LEGAL INFORMATION

Privacy statement and terms of use for website visitors and online shop visitors, and the SaaS and data processing agreements (DPA) for shop operators

Website visitors → Users of the customer view of the online shop → Operators of an OIDO online shop →

Definitions

OIDO: OIDO order & pay systems, S.L. Technical service provider that rents out, updates and hosts the OIDO shop software.

Seller: business that offers its own goods or services through an OIDO online shop (shop operator). The seller is OIDO's contracting party under the SaaS licence agreement and the data processing agreement (DPA). In these two agreements the seller is called the "customer" or the "controller" respectively.

Shop customer: buyer of goods or services in the seller's online shop.

Stripe: payment service provider (Stripe Payments Europe, Limited, Ireland) for secure payment processing.

Visitor: visitor to this website.

Website visitors

OIDO order & pay systems, S.L. Avda. Comte Güell, 12, 08871 Sitges (Barcelona), Spain Commercial Register of Barcelona (Registro Mercantil de Barcelona), VOLUME 48456, FOLIO 123, SHEET B 584519, ENTRY 1. Tax ID (CIF) B72461288 · VAT ID ESB72461288 · DUNS: 471411102 Represented by the managing directors: Günter Beer, Manon Straver Phone: +34 616 340 840 · Email: oido@oido.me Single point of contact under the Digital Services Act (Regulation (EU) 2022/2065): oido@oido.me – Languages: German, English, Spanish

Privacy statement for website visitors

Controller: OIDO order & pay systems, S.L., Avda. Comte Güell, 12, 08871 Sitges (Barcelona), Spain, email: oido@oido.me.

This statement applies to visitors to this website, and to prospects and sellers when a contract with OIDO is initiated and performed. For data that OIDO processes on behalf of a seller in the seller's online shop, the "Privacy terms for customers of an OIDO online shop" and the DPA apply.

Principle: OIDO does not track individual visitors, does not sell data, does not use data for advertising and does not build profiles.

Hosting and server log files: the website is hosted by Digitalpress.blog on servers in the EU. When you visit, the server briefly processes technically necessary data (IP address, date and time, page requested, browser and device information). The legal basis is Art. 6(1)(f) GDPR (secure and stable operation).

Audience measurement with Plausible Analytics: we use Plausible Analytics (Plausible Insights OÜ, Estonia) on servers in the EU. According to the provider, the service works without cookies and without personal profiles. It records referral sources, pages viewed, visit duration, and device type, operating system, browser and country. The legal basis is Art. 6(1)(f) GDPR (understanding general usage trends).

Cookies and local storage: this website only uses technically necessary storage, for example the "dark mode" setting in your browser. This is permitted without consent (Art. 22(2) LSSI). No third-party cookies are set for advertising purposes.

Contact: when you contact us by email or phone, we process the data you provide in order to reply (Art. 6(1)(b) or (f) GDPR) and delete it once the matter is closed, unless statutory retention obligations apply.

Consultation appointment: to book a free consultation appointment we use Brevo Meetings (Brevo, formerly Sendinblue SAS, Paris, France). We process your name, email address, the chosen appointment and any information you provide voluntarily. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). A data processing agreement is in place with Brevo.

Trial, registration and contract performance (sellers): for the trial and the subscription we process name, company, address, tax/VAT number, email, billing data and account usage data. The purposes are contract performance, billing, support and legal obligations (Art. 6(1)(b) and (c) GDPR). Payments are processed through Stripe. Commercial and tax retention periods (in Spain generally 6 years) remain unaffected.

Links to social networks and external content: the links to Instagram, TikTok, LinkedIn, YouTube and Facebook are plain links. Data is only transmitted when you click the link; the privacy policy of the respective provider then applies. If YouTube videos are embedded, they are embedded in privacy-enhanced mode (youtube-nocookie.com) and only after you click.

Recipients and transfers to third countries: recipients are our service providers (hosting, Plausible, Brevo, Stripe) under the respective data processing agreement or payment processing, and authorities where legally required. Data is only transferred to third countries with appropriate safeguards (e.g. EU standard contractual clauses or the EU–US Data Privacy Framework).

