Privacy Policy

This policy explains what personal data Dishment collects through the dishment.com website and the Dishment service, why we collect it and how we protect it. "Dishment", "we" and "us" mean the company that operates the website and the service; its details are on the Contacts page.

1. Who is responsible

For the data you send us through the forms on the website — for example, a demo or trial request — Dishment is responsible as the operator.

For the data a restaurant enters into the service or that arises from its work (orders, staff, notes on checks), the restaurant is responsible. Dishment processes that data on the restaurant's behalf and on its instructions — see section 6.

2. What we collect on the website

When you fill in the form to request a demo or a free trial, we receive:

• your name;
• your phone number;
• your e-mail, if you give it;
• the name of your venue and the city;
• your message, if you write one;
• the page the form was sent from and the UTM tags of the link that brought you (for example, the name of an advertising campaign).

We do not ask for ID documents, card numbers or other sensitive data on the website — please do not put them in the message either.

Like any website, our server automatically records technical data in its logs: IP address, browser type, the page requested and the time. We use these logs only to keep the site running and protect it from attacks. To fight spam we keep a short one-way hash of the sender's IP address with a request, not the address itself.

3. Why we use it

• to contact you about your request: arrange a demo, open a trial, answer your questions;
• to understand which pages and campaigns bring requests, and improve the site;
• to keep the website secure.

As soon as a request arrives, a short notification with the form data goes to our sales team's Telegram chat so that we can call you back quickly. We do not use your contact details for unrelated mailings without your consent. By sending the form, you agree to your data being processed for these purposes.

4. Cookies and analytics

The website itself does not use advertising cookies. We may use web analytics services — Google Analytics and/or Yandex Metrica — to count visits and see how the site is used. When enabled, these services may set their own cookies and process data such as your IP address, device and the pages you view, under their own privacy policies. You can block or delete cookies in your browser settings, and the site will keep working.

To know how often blog articles are read, the website itself uses an anonymous counter without cookies: when an article has been open for a few seconds, the browser sends us only the article's number and language. So as not to count the same reader twice in a day, we make a short one-way fingerprint (hash) of the IP address, browser type and date with a secret key; it is kept for no more than 26 hours and changes every day, and the IP address itself is not stored. We keep only the number of reads of each article per day, and only the Dishment team sees these figures. If Do Not Track or Global Privacy Control is on in your browser, the read is not counted.

We may also keep small technical settings in your browser, such as the language you chose.

5. Who we share data with

We do not sell personal data and do not give it to third parties for their own marketing. Only the following may have access to it:

• Dishment employees who handle requests and support, within their duties;
• service providers that help run the website and the service (hosting and data storage, messaging — such as Telegram for notifications, analytics), only to the extent their task requires;
• public authorities, where the law of the Republic of Azerbaijan requires it.

Our servers and backups are in data centres in the European Union; Telegram and analytics services may also process data outside Azerbaijan. Data leaves the country only in the manner the Law "On personal data" allows, to countries with a reliable level of data protection. By sending the form, you also agree to this transfer.

6. Restaurant data in the service

Restaurants keep their menu, orders, payments, staff accounts and schedules in Dishment, and sometimes other details too (for example, a guest's name or phone number in an order note). The restaurant is responsible for this data; Dishment processes it only to provide the service, on the restaurant's instructions, and does not use it for its own purposes. If the restaurant switches on Theft and loss control, till operations (voids, discounts, refunds, cash differences) are also analysed per staff member, and suspicious cases are shown only to the people the restaurant authorises; the analysis makes no automatic decision about anyone — the restaurant decides. If the restaurant switches on Notifications, the messages it chooses (such as the day's totals or alerts) are delivered by Dishment's Telegram bot to the chats the restaurant connects; to do this, we store each chat's Telegram ID and name. A chat can be unlinked at any time by sending /stop to the bot. To improve the product, we may use aggregated statistics that do not identify any restaurant or person.

When a guest opens a restaurant's QR menu, we count opens, searches and dish views for that restaurant's statistics. These statistics are anonymous: the page keeps a random identifier on the phone, and we store no IP address, name or phone number.

If a restaurant switches on the «Delivery» module, we keep in its customer base the name, phone number, delivery addresses, notes and order history of the customers who order. This data is used only to take the order, deliver it and recognise the customer next time; in the restaurant only staff with the right to see customers can view it, and a courier sees only the address and phone of their own order. If the restaurant connects Google Maps, the address text typed in the address search is sent to Google. The data is kept while the subscription lasts; the restaurant can erase a customer's data in Back Office at any time — the name, phone and addresses are deleted, and the orders themselves stay in the reports without a name. A customer can ask the restaurant to erase their data.

When a guest orders on a restaurant's online ordering page or from the QR code on a table, we pass the order (dishes, name, phone, delivery address, note, payment method) to that restaurant. For online orders the phone and address are taken with the guest's consent and go into the customer base described above; at the table the name and phone are optional. The order's status is visible only through a secret link given to the guest, and the guest's phone keeps the links to their recent orders in its own browser. For limits against abuse we keep not the IP address itself but a short one-way fingerprint of it, for an hour at most.

If you work at or visit a restaurant and have a question about your data, please contact that restaurant first — we will help it answer.

7. How we protect data

• connections to the website, Back Office and the apps are encrypted (HTTPS);
• passwords are never stored in plain text, only as hashes;
• access to a restaurant's data is limited by roles and permissions, staff see only their own venues, and important actions are written to an audit log;
• the cloud database is backed up every night;
• the hub on the venue's computer keeps a working copy, so orders are not lost when the internet drops;
• only authorised Dishment employees who need it for their work have access to our systems.

No system is completely secure. If an incident affects your data, we will tell you and take steps to deal with its consequences.

8. How long we keep data

• Website requests — as long as we need them to work with you. If you do not become a client, we keep them no longer than 2 years after our last contact, or less if you ask us to delete them sooner.
• Server logs — for the limited time needed for security and troubleshooting.
• Restaurant data in the service — while the subscription is active. When it ends, the restaurant can ask support for an export of its data; the data is then deleted, and copies in backups disappear as the backups rotate.

9. Your rights

Under the Law of the Republic of Azerbaijan "On personal data", you have the right to:

• know whether we process your data, and see it;
• ask us to correct inaccurate or outdated data;
• ask us to delete your data or stop processing it;
• withdraw your consent;
• protect your rights in the manner set by law.

To use these rights, write to privacy@dishment.com. We will answer within the time the law requires.

10. Changes

We may update this policy. The current version is always on this page, with the date of the last update at the top. We tell clients about significant changes in advance by e-mail or through support.

11. Governing law

This policy is governed by the law of the Republic of Azerbaijan, including the Law "On personal data". If you have questions, write to privacy@dishment.com.