Privacy statement
At Benoti we handle your personal data with care. This privacy statement explains which data we process when you visit our website, contact us or book a table, why we do so, how long we keep it and what rights you have. We comply with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
1. Who is responsible?
The data controller is:
Benoti Group BV
Bresstraat 2A, 2018 Antwerp, Belgium
Company number: 1035.915.359 (VAT BE1035.915.359), Register of Legal Entities Antwerp, Antwerp division
For any question about privacy and data protection, contact privacy@benoti.be or gdpr@benoti.be. You can also write to us at the address above or call +32 3 289 88 88.
Benoti has not appointed a data protection officer (DPO), as this is not legally required for our activities. Your request is handled directly by the management.
2. Which data, for what purpose and on what legal basis?
We only process the data we need. You are not obliged to give us personal data, but without your name and contact details, for example, we cannot confirm a booking or answer your question.
| When | Which data | Purpose | Legal basis (Art. 6 GDPR) |
|---|---|---|---|
| You book a table (via the Lightspeed booking module, by phone or by email) | Name, phone number, email address, date, time, number of guests and any comments you add (e.g. an allergy or a special occasion) | Recording, confirming, reminding you of, changing or cancelling your booking | Performance of a contract or pre-contractual steps at your request (b). If you share health information such as an allergy, we use it with your explicit consent (Art. 9(2)(a) GDPR) solely to prepare your meal safely. |
| You use the contact form or email us | Name, email address, phone number, your message, the language of the website and the time | Answering your question and, if requested, preparing a group dinner or private event. Messages sent through the form arrive in our mailbox and are also stored in the secure website management area so our team can follow them up. You automatically receive an acknowledgement by email. | Pre-contractual steps (b) or our legitimate interest in answering questions (f) |
| You visit the website | IP address, date and time, requested page, browser and device data (server log files) | Delivering the website technically, securing it and detecting faults or abuse | Legitimate interest (f): a secure, properly working website |
| You visit the website (our own visitor statistics) | Page visited, language, referring website, campaign data from the link (utm parameters and whether you came via a Google ad, without storing the click ID itself), clicks on buttons such as "Book", device type, browser and operating system (derived from what your browser sends by default) and a daily changing, irreversible code based on IP address and browser to count unique visitors | Anonymous statistics: which pages are viewed, how visitors find us and how many visitors want to book a table. We use no cookies and no storage on your device for this, and we do not store your IP address. If your browser sends a "Do Not Track" or "Global Privacy Control" signal, we do not measure your visit. | Legitimate interest (f): improving our website and our offer with as little data as possible |
| You visit the website without consenting to marketing cookies | Cookieless signals to Google (Consent Mode): time, page visited, browser type, your consent choice and, technically, your IP address | Aggregated, non-personal measurement of how our ads perform. In this case Google does not set or read cookies. | Legitimate interest (f): assessing the effectiveness of our ads in a privacy-friendly way. You can object by emailing privacy@benoti.be or by blocking Google domains in your browser. |
| You answer a survey on the website | Your answer, the language and an irreversibly encrypted (hashed) version of your IP address | Letting each person vote once and showing the results | Legitimate interest (f) |
| You leave your email address in a survey | Email address, language, date and the text of your consent | Informing you about the subject of the survey, e.g. when reservations open | Consent (a), which you can withdraw at any time via info@benoti.be |
| You send the contact form | An irreversibly encrypted (hashed) version of your IP address | Preventing spam and abuse of the form (maximum 5 messages per hour) | Legitimate interest (f) |
| You make a choice in the cookie banner | Your cookie preference and its date (on your own device) | Remembering your choice and being able to demonstrate it | Legal obligation (c), see our cookie policy |
| You consent to marketing cookies | Cookie IDs, IP address, data about your visit and ad clicks | Measuring which Google ads lead to a visit or booking and making ads more relevant | Consent (a), which you can withdraw at any time via "Cookie settings" at the bottom of every page |
| You are a customer (e.g. an invoice for a group dinner or event) | Name, (business) address, VAT number, invoicing details | Invoicing and accounting | Legal obligation (c), including accounting and VAT legislation |
| You respond on our Instagram or TikTok page | Your public profile and your message or comment | Communicating with you via social media | Legitimate interest (f) |
We do not use your data for automated decision-making or profiling with legal effects for you. We never sell your data. We do not send you newsletters or advertising by email without your prior consent.
Our website is not aimed at children. If you are under 13, please ask a parent or guardian to contact us or make a booking.
3. Who do we share your data with?
Only our staff who need the data for their work have access to it. We also work with a limited number of external parties:
- Lightspeed (Lightspeed Commerce Inc. and its subsidiaries): our booking system. Lightspeed processes your booking data as a processor on our behalf. The booking module is loaded on the website from servers of Lightspeed and its supplier Amazon Web Services (CloudFront).
