Cookie policy

EN — This is a translation provided for convenience. The French version of this document is the binding version: in the event of any discrepancy in interpretation, the French text prevails, save where mandatory law in the Client's country of establishment requires otherwise. The French version is available at https://odres.io/politique-de-cookies.

Placing or reading Trackers that are not strictly necessary requires your prior, freely given, specific, informed and unambiguous consent. As at the date of this policy, no audience measurement or marketing Tracker is placed, either on the Website or on the Platform. There is only one case of a Tracker subject to consent: the video players of the Training module, described in article 4.9. Your consent is requested there at the precise moment at which it has a purpose, and nowhere else.

1. Purpose and scope

1.1 This policy describes the Trackers placed on or read from your terminal equipment when you visit the website https://odres.io (the "Website") or use the software platform accessible at https://app.odres.io (the "Platform", referred to as the "Solution" in the other documents of this corpus), together the "Services".

1.2 Two distinct perimeters. The Website and the Platform are two separately deployed applications. They do not place the same Trackers, and this policy deals with them separately throughout: every table, every duration and every justification states which perimeter it relates to. You therefore do not have to guess what applies to you: if you browse the presentation website without logging in, only article 4.1 concerns you; if you work in the application, articles 4.3 to 4.10 are the relevant ones.

1.3 The Platform comprises six applications, all covered by this policy: ODRES ERP (back office for owners, managers and accountants), OdStaff (employee application), OdKiosk (kitchen and hygiene tablet), OdStock (stock tablet), OdClock (time clock) and OdLabels (iOS label-printing application). It also covers the modules intended for restaurant consumers (loyalty, prize wheel, online reviews).

1.4 It supplements the Legal notice (document no. 02), the Privacy policy (document no. 03) and, for Users of the Platform, the Terms of use (document no. 05). In the event of any conflict regarding the processing of personal data, the Privacy policy prevails.

1.5 It is addressed to anyone who visits the Services, whether as a visitor, prospect, Client, User, employee of a client restaurant or consumer taking part in a module intended for the public.

2. What a "Tracker" is

2.1 For the purposes of this policy, a "Tracker" means any technique for storing information in your terminal equipment, or for gaining access to information already stored in it, whatever its technical form.

2.2 This definition is deliberately broader than cookies alone. The legal rule is technologically neutral: it covers storage and access, not the method used. The following therefore fall under the same regime, without exception:

2.3 A significant proportion of the Trackers listed in article 4 are not cookies: on the Website, three of the four Trackers are local storage or session storage; on the Platform, the keys listed in article 4.4 use the same technique. They are nonetheless subject to the same legal regime, and this policy declares them on the same footing. The absence of a cookie in the strict sense does not remove any obligation.

3. Legal framework

3.1 The placing and reading of Trackers are governed by:

• article 5(3) of Directive 2002/58/EC ("ePrivacy"), transposed into Belgian law in article 129 of the Act of 13 June 2005 on electronic communications;
• Regulation (EU) 2016/679 ("GDPR"), in particular articles 4.11 and 7 thereof, for the definition and conditions of validity of consent, and article 6 thereof for the legal basis of the processing of data collected by means of Trackers;
• Book XII of the Code of Economic Law, for the information obligations specific to information society services;
• the recommendation of the Data Protection Authority on cookies, the requirements of which are set out in article 6.

3.2 Regime applicable by category. Trackers that are strictly necessary for the provision of a communication service or for the provision of a service expressly requested by the user are exempt from consent. All others — audience measurement, personalisation not requested, marketing, social networks, third-party content players — require prior consent, obtained before any placing.

3.3 Approach adopted across the corpus. For trackers, this policy relies on article 129 of the Act of 13 June 2005, which is the specific Belgian provision and the one to which the Data Protection Authority refers. Article XII.13 of the Code of Economic Law is reserved for the information obligations specific to electronic commerce.

4. Inventory of the trackers placed

Rule of accuracy. No Tracker appears below without having actually been observed on the Services; conversely, every Tracker observed appears here. This inventory is the result of a technical survey, not a statement of intent. A cookie policy describing trackers that do not correspond to those actually placed is in itself a breach.

4.1 Strictly necessary Trackers — showcase website (odres.io)

All the Trackers below are issued by Odres, from the odres.io domain. None is issued by a third party. They are exempt from consent pursuant to article 129 of the Act of 13 June 2005 and article 5(3) of Directive 2002/58/EC.