Your rights: you have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), and the right to withdraw any consent given at any time. Please send your requests to oido@oido.me.

Right to lodge a complaint: you may lodge a complaint with a data protection supervisory authority, in particular with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), which is competent for OIDO, C/ Jorge Juan, 6, 28001 Madrid, www.aepd.es, or with the authority of your place of residence.

Last updated: 6 October 2026

Terms of use for website visitors

This website is the homepage of OIDO's software-as-a-service (SaaS) offering and is aimed at business customers.

All information has been compiled to the best of our knowledge and is continuously updated. The blog posts are market and background information and opinion pieces by their respective authors and do not replace legal or tax advice.

Image sources: we use photos from our own archive and royalty-free images from Unsplash.com.

All image compositions and content are protected by copyright and may not be reproduced or copied without express written permission.

© 2022–2026 OIDO order & pay systems, S.L.

OIDO® is a European Union trade mark registered with the European Union Intellectual Property Office (EUIPO) (No. 018623488).

Using the customer view of the shop app

Privacy terms for customers of an OIDO online shop

These standard privacy terms apply unless the seller has stored its own privacy terms in its shop.

Who is responsible? The controller for the processing of your data in the online shop is the seller you buy from. Its contact details are in the shop under "Contact". OIDO order & pay systems, S.L. (OIDO) operates the shop software as a technical service provider and processes your data exclusively on behalf of the seller. As a shop customer you do not enter into a business relationship with OIDO. OIDO does not use your data for its own purposes.

What data, for what purpose and on what basis? The shop can be used without registration. To process your order, the seller processes the data you provide, e.g. name, email address, phone number, delivery and billing address, products ordered, pick-up or delivery time. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). Invoicing and payment data are processed to comply with legal obligations (Art. 6(1)(c) GDPR). You only receive marketing emails if you consent (Art. 6(1)(a) GDPR); you can withdraw your consent at any time.

With registration: if you create a customer account, your data (e.g. email address, orders, addresses) is stored in Google Cloud's cloud infrastructure in Frankfurt am Main (Germany) and used for your convenience in this shop. Your data is not shared with other shops and is not analysed for advertising purposes or sold.

Recipients: your data is only received by bodies that are necessary for processing: OIDO and the service providers OIDO uses (Google Cloud for hosting, Brevo/Sendinblue for sending order and system emails), the payment service provider Stripe and, if the seller uses the marketplace function, the participating providers in your order, to the extent that they prepare or deliver the respective products.

Payment processing: for the payment, Stripe needs at least your payment details as well as your name and email address; depending on the country of origin of the payment method, further data may be required by law. Stripe processes this data in part as an independent controller. OIDO does not use the data collected by Stripe for its own purposes. Stripe's privacy terms: https://stripe.com/privacy.

Retention period: the seller stores your data as long as necessary for processing and thereafter as long as commercial and tax retention periods require (depending on the seller's registered office, several years, e.g. 8 or 10 years in Germany). Customer accounts remain until you delete them. If the seller terminates its contract with OIDO, OIDO returns the data to the seller within the periods set out in the data processing agreement and then deletes it.

Your rights: you have the right of access, rectification, erasure, restriction of processing, data portability and objection. Please contact the seller; OIDO supports the seller in handling your request. You may also lodge a complaint with the data protection supervisory authority responsible for the seller.

Changes and questions: OIDO may update these terms to comply with applicable regulations. If you have any questions, please contact the seller or oido@oido.me.

Terms of use for customers of an OIDO online shop

The seller is solely responsible for the content, offers and sale. The seller offers its products or services in its OIDO online shop on its own terms. The sales contract is concluded exclusively between you and the seller. The seller's contact details are in the shop at the bottom right under "Contact".

OIDO order & pay systems, S.L. processes business and transaction data on behalf of the seller as a technical service provider. As a shop customer you do not enter into a business relationship with OIDO.

In case of discrepancies, please contact the seller named on the receipt, invoice or order confirmation.

