Maal-Tijd | Bestel Online bij Lokale Restaurants

1. Data Controller

Maal-Tijd ("we", "us") is the data controller for the processing of your personal data as described in this privacy policy.

Maal-Tijd

Kajuit 36, 9733 CB Groningen, The Netherlands

Chamber of Commerce (KvK): 96820713

VAT number: NL867776699B01

Email: support@maal-tijd.com

Website: www.maal-tijd.com

2. Personal Data We Collect

2.1 Order Data

Full name, email address, phone number
Delivery address (for delivery orders)
Ordered items and selected options
Payment method and status
Order history and order numbers
Order notes

2.2 Technical Data

IP address and browser type (user-agent)
Time and origin of the order

2.3 Location Data

Postal code or address (for restaurant search, stored in your browser)
Geographic coordinates of delivery address (via free PDOK service)

2.4 Review Data

Name, star rating and review text (displayed publicly on the restaurant page)

3. Purposes and Legal Bases

Purpose	Legal basis (GDPR art. 6)
Processing and fulfilling orders	Performance of contract (art. 6(1)(b))
Sending order confirmation emails	Performance of contract (art. 6(1)(b))
Fraud prevention and security	Legitimate interest (art. 6(1)(f))
Geocoding delivery addresses	Performance of contract (art. 6(1)(b))
Location-based restaurant search	Consent (art. 6(1)(a))
Tax and accounting obligations	Legal obligation (art. 6(1)(c))

4. Retention Periods

Order and payment data: 7 years (Dutch tax law obligation)
Customer profile: As long as active, plus max. 2 years after last activity
Reviews: As long as the review is active on the platform
Security logs: Maximum 90 days
Location preferences: Until you clear your browser storage

5. Recipients of Your Data

Mollie B.V. – Payment Processing

Processes online payments on our behalf.

Google LLC (Firebase) – Infrastructure & Security

Database, serverless functions, hosting and App Check. May involve data transfer outside the EEA — see section 6.

Google LLC (reCAPTCHA) – Bot Detection

Protects our platform against automated attacks.

PDOK (Kadaster) – Geocoding

Free Dutch government geocoding service. No personal data is stored by PDOK.

Email provider – Transactional emails

Your name and email address are shared to send order confirmations.

Restaurants (partners)

Your order details (name, phone, address, items) are shared with the restaurant to enable fulfilment.

6. International Transfers

Google Firebase and reCAPTCHA are provided by Google LLC (US). Data transfers take place under Standard Contractual Clauses approved by the European Commission and the EU-US Data Privacy Framework where applicable.

7. Your Rights

Access (art. 15): Request a copy of the data we hold about you
Rectification (art. 16): Correct inaccurate or incomplete data
Erasure (art. 17): Request deletion (unless legally required to retain)
Restriction (art. 18): Restrict processing in certain circumstances
Portability (art. 20): Receive your data in a machine-readable format
Object (art. 21): Object to processing based on legitimate interest
Withdraw consent: Withdraw at any time where processing is consent-based

8. Complaints

You have the right to lodge a complaint with the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens

P.O. Box 93374, 2509 AJ The Hague, Netherlands

Website: autoriteitpersoonsgegevens.nl

Phone: +31 88 1805 250

We kindly ask you to contact us first so we can try to resolve your concern.

9. Security

We implement appropriate technical and organisational security measures including HTTPS/TLS encryption, access controls, Firebase App Check, and periodic security reviews.

10. Changes to This Policy

We may update this policy from time to time. Changes will be published on this page with an updated date.

Privacy Policy