How these durations are obtained. Browser local storage does not expire of its own accord: information written to it remains until it is erased by the site or by you. The twelve-month durations above therefore do not result from a browser mechanism but from a rule programmed into the Website's code, aligned with the one the Platform already applies (article 4.4): the date of your last visit is time-stamped, and the keys are erased once twelve months have elapsed without a visit. The six-month duration of the odres-lang cookie is, by contrast, an expiry duration of the cookie itself, renewed on each visit.

Undertaking. The durations set out in the table above are Odres's undertaking. They are programmed into the Website's code. Odres has chosen to declare the rule rather than leave a blank field: a stated duration can be relied upon, a blank field tells no one anything.

4.2 Why these five Trackers are strictly necessary

Each of them falls within one of the two recognised cases of exemption.

odres-lang and odres-lv3-controls fall within interface personalisation expressly requested by the user. The exemption applies only because you have actively chosen your language and your theme: the Tracker merely retains a decision you have taken yourself, without building any profile and without being shared with anyone.

odres-lv3-cookie-consent records your acknowledgement of the information banner. It is exempt by its very nature: without it, the banner would be shown to you again on every page.

odres-lead-context serves the provision of the service you have expressly requested — completing a contact form without re-entering the information you have just provided. It disappears when the tab is closed.

odres-guide-popup keeps a choice you have expressed — having closed the guide offer, or having already requested the guide — so as not to show it to you again. It contains only a date or a marker, with no identifier, and is read by no third party.

None of these five Trackers makes it possible to identify you, to track you from one site to another, to reconstruct your browsing path or to feed a prospecting database.

4.3 Strictly necessary cookies — Platform (app.odres.io)

The six cookies below are issued by Odres, from the app.odres.io domain. None is issued by a third party. All are strictly necessary for the operation of the service and for the security of your connection; they are exempt from consent.

What the protection attributes mean. HttpOnly prevents any script on the page from reading the cookie, which places it beyond the reach of a script injection attack. Secure prevents it from being sent in clear: it travels only over an encrypted connection. SameSite=Lax prevents it from being sent with a request triggered from another site, which is the basic protection against a forged request. These attributes are not decorative: they are the reason why a session cookie is a secure technique.

4.4 Local and session storage — Platform (app.odres.io)

The keys below are saved in your browser for your convenience of use. They are never transmitted to the server and enable no tracking. The Platform time-stamps each visit and erases these keys after twelve months without a visit.

The expiry mechanism. As local storage does not expire of its own accord, the Platform writes the date of your last visit into the odres_ls_last_seen key. On each of your visits, that date is compared with the current date: if twelve months have elapsed without a visit, the keys above are erased. It is this mechanism, and not a property of the browser, that gives the stated durations their effect. The odres_cookie_consent_v1 key, which records that the information banner has already been presented to you, remains until you erase it yourself.

4.5 Why the Platform's Trackers are strictly necessary

sessionid keeps your session open. Without it, you would have to authenticate on every page. It is essential to the performance of the subscription contract and contains only a random identifier: your session data remains on Odres's server, never in your browser.

csrftoken protects your account against the forged request, that is, the manoeuvre by which a malicious site would attempt to trigger an action in your name. A security tracker is the clearest example of a strictly necessary tracker: its absence does not inconvenience the user, it exposes them.

odres_device recognises a tablet that the restaurant operator has itself configured as a kitchen, stock or clocking station. It identifies a professional device deliberately installed, not a person.

rcl_<campagne> calls for a particular justification, as it concerns a consumer and not an employee. Its function is to limit entry to the prize wheel to one per person and per campaign. That limitation is not an incidental convenience: it is the very rule of the game in which the consumer has chosen to take part. The tracker is therefore necessary for the provision of the service expressly requested by the consumer who takes part — which is precisely what grounds its exemption within the meaning of article 5(3) of Directive 2002/58/EC. It contains only a "has already taken part" marker, is not read outside the campaign concerned, and disappears after thirty days. It serves neither to profile the entrant, nor to recognise them on another site, nor to send them advertising.

django_language retains the language you have chosen, for the duration of your browser session only.

messages carries the text of a confirmation message — "your clocking has been recorded", for example — for as long as it takes to display it, and is deleted as soon as it is displayed.