Reporting illegal content (Digital Services Act): if you find content in an OIDO online shop that you consider illegal, you can report it to oido@oido.me. Please state: (1) the exact internet address (URL) of the content, (2) the reasons why you consider the content illegal, (3) your name and email address, and (4) a statement that the information you provide is, to the best of your knowledge, accurate and complete. OIDO will acknowledge receipt, examine the report carefully and inform you and the seller concerned of the decision and of the options for challenging it.

Right of withdrawal

For consumers: if you buy as a consumer in a seller's online shop, you generally have a right of withdrawal of 14 days without giving any reason for distance contracts. For goods, the period starts when you receive the goods. You can declare your withdrawal with one click using the withdrawal function in your order confirmation, invoice or receipt, or inform the seller of your decision in an unambiguous way. The seller's withdrawal information is decisive.

There is no right of withdrawal, in particular (depending on the seller's offer), for:

  • goods that are liable to deteriorate or expire quickly (e.g. fresh fruit and vegetables such as carrots, dairy products, fish and fresh meat, fresh baked goods, prepared meals);
  • goods made to your specifications or clearly personalised (e.g. a cake with a custom inscription);
  • sealed goods that are not suitable for return for reasons of health protection or hygiene, if the seal was broken after delivery;
  • the delivery of food and drinks where a specific date or period has been agreed for it (e.g. pick-up or delivery at the chosen time).

Long-life food and drinks are not excluded across the board; a right of withdrawal may exist as long as none of the exclusions above applies.

For businesses: there is no statutory right of withdrawal.

Note for the seller: this text is general information and does not replace the withdrawal information that the seller must provide to its consumers itself.

Changes and questions

We may update this policy where necessary to comply with applicable regulations and to reflect new practices. Please contact us if you have any questions, comments or concerns about this privacy policy, your data or your rights in relation to your information.

Core agreements for sellers (shop operators)

Here you will find the agreements for the cooperation between the seller and OIDO. The main agreement is the SaaS licence agreement; data protection matters are governed by the data processing agreement (DPA). To operate your OIDO online shop you must agree to both agreements.

SaaS / licence agreement – EN

SaaS service and licence agreement between OIDO order & pay systems s.l. (provider) and the owner of the online shop (customer).

1. Parties, subject matter and services

This agreement is concluded between OIDO order & pay systems, S.L., NIF B72461288, Avda. Comte Güell, 12, 08871 Sitges (Barcelona), Spain ("provider") and [customer name], [address], [NIF/VAT ID] ("customer"). The offer is aimed exclusively at businesses and professionals.

Subject matter: making the cloud-based online shop software OIDO online shop available on a subscription basis as software as a service (SaaS) for use over the internet. The customer uses it to operate its own online shop and sells exclusively its own goods and services to its own customers through it. The provider does not operate a marketplace. If the customer uses the marketplace function to set up a joint offer of several providers in its shop, the customer is solely responsible for its contracts with the participating providers and for its own tax obligations.

Scope of services: the provider makes the software available to the customer in its current version, with the functions described in the chosen package (including shop, order management, invoicing, customer management and statistics). Hosting and operation take place in the Google Cloud infrastructure (Frankfurt am Main data centre). Onboarding by the provider is free of charge; the additional set-up service (Shopbuild) is only provided on separate order in accordance with clause 3.

Contract documents: (1) this agreement, (2) the service description/price list of the chosen package and (3) the data processing agreement (DPA) with its annexes. In the event of conflict they apply in this order; on data protection matters the DPA prevails.

2. Right of use and customer obligations

Right of use: the provider grants the customer, for the term of the agreement, a non-exclusive, non-transferable and non-sublicensable right to use the software to the agreed extent for the operation of its own online shop. There is no right to the source code.

Customer obligations:

  1. Keep its access credentials secret and protect them from third parties; inform the provider immediately if misuse is suspected.
  2. Use the software in accordance with applicable law and not publish unlawful content or products.
  3. Be responsible for the accuracy of its shop, product, price and tax data. As seller, the customer remains responsible for complying with its commercial, tax, consumer and food law obligations (e.g. legal notice, pre-contractual information, price indication, allergens) and for the tax accuracy of the invoices issued through the software.
  4. Comply with its own statutory retention obligations (Art. 30 Commercial Code, General Tax Law) and secure a copy of its data in good time before the agreement ends (see clause 4).
  5. Not copy or reverse engineer the software, not make it available to third parties outside its business, and not take any action that affects the stability or security of the platform.

