Privacy and cookie policy

Who we are

This website (vorkentas.be) is run by Vork & Tas, Europalaan 1A, 8970 Poperinge. Company number / VAT: BE 1039.041.135. Vork & Tas is the controller for the data described on this page. Contact: contact@vorkentas.be or 0486 95 25 82.

Which data we collect

When you contact us by phone or email, we process the data you give us yourself (name, contact details, the content of your message) only to answer your question.

When you place an order (online for pickup, at the table via the QR code, or at the kiosk) we collect your name and phone number, and your email address if you fill it in or order with your account. Without an order, we do not store those details.

If you create a customer account, we keep your details, your order history and your loyalty points so you can reorder quickly. An account is always optional: you can also order without one. You can sign in with a password or with a link by email. When you sign in with a link or when you reset a password, we keep a one-time code (only as an encrypted fingerprint) until it is used or it expires.

We keep reservations with your name, phone number and email so we can manage your table and reach you if we have a question.

We keep the source of the link (utm) and the answer to “how you found us” with the order or reservation, without cookies.

Gift vouchers: when you buy a gift voucher, we keep your name, your email address, the amount, your personal message (if you add one) and the payment through Stripe. With that we send the voucher and we can redeem it in our place.

Business accounts: for a business account we keep the VAT or company number, the name and address of the company (which we look up in the official EU register VIES), the email address of the business and the names and email addresses of the colleagues who order, together with their orders and the invoicing details.

Allergies and notes: in a note with an order you can mention an allergy or a diet (for example “no nuts”). That can be data about your health. By filling in such a note yourself, you give us explicit consent for that. We use it only to prepare your order safely and we do not keep it for longer than necessary. You can withdraw your consent at any time by contacting us. If you fill in nothing, we cannot take it into account.

Staff: for staff of our place we keep a management account (name, email address, role) and a log of sign-in attempts and actions in the management area, to protect the place and customers' data.

How long we keep your data

We keep the amount, payment method and date of an order for 10 years from the end of the financial year, because accounting law requires it. For a company, the name (including when that is a person's name), the address and the VAT number also stay with the records for those 10 years. We unlink the phone number and email address from an order after 7 years; for an order by a private customer, the name as well. We delete a note with your order (for example an allergy) after 90 days. If you delete your account, the phone number and email on your orders are deleted straight away, and for an order by a private customer your name as well. For a company, the name, address and VAT number stay for the bookkeeping. We keep account details for as long as you use your account. We keep reservations for 2 years at most. We keep business applications for 2 years at most. We keep staff sign-in attempts (email address, device type) for 12 months at most. We do not keep technical logs (such as which emails the website sent) for longer than needed to trace errors and prevent misuse.

Messages about your order and your account

If you place a pickup order, we can let you know by text message as soon as your order is ready. That only happens on the phone number you gave yourself with the order. If a text message is not possible and you gave an email address, we send you an email. If you order at the table in our place, you do not get a message like that. We also send the emails that belong to your account: a sign-in link, resetting or changing your password, confirming an email address, and gift voucher confirmations. Those are service emails, not advertising. We only send advertising or a newsletter with your consent.

Cookies

This website does not use tracking or advertising cookies. We do count anonymously how often pages are viewed and where visitors come from (for example Google or Instagram). That happens without a cookie, without storing anything on your device, without your IP address and without data about you as a person: we only keep daily totals. Only strictly necessary functional cookies are used: for your sign-in session (per device, for up to 30 days) if you have a customer account, and for managing the website itself. Under the GDPR and Belgian cookie law, consent is not required for those cookies, which is why we do not show a cookie banner either. If we ever introduce tracking or marketing cookies, we will ask for your consent first and update this policy. On your own device we only keep your basket in the browser (localStorage).

Map

On our contact page a map image of our location is shown straight away. That image sits on our own server (map data from OpenStreetMap), so opening the page does not share any data with a third party. If you yourself choose “Load the interactive map” or “Route in Google Maps”, you give consent for that and Google may collect technical data under its own privacy policy. We have no influence over that.

Why we may use your data

We process orders, reservations, gift vouchers, business accounts and business applications in order to perform the contract with you (Article 6.1.b GDPR) and to meet our accounting and tax obligations (6.1.c). We base a customer account and loyalty points on your consent (6.1.a), which you can withdraw by deleting your account. We process an allergy or a diet that you fill in yourself on the basis of your explicit consent (Article 9.2.a). The text message or email “your order is ready” is needed to hand over the order (6.1.b). We base security and the prevention of misuse (for example a limit on the number of sign-in attempts per IP address, which only stays in memory briefly, and the management log) on our legitimate interest (6.1.f).

Who we share data with

We only share data with service providers who work on our instructions (processors):

• Stripe: online payments and refunds.
• Railway: hosting of the website and the database.
• Resend: sending emails (servers in Ireland, within the EU).
• Twilio: sending text messages, once we use that service.
• Google (Gmail and Drive): our mailbox, where replies to our emails come in, and secure copies of our administration.
• The European Commission (VIES): checking a VAT number for a business account.

They may use your data only to provide their service. Some of those parties are outside the EU; then standard contractual clauses or another legal transfer mechanism apply. We never sell your data and we do not use it for profiling or automated decisions.

How we protect your data

The website only works over a secure connection (https). Passwords are not stored themselves, only as a strong, irreversible fingerprint. Staff only get access to what they need, and we do not keep unencrypted copies of the database lying around.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Do you have a customer account? Then you can download your data yourself and delete your account on the page My account. Your order data is then anonymised (it remains as anonymous rows for the bookkeeping, as the law requires). You can also contact us at any time via contact@vorkentas.be; we reply within a month. If you have a complaint about how we handle your data, you can also submit it to the Data Protection Authority (Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be).

Terms

You can read how ordering, paying, cancelling and gift vouchers work in our terms and conditions.

Changes

This policy can be updated. The most recent version is always on this page.