Privacy Policy.

Effective date: 6 November 2026 · Version 2026-11-06-v2

This Policy explains how personal data is handled when you visit Ordna, create a retailer account, use a retailer shop or place an order through a shop powered by Ordna.

1. Who is responsible for your data?

Ordna is operated by Richard Agius, trading as ordna. ("the Operator", "we", "us"). Ordna is currently operated by the Operator personally and is not a separate limited liability company. Business address: Bullara Court, Block B, Flat 1, Triq Guzeppi Bajada, Xaghra, Gozo, XRA 1661, Malta. VAT registration number: MT24705317. Contact us at info@fortycreative.com for privacy questions or requests.

For account, platform operation, security, billing and website administration data, the Operator generally acts as a controller. A retailer is generally the controller for personal data it collects from its customers through its Ordna shop. When the Operator hosts and processes customer order information on that retailer's documented instructions, the Operator acts as the retailer's processor. Contact the retailer directly about its own use of your order information; we can help route a request where appropriate.

2. Personal data we may process

• Retailer account data: name, email address, authentication identifiers, business name, role and account settings.
• Shop and order data: customer name, contact details, delivery or collection address, items ordered, quantities, product options, order notes, order status and relevant transaction references.
• Retailer business data: shop details, staff access, product catalogue, prices, opening hours, delivery settings and payment-provider connection status.
• Technical and security data: device and browser information, IP address, access logs, diagnostic events and information needed to investigate abuse or protect the service.
• Support and communications: messages, requests, feedback and records of our responses.
• Subscription and billing data: plan, subscription status, billing dates and payment-provider identifiers. Card details are handled by the relevant payment provider; Ordna is not designed to store full payment-card numbers or security codes.

Retailers should not ask customers to put passwords, full payment-card details or unnecessary sensitive information in order notes or other free-text fields.

3. Why we use personal data and our legal bases

• Provide Ordna and process orders: to create accounts, operate shops, transmit order requests, manage retailer workspaces and provide customer support. The legal basis is performance of a contract or steps requested before entering a contract; for retailer customer orders, the retailer determines its own legal basis.
• Subscriptions and accounting: to manage plans, recurring subscription billing, invoices, payment status and financial records. The legal bases are contract and compliance with legal obligations.
• Security and fraud prevention: to authenticate users, protect accounts, detect misuse, investigate incidents and maintain platform integrity. The legal basis is our legitimate interests in operating a secure service, balanced against individuals' rights.
• Service communications: to send essential account, order-system, security and service notices. The legal basis is contract, legal obligation or legitimate interests depending on the communication.
• Marketing: we will use personal data for direct marketing only where we have a valid legal basis and provide any required opt-out or consent choices.
• Legal claims and compliance: to meet legal requirements, respond to lawful requests and establish, exercise or defend legal claims. The legal basis is legal obligation or legitimate interests.

4. Who may receive personal data?

We share personal data only where needed to provide Ordna, fulfil the purposes described in this Policy, meet legal obligations or protect the platform, and subject to appropriate safeguards. The services currently integrated into Ordna include:

• Vercel: application hosting and delivery of the Ordna website and application.
• Supabase: database hosting, user authentication and file storage used by the platform.
• Stripe: subscription billing paid by Ordna retailers and, where a retailer connects Stripe, payment processing for that retailer's customer orders.
• PayPal: retailer account onboarding and, where a retailer enables PayPal, payment processing for that retailer's customer orders.
• OpenStreetMap tile services: map tiles displayed in delivery-location and delivery-zone maps. When a map is displayed, the map provider may receive technical connection data such as an IP address and browser information.
• the retailer operating the shop through which an order is placed, and its authorised staff;
• professional advisers, auditors, insurers and public authorities where necessary and lawful; and
• a successor organisation in connection with a genuine business reorganisation, merger or transfer, subject to applicable law.

Ordna uses Stripe for its own subscription charges; retailer customer payments are processed for the retailer through the retailer's connected payment account. Ordna does not receive or hold retailer sales proceeds as merchant of record. The providers above may act as processors for some activities and as independent controllers for others, such as their own legal, security, fraud-prevention and regulatory obligations. Their own privacy notices and terms apply to those independent activities.

5. International transfers

Where personal data is transferred outside the European Economic Area, we will use a lawful transfer mechanism under GDPR Chapter V, such as an adequacy decision or appropriate safeguards including Standard Contractual Clauses, where required. You may contact us for information about safeguards relevant to a particular transfer.

6. How long we keep data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including to provide the service, maintain account records, resolve disputes, protect the platform and meet legal obligations. Retention periods vary by data type and context. Order and accounting records may need to be retained for statutory periods; security logs are retained for operational and security needs; support records are retained while needed to resolve the request and maintain an appropriate history. When data is no longer needed, we delete or anonymise it. Protected backup copies may remain until overwritten in the normal backup cycle.

7. Your data protection rights

Subject to the conditions and exceptions in applicable law, you may have the right to request access, rectification, erasure, restriction of processing, data portability, or to object to processing based on legitimate interests. Where processing relies on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You also have the right to lodge a complaint with the supervisory authority.

To exercise a right in relation to data for which the Operator is controller, email info@fortycreative.com. We may need to verify your identity and will respond within the period required by law. If your request concerns an order placed with a retailer, please contact that retailer first because it is generally the controller for that order data.

In Malta, the supervisory authority is the Information and Data Protection Commissioner (IDPC): idpc.org.mt.

8. Security

We use technical and organisational measures designed to protect personal data, including access controls, authentication, secure transmission, role-based permissions and operational safeguards. No online service can be guaranteed to be completely secure. We investigate suspected incidents and take steps required by applicable law. Where we act as a processor, we notify the relevant retailer-controller without undue delay of a personal-data breach affecting data processed on its behalf.

9. Children

Ordna is a business ordering platform and is not designed to target children. Retailers must not knowingly collect children's personal data unless they have a lawful basis and meet any additional requirements that apply.

10. Cookies and similar technologies

Ordna may use technologies that are strictly necessary to provide core functions such as secure sessions, authentication and platform security. Any non-essential analytics, advertising or preference technologies must be disclosed and, where required, activated only after valid consent. See our Cookie Policy for further information.

11. Changes to this Policy

We may update this Policy to reflect changes in Ordna, our providers or applicable law. The current version and effective date will be published on this page. Where a change requires notice or renewed consent, we will take the steps required by law.

12. Contact

For privacy questions or requests, contact info@fortycreative.com. Please do not email passwords, payment-card details or other unnecessary sensitive information.