfers outside the EU we rely on standard contractual clauses and the other safeguards the law requires.

Your rights

You can ask to access, correct, delete or receive a copy of your data, to restrict or object to its use, and withdraw consent at any time, by writing to info@scanord.biz. We reply within 30 days. If a request concerns an order, we may also pass it on to the venue.

If you believe your data is not being handled properly, you can complain to a data protection authority: in Kosovo, the Information and Privacy Agency (AIP); in Albania, the Commissioner for the Right to Information and Personal Data Protection (IDP); in the EU, the authority in your country.

Deleting your data

To delete your customer account:

Sign in with the same Google or Facebook account, open this page and press "Delete my account"; or
email us from the same address at info@scanord.biz with the subject "Data deletion". We delete it within 30 days and let you know.

You can also remove Scanord from your connected apps on Facebook (Settings → Apps and websites) or Google (Account → Security → Third-party apps with account access).

Venue or staff accounts (including the one you use in the Android app): email us from the account's address at info@scanord.biz with the subject "Account deletion". We delete it within 30 days, except what the law requires us to keep (e.g. invoices). An owner can also remove a staff member themselves from the dashboard's user list.

Customers without an account who want an order's data deleted: email us with the venue's name and the approximate date and time of the order.

Children

The platform is not directed at children under 16 and does not knowingly collect their data.

Changes

When this policy changes, the date above is updated. We announce significant changes on this page and by email to venue owners. If the Albanian and English versions differ, the Albanian version prevails.