The storage keys in article 4.4 retain the state of your interface: a collapsed menu, the tab you were viewing, a getting-started guide already read. They fall within the interface personalisation you have carried out yourself, never leave your browser and are read by no third party.

4.6 Proof of acknowledgement of the banner

When the Platform's information banner is presented to you, your acknowledgement is recorded. The following are recorded, and nothing else:

This record meets the obligation to keep proof of the information given, and that alone. Neither your IP address nor your browser is recorded on that occasion: they are not necessary in order to establish that information was presented to you on a given date, and they are precisely the two items that would make it possible to re-identify you. Stating the version of the banner makes it possible to know exactly what information was given to you, which is the only way of verifying that a consent or an item of information does indeed correspond to the content displayed at that time.

4.7 No audience measurement trackers

No audience measurement or statistics Tracker is placed on the Services. Neither the Website nor the Platform uses any traffic analysis tool placing a tracker on your equipment.

4.8 No marketing trackers

No marketing, advertising, retargeting, social network or commercial partner Tracker is placed on the Services. No pixel, no advertising network tag, no social network button placing a tracker. No data from your browsing is transmitted to an advertiser, an advertising network, an advertising platform or a social network.

4.9 Video players of the Training module — the only third-party Trackers, subject to consent

Point to be read carefully. This is the only place in the Services where a third-party tracker is placed, and the only place where your consent is requested. Version 4.0 of this policy stated that no third-party tracker was placed: that statement remains accurate for the whole of the rest of the Services, but it was inaccurate as regards the video players. This version corrects that point.

4.9.1 The two third parties concerned. The Platform's Training module streams videos hosted with two providers:

For the data processed by their player, these providers act on their own behalf, as controllers, and not on Odres's instructions.

4.9.2 These trackers are not strictly necessary. A third-party video player is neither a means of communication nor an element essential to the service you have requested: the Platform works, and the Training module is displayed, without any player being loaded. It follows that these trackers require your prior consent, obtained before the player is loaded — and not afterwards, nor at the moment the video starts.

4.9.3 The design rule that makes this use compliant. Prior consent is not a formality added after the event: it governs the way the page is built. Odres accordingly applies the following rule:

• the video player is not loaded when the page loads;
• it is replaced by a thumbnail — a still image accompanied by a statement that starting the video will result in trackers being placed by the provider and in a transfer to the United States;
• the player is loaded only after a positive act on your part, amounting to consent: clicking on that thumbnail, and that alone;
• this choice is revocable: you may withdraw it at any time, as easily as you gave it, and withdrawal restores the thumbnail.

For as long as you do not click, no request is sent to Vimeo or to YouTube, and no third-party tracker is placed.

4.9.4 YouTube's "no-cookie" mode does not remove the need for consent. The so-called "no-cookie" mode (youtube-nocookie) reduces the placing of trackers, but does not eliminate it, and it in no way prevents the transmission of your IP address to the provider's server, in the United States. It mitigates the interference; it does not make it disappear. It therefore does not constitute a ground for exemption, and consent remains required on the same conditions as for Vimeo. Odres has chosen to state this rather than rely on it: presenting that mode as a dispensation would be inaccurate.

4.9.5 Transfer to the United States. The consent you give by starting a video entails a transfer of data to the United States — your IP address and, for Vimeo, the cookies of its player. That transfer is governed, in this order:

1. by the European Commission's standard contractual clauses (implementing decision (EU) 2021/914);
2. and, where the provider is certified under it, by the EU–US Data Privacy Framework, as an additional safeguard.

This order is not immaterial: a position based on the standard contractual clauses survives any annulment of the EU–US framework, whereas the converse is not true. As at 8 October 2026, Vimeo and its subsidiaries participate in that framework, and Google LLC is certified under it; Odres verifies that these entries are maintained in the official register at each revision of its technical document.

4.9.6 If you refuse. You do not see the video concerned. You retain full access to the Training module, to the Platform and to all its other functions. Refusal is set out in detail in article 7.

4.10 Push notifications

Push notifications are not a tracker in the strict sense: they serve neither to track you nor to recognise you from one site to another. However, writing the device token into your terminal equipment falls within the same storage regime, and this policy therefore declares them here.