In the event of culpable breach of these obligations, the provider may temporarily block access to the extent necessary to prevent damage, informing the customer immediately.

3. Price, payment and onboarding service

Recurring price: when ordering, the customer chooses one of the subscriptions offered. Prices are those of the price list in force at the time of the order, available at https://www.myownshopoido.com/pricing/ (always plus statutory VAT). The Mini, Small and Medium subscriptions include all functions of the OIDO online shop and differ in the number of orders (transactions) processed per month: Mini 50, Small 250, Medium 1,000. Unused quota is not carried over to following months and expires at the end of the month. If the customer exceeds the quota of its subscription, the provider will inform the customer. In the event of considerable or repeated overuse, the provider may suspend the ability to place orders after a prior warning. If the customer upgrades to a higher subscription, it is activated immediately. There is no right to have orders processed above the quota; temporary toleration of an overuse does not create such a right. The Catalog subscription serves exclusively to present the catalogue as an online menu or product catalogue, without the possibility of ordering. The customer may choose between monthly or annual payment; the price is due in advance for the chosen period and is collected through the payment provider Stripe by credit card or SEPA direct debit. Setting up and testing the shop are free of charge; the payment obligation begins with the activation of the paid subscription. Invoices are made available electronically.

Onboarding: the basic set-up of the shop is free of charge. The optional Shopbuild service (creation of the shop and entry of products by the provider) is only provided at the customer's request, for the one-off price stated in the order of €300 plus VAT, payable when ordered.

Late payment: in the event of non-payment, the provider may block access after a prior reminder with a reasonable deadline (at least 14 days); the payment obligation remains. Statutory default interest and costs are reserved. If payment is still not made after the deadline set in the reminder has expired, the provider may terminate the agreement for cause in writing; non-payment alone does not constitute termination. When the termination takes effect, the period for providing the data export under clause 6 of the DPA begins. The export is not made conditional on payment of outstanding amounts. Before the final deletion of the data, the provider will notify the customer once more in writing.

Price changes: the provider may change the price with at least 30 days' written notice. In that case the customer may terminate the agreement with effect from the date the change takes effect. If the customer does not do so, the change is deemed accepted.

4. Term, cancellation and data export at the end of the agreement

Term and cancellation: the agreement begins with the order and the activation of access and is concluded for an indefinite period. The possibility of cancellation depends on the chosen payment interval: with monthly payment, either party may cancel the agreement with effect from the end of the current billing month; with annual payment, with effect from the end of the current billing year. Cancellation may be given in writing or through the function provided in the customer account. The right to terminate for good cause remains unaffected.

Data export at the end of the agreement: the customer may export its data (shop data, orders, customers and tax-relevant invoices) in a machine-readable format before and after the end of the agreement. The details, in particular the periods for providing the export, the transition period and the subsequent irreversible deletion, are set out in clause 6 of the DPA. The customer remains solely responsible for complying with its statutory retention obligations after the end of the agreement as well.

Effects of termination: when the agreement ends, the right of use expires, the shop is deactivated and access is blocked. The price already paid for the current billing period is not refunded pro rata, unless the cancellation is based on good cause attributable to the provider.

5. Availability, support, data protection and payments with Stripe

Availability: the provider guarantees an availability of the software of 98% on a monthly average. Excluded are scheduled maintenance work (preferably outside normal business hours and with reasonable advance notice) and interruptions outside the provider's sphere of control (e.g. failures of third parties or force majeure).

Support and development: the provider offers support by email, video consultation or help centre on working days during normal business hours. It may further develop the software and change functions, provided that the essential agreed scope is maintained. Changes in legal requirements may exceptionally require changes to the essential scope; the provider will inform the customer in writing and, where possible, in advance.

Data protection: to the extent that the provider processes personal data on behalf of the customer, the data processing agreement (DPA) applies, which forms part of this agreement. The customer remains the controller within the meaning of the GDPR for the data of its shop customers.

