Imprint & privacy

Who is responsible

The company named above is the controller for the data described here — the data of SofraPiwas's own customers and partners. This page does not cover a restaurant's own guests: their bookings and orders live in that restaurant's own installation, and that restaurant publishes its own privacy policy for them.

What we collect

For accounts: your name, email address and a password hash. For billing: your company's legal name, address, registration number, VAT number and billing email, together with payment records from our payment provider and what the VAT service returned when we checked your number. If you contact us or apply to the partner programme, whatever you write in the form, including a phone number and city if you give them. For a partner: the restaurants you introduce, their contact details and your notes on them. We keep security logs of sign-in attempts, which include the email address that was tried. We run no analytics and no advertising trackers.

Why

To give you an account, to bill you, and to issue the invoices the law requires us to issue. We check VAT numbers against the European Commission's VIES service so we can apply the right tax treatment, and we keep the reference of that check as evidence.

How long we keep it

Invoices, and the billing details printed on them, are kept for the period Dutch tax law requires. Sign-in and administrative logs are kept for 18 months. A partner application we turned down is kept for 12 months, then deleted. Sign-up invitation links expire and are deleted after 30 days. Accounts and CRM records are kept while the relationship lasts, and we remove them on request — there is no automatic clock on those.

Your rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Write to the address above and we will answer. Some things we cannot delete on request, and it is fairer to say so: an issued invoice and the legal details printed on it, because we are required to keep them; and security logs, until their 18 months are up.

Cookies

A session cookie when you are signed in, and a cookie remembering your language. Your light or dark preference is stored in your browser and never sent to us. No analytics or advertising cookies.

Who else sees it

We use a small number of suppliers, and each receives only what its job needs. We also check VAT numbers against the European Commission's VIES service, which means sending it the number you gave us.

• Netcup GmbH — hosting and databases (DE)
• Mollie B.V. — subscription payments (NL)
• Resend — sending email (US)
• Sentry — error monitoring, so we find out when something breaks (EU)
• GitHub (Microsoft) — source code and builds — and, for each restaurant we set up, its name, city and administrator's email address, which are recorded in a private repository (US)