Transfer. The delivery of notifications involves a transfer to the United States, governed by the European Commission's standard contractual clauses (implementing decision (EU) 2021/914) and, where the provider is certified under it, by the EU–US Data Privacy Framework. Google LLC is certified under that framework; Apple and Mozilla are not, and for them the transfer relies on the standard contractual clauses declared by the provider. What makes this transfer proportionate is the fact that it carries no data from the database: a notification text and a device address, nothing else. Messages delivered by Mozilla are end-to-end encrypted and unreadable by Mozilla.

4.11 No other third party — locally served resources

With the exception of the video players in article 4.9 and the notification services in article 4.10, all of the Trackers listed are issued by Odres from its own domains.

This point deserves to be spelled out, as it is unusual and verifiable. The typefaces (Inter, Manrope, Sora, Plus Jakarta Sans), the icon library Font Awesome, as well as Chart.js, SortableJS and Bootstrap Icons are local copies served by the Platform itself. No page loads any resource from Google Fonts, cdnjs or jsDelivr. It follows that your IP address is transmitted to no content delivery network when a page is displayed.

This is the opposite of common practice: most websites transmit the IP address of each of their visitors to several American delivery networks on every page displayed, simply by loading a typeface or an icon from them. Odres does not do so, and you can verify this by inspecting the network requests of a page.

4.12 No digital fingerprinting

Odres implements no digital fingerprinting technique (fingerprinting): no reading of the list of installed fonts, no canvas or audio context fingerprint, no survey of extensions, nor any other technique aimed at reconstructing an identifier from the characteristics of your equipment.

4.13 Changes to the inventory

If audience measurement or marketing Trackers are added in the future, they will be placed only after your consent has been obtained, and this inventory will be updated beforehand. The addition of a purpose or of a third party gives rise to a fresh collection of consent, in accordance with article 11.

5. Information, consent and withdrawal

5.1 Two distinct arrangements, for two distinct situations. Odres asks you for consent only where it has a purpose. This results in two arrangements, which must not be confused:

5.2 Why the banner is an information notice and not a request for consent. All of the Website's and the Platform's Trackers listed in articles 4.1, 4.3 and 4.4 are strictly necessary and therefore exempt from consent. A banner seeking your agreement for those trackers would ask you for a decision with no purpose: by refusing, you would obtain exactly what you were already obtaining. Three reasons led Odres not to do so:

• it is unnecessary friction, which the Data Protection Authority advises against: seeking a consent that has no purpose accustoms the user to clicking without reading, and weakens the value of those consents that do have a purpose;
• it is misleading by omission: a consent banner suggests tracking that does not exist, and does a disservice to a service for which the absence of advertising and audience measurement trackers is precisely a selling point;
• it is not the most protective solution: the most protective solution consists in concentrating the request for consent where it produces a real effect, that is, in front of the video players.

The banner therefore informs you, refers to this policy, and records your acknowledgement on the conditions set out in article 4.6.

5.3 Consent to the video players. It is separate, specific and prior. It is obtained at the point of loading, for the sole purpose of playing a video, and no third-party tracker is placed before it is given. No box is pre-ticked. Continuing to browse, scrolling the page and closing a banner never amount to consent. Refusal consists simply in not clicking, which is at least as easy as acceptance.

5.4 Withdrawal at any time. You may withdraw your consent to the video players at any time, as easily as you gave it; the thumbnail is then restored and the player is no longer loaded. You may likewise, at any time, erase from your browser the information retained by the Trackers in articles 4.1, 4.3 and 4.4. Withdrawal does not affect the lawfulness of the placing carried out beforehand.

5.5 General mechanism maintained. The general mechanism for obtaining consent remains developed and ready to be reactivated should audience measurement, a marketing tracker or any other tracker subject to consent be added to the Services. It is not removed; it is without purpose at this date outside the video players — and article 11.2 prohibits a newly introduced tracker from being placed on the basis of a consent obtained before its introduction.

6. Requirements complied with

Odres complies with the following requirements, derived from the regulations and from the recommendations of the Data Protection Authority:

7. Consequences of a refusal

7.1 No access to the Services, and no functionality other than the playback of the video concerned, is conditional upon acceptance of Trackers that are not strictly necessary.

7.2 Odres implements no "tracker wall" mechanism (cookie wall), no degradation of the service in the event of refusal, and no paid consideration for exercising a refusal.

