Business Contact Data Notice

1. Who we are

Xorda Ltd, a company registered in England and Wales. Registered address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are registered with the Information Commissioner's Office as a data controller, registration number ZC181142.

Contact us about anything on this page at legal@xorda.co.uk.

2. Where we got your details

We did not obtain this information from you. We obtained it from:

• Google Places API — your business name, address, listed telephone number, website address, rating, review count and opening hours, as published on your Google Business Profile.
• Companies House — the public register: company number, registered name, status, SIC codes, and the name of a current director.
• Your own website — a single automated request to your homepage, to identify whether you already use an online ordering system.
• Telephone Preference Service / Corporate TPS — we submit your listed telephone number to a screening provider to check whether you have registered an objection to marketing calls.

We do not collect data from food delivery platforms, and we do not store the text of customer reviews about your business.

3. What we do with it

We use it to assess whether Xorda — a telephone ordering system for UK takeaways — is likely to be useful to your business, and to prepare for a conversation with you. A person reviews every business before any contact is made. We do not make automated decisions about you, and we do not profile you for any purpose other than deciding whether to approach you.

4. Our lawful basis

Legitimate interests (UK GDPR Article 6(1)(f)) — our interest in identifying businesses that may benefit from our product, balanced against your interests and rights. We have carried out and documented a Legitimate Interests Assessment, and we will provide it on request.

Separately, the Privacy and Electronic Communications Regulations govern how we may contact you. We do not send marketing email or text messages to sole traders or unincorporated partnerships without consent, and we do not make marketing calls to any number registered with the TPS or CTPS. We do not use automated calling systems at any time.

5. How long we keep it

• If we never contact you: deleted within 6 months.
• If we do contact you: deleted within 24 months of the last contact.
• Information obtained from Google is deleted or refreshed within 30 days.
• If you tell us not to contact you again, we keep the minimum needed to honour that — normally your business name, telephone number and website address — indefinitely. Keeping it is the only way to make sure we do not contact you again by mistake.

6. Who else sees it

Our hosting and database providers (Vercel and Supabase), our email provider (Resend), and our telephone preference screening provider, each acting on our instructions under contract. We do not sell your data, share it for anyone else's marketing, or transfer it outside the UK or EEA except under approved safeguards.

7. Your rights

You can ask us to give you a copy of what we hold, correct it, delete it, restrict what we do with it, or object to it. You have an absolute right to object to direct marketing — if you do, we will stop immediately and permanently, with no questions asked.

Email legal@xorda.co.uk and say “remove my business”. Include your business name and postcode so we can find the right record. We will action it within 5 working days and confirm when it is done. There is no charge, and you do not have to give a reason.

Note that some of this information — your company's entry on the Companies House register, and your Google Business Profile — is published by others, not by us. We can delete our copy, but we cannot remove it from those sources.

8. Complaints

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.