Payments with Stripe: payments from the customer's end customers are processed through Stripe Connect. For this purpose the customer concludes its own contract with Stripe (Stripe Connected Account Agreement) and receives the payments directly in its Stripe account. The provider is not a payment service provider or a party to the payment processing and is not liable for services, disruptions or decisions of Stripe (e.g. account blocks or fees). The customer is responsible for complying with Stripe's terms.

6. Liability, confidentiality and final provisions

Liability: the provider is liable without limitation in cases of wilful misconduct or gross negligence, for injury to life, body or health, and under mandatory statutory provisions. In the case of slight negligence in breaching essential contractual obligations, liability is limited to the foreseeable damage typical for this type of contract, up to a maximum of the price paid in the last 12 months. Otherwise, liability for slight negligence is excluded. The provider is liable for loss of profit and indirect damages only in accordance with this provision. The customer shares responsibility for backing up its data through regular exports.

Confidentiality: both parties will treat the other party's confidential information that they become aware of in the course of this agreement as strictly confidential and use it only to perform the agreement. This obligation continues after the end of the agreement.

Final provisions: amendments and additions must be made in writing. If any provision is invalid, the agreement remains valid in all other respects and the invalid provision will be replaced by a valid one that comes closest to its economic purpose. This agreement is governed by Spanish law. The competent courts are those of the provider's registered office, to the extent permitted by law. The DPA forms an integral part of this agreement.

Data Processing Agreement (DPA)

Data processing agreement under Art. 28 GDPR and the LOPDGDD between the owner of the online shop (controller) and the SaaS provider OIDO order & pay systems s.l. (processor).

1. Parties, subject matter and term

This data processing agreement governs the rights and obligations of [name of the online shop owner], [address] ("controller") and OIDO order & pay systems s.l., CIF B72461288, Avda. Comte Güell, 12, 08871 Sitges (Barcelona), Spain ("processor") in connection with the processing of personal data arising from the use of the e-commerce platform OIDO online shop. It specifies the obligations under Art. 28 GDPR and the LOPDGDD, and forms part of the main agreement (SaaS/licence agreement dated [date]).

Subject matter: hosting, operation and storage of the controller's shop, order, payment and customer data on the processor's SaaS platform, including the recording of financial data relevant for accounting and tax purposes (invoices, payment receipts, order histories).

Term: this agreement has the same term as the main agreement. For data subject to statutory retention obligations (Art. 30 Commercial Code, General Tax Law), the provisions of clause 6 (return/deletion of data) remain in force after the main agreement ends.

2. Nature, purpose, data subjects and data

Purpose: provision and operation of the online shop software as SaaS, including payment processing, order management, invoicing and archiving with evidentiary value.

Categories of data subjects Categories of data
Customers of the online shop Name, address, email, phone, payment data, order history
Employees of the controller Access credentials, login records
Contacts at payment service providers Transaction IDs, payment status

Financial data (invoices, payment receipts, order confirmations) are also processed and retained for the controller's commercial and tax purposes (Art. 30 Commercial Code, General Tax Law).

3. Obligations of the processor (Art. 28(3) GDPR)

The processor undertakes to:

  1. Process the data only on documented instructions from the controller (Art. 28(3)(a)), including transfers to third countries.
  2. Ensure that persons authorised to process the data have committed themselves to confidentiality (Art. 28(3)(b)).
  3. Take all technical and organisational measures required by Art. 32 GDPR, in particular: encryption, access control, activity logging, immutability of tax-relevant data, system documentation and regular backups (Art. 28(3)(c)). Details in Annex 1 – Technical and organisational measures.
  4. Respect the conditions for engaging other processors under clause 4 (Art. 28(3)(d)).
  5. Assist the controller, by appropriate technical and organisational measures, in fulfilling its obligation to respond to requests to exercise data subjects' rights (Art. 28(3)(e)).
  6. Assist the controller in ensuring compliance with the obligations under Arts. 32 to 36 GDPR (Art. 28(3)(f)).
  7. At the choice of the controller, delete or return all data after the end of the provision of the services, unless there is a legal retention obligation (Art. 28(3)(g), see clause 6).
  8. Make available to the controller all information necessary to demonstrate compliance with these obligations and allow audits (Art. 28(3)(h), see clause 5).

