Privacy Policy

Last updated: 16 July 2026

1. Who are we

The Tafel is a Dutch platform offering free booking systems to restaurants. We are registered with the Chamber of Commerce under number KVK 42027611 and have VAT number NL005440779B20. For questions about your personal data, please contact us at hello@thetafel.nl.

2. What data do we collect

We only collect personal data that you provide to us via our sign-up form. This includes:

• Name (first and last name)
• Email address
• Phone number
• Restaurant name
• City or location

We do not collect special categories of personal data and do not request more information than is necessary for the purpose for which the data is processed.

Data from guests using our booking and ordering flows

When you book a table, order from a table via QR code, or place a takeaway order through The Tafel, we additionally collect:

• Bookings — your full name, email address, phone number, party size, any note you leave, and the restaurant you booked with.
• QR table orders — the items you order, your table number, any note you leave, and the payment method you choose.
• Takeaway orders — the items you order, your pickup time, your name/email/phone number where applicable, and your payment reference.
• Payment intents — the Mollie payment reference, amount, currency and status of your payment. Your card details never pass through The Tafel — these stay with Mollie.
• Technical data — on every request we log your IP address (masked to the first two octets), browser user-agent, referrer and timestamp, for security and abuse prevention.

3. Why do we use your data

Your personal data is used solely for the following purposes:

• Contacting you to activate your restaurant on the The Tafel platform.
• Answering questions you send us.
• Performing the agreement you enter into with us.

When you use our consumer booking and ordering flows, we also use your data to:

• Confirm your bookings and send reminders.
• Process your orders and take payment.
• Send you order-ready notifications.
• Detect and prevent abuse of the platform.
• Respond to legal obligations, such as Dutch tax law.

We will not send you commercial messages or newsletters unless you have explicitly given consent. You can withdraw this consent at any time.

4. How long do we retain your data

How long we keep your data depends on what kind of data it is:

• Restaurant sign-up data — a maximum of 2 years after the last contact with you.
• Booking, order and payment records — 7 years, as required by Dutch tax law (Wet op de Rijksbelastingen, art. 52).
• Personal identifiers within those records — kept until you request deletion. At that point your identifiers are anonymised immediately, and the underlying records remain in anonymised form for the rest of the 7-year retention period.

5. Do we share your data

Your personal data is not sold, rented or shared with third parties for commercial purposes. We use the following processors who process data on our behalf:

• Supabase — storage of submitted form data. Supabase is certified for data processing in the European Union.
• Resend — sending confirmation and notification emails. Resend processes email data in accordance with GDPR and is EU-based.
• Mollie — payment processing for bookings and orders. Mollie is EU-based and GDPR-compliant.
• Cloudflare Turnstile — bot detection on our public forms. Turnstile receives request metadata and your IP address.
• Vercel — hosting infrastructure for our website and application. Vercel is EU-based and GDPR-compliant.
• Plausible — anonymous website analytics, only if you have accepted the analytics cookie category. Plausible is EU-based and cookie-free.
• Upstash Redis — session state and rate-limit tracking. Upstash is EU-based.
• Meta WhatsApp Cloud API— order status notifications, only for guests who provide a phone number and opt in. Governed by Meta's own data processing agreement.

Data processing agreements have been concluded with all processors in accordance with the General Data Protection Regulation (GDPR).

6. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of access — you can request a copy of everything we hold about you, via our data request page.
• Right to rectification — you can ask us to correct inaccurate or incomplete data. Currently handled manually — contact hello@thetafel.nl.
• Right to erasure — you can ask us to delete your data ('right to be forgotten'), via our data deletion page.
• Right to data portability — you can receive your data in a machine-readable format. Covered by the same data request page as the right of access.
• Right to restriction of processing — you can ask us to restrict processing in certain circumstances.
• Right to object — you can object to specific processing. Manual — contact hello@thetafel.nl.
• Right to lodge a complaint — with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), at autoriteitpersoonsgegevens.nl.

To exercise a right that requires a manual request, please email hello@thetafel.nl. We aim to respond within 30 days.

7. Cookies

We use three categories of cookies: essential (always on, needed for the site to work — e.g. bot protection, your language preference, your cart session, and rate limiting), analytics (off by default, only loaded once you accept), and marketing (currently unused). You can choose which categories to accept via the cookie banner shown on your first visit.

For website analytics we use Plausible Analytics, a privacy-friendly alternative to Google Analytics. Plausible works entirely without cookies and stores no personal data — but as a precaution we still only load it once you have accepted the analytics category. All analytics data is processed anonymously.

You can change your cookie choices at any time via the "Cookie settings" link in the footer of this website.

8. Security

We take appropriate technical and organisational measures to protect your personal data against loss, misuse or unauthorised access. Communication via our website always takes place over a secure HTTPS connection.

9. Changes to this privacy policy

We reserve the right to amend this privacy policy. Changes will be published on this page with an updated date. We advise you to consult this policy regularly.

Your data

You can request a copy of everything The Tafel holds about you, across every restaurant you have booked or ordered from. You will receive it by email as a PDF you can read and a JSON file for technical use.

You can also ask us to delete your data entirely. This cannot be undone — some records must be kept for tax reasons, but everything identifying you will be removed.

10. Contact

Do you have questions, comments or requests regarding your personal data? Please contact us:

The Tafel
KVK: 42027611
BTW: NL005440779B20
Email: hello@thetafel.nl
Netherlands