Privacy Policy — Poruči PRO Order

Last updated: 22 September 2026

This policy explains how the Poruči PRO Order app (Android, iOS and Windows) processes personal data. The app is used by the staff of restaurants and other food businesses that take orders through the poruci.pro platform.

1. Who we are

The app is developed and operated by NKM SOFT (registration no. 63415642, tax ID (PIB) 108384996), Lole Ribara 55, 11317 Lozovik, Serbia (email: info@poruci.pro, phone: +381 65 888 71 61).

A restaurant using the poruci.pro platform is the controller of the data about its guests and its staff. NKM SOFT processes that data on the restaurant's behalf, as a processor, under its agreement with the restaurant. For data we process to run and secure the service itself (such as technical logs and notification tokens), NKM SOFT is the controller.

2. Data we process

Staff account

First and last name, email address, role, and the venues the staff member can access. Accounts are created by the restaurant; the app does not let anyone sign up on their own. Passwords are stored on the server only in hashed form. After sign-in, the access token is stored encrypted on the device.

Orders

Guest name, phone number, delivery address, notes for the kitchen and the driver (including allergy notes, if the guest enters them), items, amounts, payment method, order time and status changes. This data is entered by guests on the restaurant's website, or by staff when taking an order over the phone. The app displays, edits and prints it solely to prepare and deliver the order. We also record which staff member changed an order's status (an activity log).

Device

The notification token (Firebase Cloud Messaging), the platform (Android or iOS), the venue and account the device is signed in to, and when the device last checked in.

Technical logs

IP address, time and type of requests to the server, for security and troubleshooting.

Settings on the device

Language, theme, sound, screen layout, the selected printer (the printer's name and Bluetooth address) and similar settings are stored only on the device and are not sent to our server.

The app does not collect location, contacts, photos, audio or the device's advertising ID. It shows no ads and uses no analytics or user-tracking tools. We do not sell data.

3. Device permissions

• Internet and network state — to connect to the platform's server.
• Notifications — to announce new orders. You can turn this off in the device settings.
• Bluetooth (connect and scan) — only to connect to a thermal printer paired with the device. It is not used to determine location.
• Keep the device awake — so receiving and printing orders does not stop when the screen turns off.
• Calling a guest — the "Call guest" button opens the phone app with the number filled in. The app does not place calls itself and has no access to the call log.

4. Purposes and legal bases

• Receiving, processing, preparing, printing and delivering orders — performance of the contract between the restaurant and NKM SOFT, and between the restaurant and its guest.
• Allergy notes — processed only because the guest entered them, so the food can be prepared safely.
• New-order notifications — the permission you grant on the device.
• Security, abuse prevention and troubleshooting — legitimate interest.
• Legal obligations — where a regulation requires it.

5. Who receives the data

• The restaurant and its staff, according to the role the restaurant assigns them.
• Google LLC (Firebase Cloud Messaging) and, for iOS devices, Apple Inc. (Apple Push Notification service) — to deliver notifications. A new-order notification contains the order's daily number, the guest's name and the order total.
• Contabo GmbH — the server infrastructure provider. The servers are located in the European Union (France).
• Public authorities, where required by law.

Google and Apple may process data outside Serbia and the European Economic Area, subject to the safeguards set out in their data processing terms (standard contractual clauses).

6. How long we keep data

• Orders and staff accounts — for as long as the restaurant uses the platform, or as long as the restaurant decides or the law requires. When a restaurant stops using the platform, we delete its data at its request, except data that must be kept by law.
• Notification token — until you sign out of the app, when the server deletes it. Tokens that stop working are deleted automatically.
• Technical logs — for as long as needed for security and troubleshooting.
• Settings on the device — until you delete the app or its data.

7. Security

The connection to the server is encrypted (HTTPS). Passwords are stored hashed, the access token is stored encrypted on the device, and every restaurant has its own separate database. Only staff with the appropriate role can access the data.

8. Your rights

You have the right to access, correct and delete your data, to restrict its processing, to data portability, to object, and to withdraw a permission you have given. Because the restaurant is the controller of data about its guests and staff, the quickest route is to contact the restaurant. You can also write to us at info@poruci.pro and we will help the restaurant respond. You also have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (www.poverenik.rs).

9. Deleting your account and data

A staff account is deleted by the restaurant's administrator in the platform's admin panel. You can also request deletion of your account and the related data at info@poruci.pro, giving the account's email address and the restaurant's name. Signing out of the app removes the access token from the device and unregisters the device from notifications; deleting the app also removes all its settings from the device.

10. Children

The app is intended for the staff of food businesses and is not intended for children.

11. Changes

We publish changes to this policy on this page, together with the date of the latest change.

12. Contact

NKM SOFT, Lole Ribara 55, 11317 Lozovik, Serbia · MB 63415642 · PIB 108384996 · info@poruci.pro · +381 65 888 71 61