4. Subprocessors, data location and international transfers

Subprocessors: the processor may only engage other processors (e.g. hosting, payment gateways, backup providers) with the prior general or specific authorisation of the controller. The current subprocessors are listed in Annex 2; any change will be notified in advance with reasonable notice (at least 30 days), and the controller may object.

Data location: processing takes place in data centres located within the European Union / European Economic Area (EU/EEA). The specific locations are set out in Annex 2. The data does not have to be stored in Spain.

A transfer to a third country outside the EU/EEA requires the prior consent of the controller and requires (a) appropriate safeguards under Art. 44 et seq. GDPR (e.g. standard contractual clauses) and (b) that electronic access by the tax authorities to the data is guaranteed at all times.

The processor in any case guarantees that tax-relevant data will remain unaltered, complete and available for the applicable statutory retention period (generally 6 years under Art. 30 of the Commercial Code).

5. Audit rights, assistance and notification of data breaches

Audit rights: the controller may verify compliance with this agreement before the start of the service and thereafter at reasonable intervals, for example by requesting audit reports or on-site audits with reasonable prior notice (at least 14 days), at its own expense.

Assistance: the processor will assist the controller in handling requests from data subjects (access, rectification, erasure, portability), as well as in impact assessments and prior consultations with the supervisory authority.

Notification of data breaches: the processor will notify the controller of any personal data breach without undue delay and in any event within 24 hours of becoming aware of it, providing all the information necessary for the notification under Art. 33 GDPR.

6. Return/deletion of data, liability and final provisions

At the end of the main agreement, the processor will make available to the controller, within 30 days, a complete and machine-readable export of all data (including tax-relevant receipts and the system documentation).

For data subject to statutory retention periods (Art. 30 Commercial Code: 6 years; General Tax Law: 4 years), the processor, at the controller's choice, will either (a) continue to retain them for an additional transition period of 90 days, remunerated separately, to allow their retrieval, or (b) delete them immediately after the export. After the agreed transition period has expired, all data will be irreversibly deleted, unless a legal obligation provides otherwise. The responsibility for ensuring compliance with its own retention obligations lies with the controller.

Liability: the liability regime of Art. 82 GDPR applies; as between the parties, each party is liable for the damage it has caused.

Final provisions: amendments must be made in writing. This agreement is governed by Spanish law. The competent courts are those of the processor's registered office, to the extent permitted by law. Annexes 1 (technical and organisational measures) and 2 (subprocessors) form an integral part of this agreement.

Annex 1 – Technical and organisational measures (Art. 32 GDPR)

The following measures are example wordings that the processor must adapt to the actual state of its systems before signature; measures that are not implemented must be removed and the data in square brackets completed.

  • Physical access control: data centre in Frankfurt am Main, operated by Google Cloud, with access control, visitor log and video surveillance (responsibility of the data centre operator); the processor operates as a virtual organisation and has no offices or server rooms of its own.
  • Logical access control: individual user accounts, Firebase Authentication, strong password policy, two-factor authentication for administrators and Google Cloud accounts, lockout after failed attempts; personal data is processed exclusively in Google Cloud's cloud infrastructure and is not stored at local sites. Staff access is remote via VPN; all work devices are protected with biometric authentication and a password.
  • Data access control: role and permission model based on the need-to-know principle (Google Cloud IAM, Firebase security rules), logging of administrator access (audit logs), regular review of permissions.
  • Separation: logical separation of the data of each shop owner (multi-tenancy); separation of development, test and production environments.
  • Encryption / pseudonymisation: TLS encryption in transit; encryption of stored data and backups; pseudonymisation in support access where possible.
  • Transmission control: encrypted interfaces (API/HTTPS), documentation of recipients and transmission paths, no disclosure without instruction from the controller.
  • Input control / immutability: logging of creation, modification and deletion of data; immutable archiving of tax-relevant receipts and procedure documentation.
  • Availability and resilience: regular backups [method, frequency, retention period], restore tests, redundant Google Cloud infrastructure, contingency and recovery plan, monitoring and patch management.
  • Order control: careful selection and verification of subprocessors (Annex 2), contracts under Art. 28 GDPR, confidentiality undertaking and data protection training of staff.
  • Deletion and return: documented deletion policy with time limits, secure deletion of data, data export at the end of the agreement in accordance with clause 6.
  • Review and evaluation: review of the effectiveness of the measures at least once a year, incident response procedure with notification in accordance with clause 5; the processor currently holds no certifications of its own (e.g. ISO 27001) and relies for the infrastructure on Google Cloud's certifications and audit reports.