7.3 What a refusal entails exactly. If you do not click on the thumbnail of a video player, you are deprived solely of the playback of that video — and of nothing else. The Training module remains accessible, the module's other content remains available to view, and no other function of the Platform is affected. Your refusal of one video does not amount to refusal of the others: each video is started by a click of its own.

7.4 As the information banner contains no request for consent, there is nothing in it to refuse and merely closing it has no consequence.

8. How to delete or block trackers

8.1 Independently of the arrangements described in article 5, you may at any time configure your browser to refuse, limit or delete Trackers. The procedures vary from one browser to another and are set out in its help menu.

8.2 Warning — Website. Blocking the Trackers in article 4.1 does not prevent access to the Website, but results in the loss of the preferences they retain: your language and your display theme will be reset on each visit, and the information banner will be presented to you again.

8.3 Warning — Platform. Blocking the cookies in article 4.3 has more serious consequences, as they are essential: blocking sessionid or csrftoken prevents logging in to the Platform. Blocking odres_device makes it necessary to reconfigure a tablet on each use. Blocking rcl_<campagne> does not allow you to take part several times in the same campaign: the limitation is also checked on the server side. Blocking the keys in article 4.4 prevents nothing, but resets the state of your interface on each visit.

8.4 Deleting local storage from your browser also erases the record of your acknowledgement and of your choices. Odres can then no longer take them into account: the banner reappears and the consent thumbnails are restored in front of the video players.

9. Data collected by means of trackers

9.1 The categories of data liable to be collected by means of Trackers, their recipients, their retention periods and the rights that may be exercised are described in sections 5.1, 7, 8 and 11 of the Privacy policy (document no. 03). The transfers to the United States mentioned in articles 4.9 and 4.10 of this policy are detailed there by recipient, as is the transfer impact assessment annexed to the DPA (document no. 10).

9.2 Legal basis of the processing. The data associated with strictly necessary Trackers are processed on the basis of Odres's legitimate interest in providing a functional and secure service (article 6.1.f GDPR), or indeed of the performance of the contract (article 6.1.b) where the Tracker is essential to the provision of the Platform. The data associated with the video players are processed on the basis of consent (article 6.1.a). The data associated with push notifications are processed on the basis of the activation you have carried out yourself.

9.3 You may exercise your rights of access, rectification, erasure, restriction, objection and portability, and withdraw your consent, by writing to contact@odres.io.

9.4 You may lodge a complaint with the Data Protection Authority, rue de la Presse 35, 1000 Brussels — contact@apd-gba.be.

10. Retention period of trackers

10.1 The retention period of each Tracker is set out in the tables in articles 4.1, 4.3 and 4.4.

10.2 Cookies. A cookie carries an expiry date which the browser enforces of its own accord. Where the duration is said to be rolling, it is recalculated on each visit: the odres_device cookie, for example, expires one year after your last visit, and not one year after it was created.

10.3 Local storage. Browser local storage carries no automatic expiry: information written to it remains until it is erased by the site or by you. Odres accordingly applies a programmed retention period to the information it writes there, at the end of which it is erased. On the Platform, this mechanism is in place and relies on the odres_ls_last_seen key (article 4.4). On the Website, the twelve-months-without-a-visit rule of article 4.1 is programmed in the same way: each item of information kept carries the date of your last visit and is erased when it falls due.

10.4 Session storage. Information retained in session storage is erased when the tab is closed, without any action on your part.

10.5 Third-party Trackers. The trackers placed by the Vimeo and YouTube players are subject to the retention periods laid down by those providers, in their own privacy policies, to which article 4.9 refers. Odres does not set them and therefore cannot guarantee them: that is a further reason for allowing them to be placed only after your positive act.

11. Amendments to this policy

11.1 This policy is updated on each change to the Trackers used, to the purposes pursued or to the third parties concerned, as well as in the event of a change in the regulations or in the recommendations of the Data Protection Authority.

11.2 Any substantial amendment, in particular the addition of a purpose or of a third party, gives rise to a fresh collection of consent. A newly introduced Tracker subject to consent may under no circumstances be placed on the basis of a consent obtained before its introduction.

11.3 The date of the last update appears at the head of the document. You are advised to consult this policy periodically.

11.4 Periodic review. Odres carries out, at least every six months, a fresh technical survey of the Trackers actually placed on the Services and brings this policy into line with it. That review is recorded. Any change to the code or to the configuration affecting trackers or retention periods gives rise to a new version of the internal technical document, and then to the updating of this policy.