Privacy policy

In short

• We only use your data to handle your order, booking, account and loyalty points.
• Payments are processed by Stripe: we never see your full card or bank details.
• No ads, no tracking, analytics or marketing cookies, no selling of data.
• You can download your data and delete your account on the website (My account).

What we process and why

• Orders: dishes, notes, pickup time, name, phone, amount and payment status. Legal basis: contract (Art. 6(1)(b) GDPR). Order records without name and phone are kept for 7 years for tax purposes (Art. 6(1)(c)).
• Bookings: date, time, number of guests, name, phone, email (optional) and your requests. If you mention an allergy or dietary need, we only use it to take it into account, with your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time.
• Account: on your first order or booking the website creates a guest account with a random code. If you sign in with Google or Apple, we receive your user ID from that service and, if shared, your name and email. If you sign in with your email, we send a one-time 6-digit code to that address through our email service. The same account works in the KAYAN app. Signing in is optional.
• Loyalty points: a record of points earned and redeemed (contract). If you join at the till or via /sparen, we store your name, mobile number and (optionally) email; at the till staff look you up by number or email and only see your name and part of your number. The same balance applies in the restaurant, the app and on the website. You can cancel any time via info@kayanrestaurants.nl or My account.
• E-mails and complaints: we send confirmations of your account, order, booking and cancellation, and an acknowledgement when you send a complaint or feedback (contract). A complaint with your contact details also reaches our mailbox so we can reply. No newsletters or advertising without your consent.
• Security: to prevent abuse we only process your IP address in hashed form and keep a log of important actions (legitimate interest, Art. 6(1)(f)).

Cookies and local storage

We only use functional cookies that are needed for the website to work; no consent is required for these (Dutch Telecommunications Act, art. 11.7a). We do not set tracking, analytics or advertising cookies, and we do not load third-party fonts, maps or videos.

• __Host-kayan_at and __Host-kayan_rt: keep your order or account session (HttpOnly, sent encrypted, max. 60 days).
• __Host-kayan_an: one-time security code while signing in with Apple (10 minutes).
• kayan_lang: your language (1 year).
• Local storage “kayan_cart_v1”: your basket on this device.
• During payment Stripe sets its own functional cookies for fraud prevention; when signing in with Google or Apple, their cookies apply.

Who else processes the data

We have data processing agreements with these parties. Where data is processed outside the EU (for example in the United States), this is based on the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses. If you choose delivery via Thuisbezorgd or Uber Eats, that platform’s privacy policy applies.

• Vercel (website and server hosting, Frankfurt data centre) and Neon (database, Frankfurt).
• Stripe Payments Europe (payments) and Resend (sending e-mails, Ireland data centre).
• Google (sign-in with Google via Firebase) and Apple (Sign in with Apple), only if you choose to.
• Our own till system KAYAN POS (hosted on Google Cloud, reached via Cloudflare), where your order arrives for the kitchen and bookkeeping (dishes, pickup time, name and phone).

Security

All connections are encrypted (HTTPS/HSTS). Your session is kept in secure cookies that JavaScript cannot read, the website uses a strict Content Security Policy and every order is validated on the server (prices, times, payment). Staff sign in with two-factor authentication and only see what they need for their work.

Retention

• Guest accounts without orders or bookings: 30 days after last use.
• Account: until you delete it.
• Order and payment records: 7 years (tax law), then deleted; when you delete your account, name and phone are anonymised immediately.

Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, and you can withdraw consent at any time. On the website: My account → Download my data / Delete my account. You can also email info@kayanrestaurants.nl; we respond within one month. You can lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

This website is not intended for children under 16. We do not make decisions based solely on automated processing.

Changes

If this policy changes, we publish the new version on this page.