Annex 2 – Service providers (authorised subprocessors)

To run OIDO we use the service providers listed below. They process personal data only on our behalf and on our instructions, under a data processing agreement (Art. 28 GDPR). Where data is processed outside the EU/EEA, the transfer is based on the EU–US Data Privacy Framework or on the European Commission's standard contractual clauses.

If you use OIDO for your business, these providers also process the data of your guests that we process on your behalf.

Google Cloud EMEA Limited (Google Firebase and Google Cloud), Ireland

  • Purpose: hosting of the OIDO apps and of your shop, database, login, file storage, server functions, logs and backups, push notifications to the dashboard app.
  • Data: all data processed in OIDO. This includes account data, your shop's content, orders with your guests' names, contact and delivery details, invoices, IP addresses and device identifiers.
  • Location: EU: the database in Belgium and the Netherlands, server functions and their logs in Belgium, files and backups in data centres within the EU. Logins (email address and password) are processed by Google LLC in the USA; content delivery and push notifications use Google's data centres worldwide. Push notifications carry only the device identifier and a general text such as "New order".

Stripe Payments Europe, Limited, Ireland

  • Purpose: payment of your guests' orders into your own Stripe account, refunds and saved cards; billing of your OIDO subscription; setting up your Stripe account.
  • Data: your guests' email address, name, billing and payment details, order items and amounts; your billing details. Card details are entered directly at Stripe and never reach OIDO.
  • Location: EU, with transfers to Stripe, Inc., USA. For some purposes, such as fraud prevention, Stripe acts as an independent controller (see Stripe's privacy policy).

Sendinblue SAS (Brevo), France

  • Purpose: sending emails: verification, password and welcome emails, order confirmations and status updates, receipts and invoices.
  • Data: recipients' email addresses and names, and the content of the emails, including order details and attached receipts and invoices.
  • Location: EU.

IONOS SE, Germany

  • Purpose: storing the tamper-proof change log of your tax-relevant records (orders, invoices, payments, products and settings), which tax law requires to be kept unalterable.
  • Data: every version of these records, with who made each change. Your guests' email address, phone number, delivery address and notes are removed before anything is stored. Their name and billing address stay, because an invoice needs them.
  • Location: EU (Germany: Frankfurt and Berlin).

Apple Distribution International Ltd., Ireland

  • Purpose: delivering push notifications to the OIDO dashboard app on iPhone and iPad (Apple Push Notification service).
  • Data: the device identifier and the text of the notification, a general text such as "New order" without personal data.
  • Location: EU and USA.

Digital shift OÜ (Capgo), Estonia

  • Purpose: updates of the OIDO dashboard app for iOS and Android.
  • Data: a random device identifier, the app and operating system version, IP address. No account data.
  • Location: EU.

Plausible Insights OÜ, Estonia

  • Purpose: anonymous usage statistics of our website and of the OIDO apps on www.oido.me, without cookies.
  • Data: IP address and browser information. These are used only to compute anonymous statistics and are not stored.
  • Location: EU (Germany).

Anthropic PBC, USA

  • Purpose: automatic translation of your shop's content, if you turn it on, with the AI model Claude; and, when our team creates your menu from your existing website at your request, analysing that website's content. Anthropic does not use this data to train its models.
  • Data: the texts to be translated (names and descriptions of products, categories and options, notices, the texts of your pages and stories) and, for the menu import, the publicly available content of your website. They may include names, addresses and phone numbers, for example from your legal notice or your pages.
  • Location: USA.

We update this list whenever we add or replace a service provider.