Privacy Notice

Last updated: 1 August 2026

This notice explains how MT AI Systems LTD (“we”, “us”) handles personal data when you use OpenDish. We are the data controller for the information described below.

Who we are

MT AI Systems LTD, a company registered in England and Wales, company number 16910754. You can reach us at hello@opendish.co.uk.

Our role

OpenDish provides restaurants with their own ordering system. Two different relationships matter here:

• Restaurants that subscribe to OpenDish. We are the controller of their account data.
• Customers who order from a restaurant. The restaurant decides how that order data is used; we process it on the restaurant's behalf as a processor, under our agreement with them.

What we collect and why

Data	Purpose	Lawful basis
Restaurant account: business name, address, contact name, email, phone	Creating and running the account, support, billing	Performance of a contract
Staff accounts: name, role, contact details, sign-in credentials	Giving staff access to the parts of the panel their role allows	Performance of a contract
Order data: customer name, delivery address and postcode, contact details, order contents	Passing the order to the restaurant and enabling delivery	Performance of a contract (processed for the restaurant)
Courier location while a delivery is in progress	Showing delivery progress and confirming completion	Legitimate interests of the restaurant in fulfilling the order
Payment records (we do not store card numbers)	Taking subscription payments	Performance of a contract; legal obligation for accounting records
Technical logs: IP address, browser, error reports	Keeping the service secure and working	Legitimate interests in security and reliability

Who we share it with

We share personal data only with providers that help us run the service, and only as far as they need it:

• Hosting and database infrastructure, located in the United Kingdom or the European Economic Area
• Our payment processor, for subscription billing
• Email delivery, for account and order notifications

We may also disclose data where the law requires it. Where data is transferred outside the UK, we rely on adequacy regulations or the International Data Transfer Agreement.

How long we keep it

• Account data: while the account is open, then up to 12 months
• Order data: as instructed by the restaurant, and by default 24 months
• Courier location data: 30 days
• Accounting and tax records: 6 years, as required by HMRC

Your rights

Under the UK GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or transfer it elsewhere. You may also object to processing we carry out on the basis of legitimate interests. Write to hello@opendish.co.uk and we will respond within one month.

If you are a customer of a restaurant using OpenDish, please contact that restaurant first — it decides how your order data is used. We will help them respond.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk.

Cookies

We use cookies and similar storage that are strictly necessary to keep you signed in and to remember your preferences. We do not use advertising or third-party tracking cookies.

Security

Access to data is restricted by role, connections are encrypted in transit, and passwords and PINs are stored hashed. No system is perfectly secure, but we take these measures seriously and will notify the ICO and affected people where the law requires it.

Changes

If we change this notice we will update the date above and, where the change is significant, tell account holders directly.