- mijn.host (the Netherlands): hosting of the website, the management area and our email. Contact form messages, emails and visitor statistics are stored on this processor's servers.
- Google Ireland Limited: Google Ads. Without consent, Google only receives cookieless signals (see above); with your consent to marketing cookies, it also receives data from cookies. Google is itself responsible for its own use of this data; see also Google's privacy policy.
- Meta Platforms Ireland Ltd. (Instagram) and TikTok Technology Limited: when you visit or respond to our pages on those platforms. We are jointly responsible with them for the statistics these platforms show us about our page. For everything else, the platform's own privacy rules apply. Our website itself contains no embedded posts or buttons from these platforms, only plain links.
- Our accountant, for invoices and statutory records.
- Public authorities and emergency services, only where the law requires us to (e.g. a request from the police or courts).
We make agreements with our processors (data processing agreements) so that they only process your data according to our instructions, confidentially and securely.
The map on our contact page is a static image (map data © OpenStreetMap contributors). Only when you click "Directions in Google Maps" do you open Google's website.
4. Transfers outside the European Economic Area
We keep your data within the EEA as much as possible. Some of our service providers may process data outside the EEA:
- Lightspeed is a Canadian company. Canada is covered by an adequacy decision of the European Commission, which means its level of protection is considered equivalent.
- Google, Meta and TikTok may transfer data to the United States or other countries. This is done on the basis of the EU-US Data Privacy Framework for certified companies, or on the basis of the European Commission's standard contractual clauses.
5. How long do we keep your data?
We do not keep your data longer than necessary for the purpose for which we collected it, unless the law requires a longer period:
| Data | Retention period |
|---|---|
| Bookings (in the Lightspeed booking system) | Up to 2 years after your last booking; after that we delete your guest data in Lightspeed. Lightspeed itself has no fixed retention period: as a processor, it keeps the data as long as we ask and deletes it at our request or after our contract ends. We delete allergy information once your booking has passed, unless you ask us to keep it. |
| Contact messages and emails | Up to 12 months after your question has been dealt with, or longer if needed for an ongoing booking, quote or event. In the website management area, messages are automatically deleted after 12 months. |
| Visitor statistics | 13 months, then automatically deleted. The code used to count unique visitors changes every day and cannot be traced back to you or your IP address. |
| Server log files | A few weeks at most, according to our hosting provider's retention period |
| Encrypted IP address in a survey | Up to 30 days after the end of the survey; after that, answers are only kept as totals |
| Email address from a survey | Up to 12 months after the end of the survey, or until you withdraw your consent |
| Encrypted IP address used by the spam filter | 1 hour |
| Cookie preference | 6 months, after which we ask for your choice again |
| Invoices and accounting records | 7 to 10 years, as required by accounting and VAT legislation |
| Google marketing cookies | See the retention periods in our cookie policy |
6. Security
We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. The website uses an encrypted connection (https). Access to booking and customer data and to the website management area is limited to the staff who need it, takes place via personal accounts with strong passwords and is logged. If something does go wrong with personal data, we report it where required to the Data Protection Authority within 72 hours, and to you if the incident poses a high risk to you.
7. Your rights
You have the following rights regarding your personal data:
- Right of access: you can ask which data we hold about you and receive a copy.
- Right to rectification: if your data is incorrect or incomplete, we will correct it.
- Right to erasure ("right to be forgotten"): you can ask us to delete your data, unless we still need to keep it, for example for accounting purposes.
- Right to restriction: you can ask us to temporarily restrict the use of your data, for example while we check a correction.
- Right to data portability: you can receive the data you gave us in a common digital format or have it sent on.
- Right to object: you can object to processing based on our legitimate interest. You can always object to direct marketing.
- Right to withdraw consent: if you gave consent, for example for marketing cookies, you can withdraw it at any time via "Cookie settings" at the bottom of every page. This does not affect processing carried out before the withdrawal.
You can exercise your rights free of charge by emailing privacy@benoti.be. To prevent someone else from impersonating you, we may ask you to prove your identity. We reply within one month. For complex or numerous requests this period may be extended by two months; we will let you know within the first month if so.
8. Lodging a complaint
Not happy with how we handle your data? Please let us know first via privacy@benoti.be so we can find a solution together. You also always have the right to lodge a complaint with the Belgian supervisory authority:
Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données)
Rue de la Presse 35 / Drukpersstraat 35, 1000 Brussels
Phone: +32 2 274 48 00
Email: contact@apd-gba.be
Website: www.dataprotectionauthority.be
9. Other provisions
You can read more about cookies in our cookie policy. Our company details and the terms of use of this website can be found in the legal notice.
We may update this privacy statement, for example when we start using new services or the law changes. The date at the top shows when the text was last updated. For important changes that require your consent, we will ask for it again.