Privacy policy

horecabenelux.com is run by Horeca Benelux, based in Belgium. We are the controller of the personal data described in this policy: we decide why and how it’s used, and we’re responsible for handling it properly.

• Horeca Benelux, Belgiëlei 129, 2018 Antwerpen, Belgium
• Enterprise and VAT number: BE 0655.845.308
• Privacy questions: privacy@horecabenelux.com
• General questions: info@horecabenelux.com

This policy covers everything on horecabenelux.com: the business directory and reviews, the webshop, the Marketplace, partners, vacancies, events, news and our advertising plans. Browser storage is explained in our cookie policy, the rules of the platform in our terms and conditions.

What we know about you depends on how you use the platform. Most of the site works without an account; then we only process technical data.

• Your account: name, e-mail address, password (stored only as a hash that even we can’t read), account type, language, country or region and interests; optionally a profile photo, phone number and city.
• Signing in with Google: the limited data described below.
• Jobseekers: CV, experience, desired roles and regions, applications and job alerts.
• Businesses, employers and partners: business details, VAT number, billing address, invoices and payments, and everything you publish (profile, vacancies, products, listings, events, replies to reviews).
• Reviews: ratings, text and visit date, plus reports and “helpful” marks.
• Messages and forms: contact forms, quote requests, messages to marketplace sellers and event submissions.
• Webshop orders: delivery and billing address, order contents and payment.
• E-mail preferences: your topics and frequency, and a log of every consent you give or withdraw.
• Technical data: IP address, browser type and server logs, plus a few items stored in your browser (see the cookie policy).
• HB Dine (ordering at the table): when you order as a guest via a QR code at a participating venue, we process the party size at the table, your orders and notes, your language, your rating and comment if you give one, a masked network address (30 days) and a cookie token for your table session; for the venue’s team, the first name or nickname, the role, a hashed PIN and the device name.

We don’t use analytics, advertising or tracking cookies, or tracking pixels. We never ask for sensitive data such as health information or religious beliefs, so please leave it out of your CV and messages.

We only use your data when the GDPR gives us a legal basis for it:

Legitimate interest means we’ve weighed our interest against your privacy; you can object at any time. You can withdraw your consent at any time, as easily as you gave it; this doesn’t affect earlier processing. Some data is required for a service: without an e-mail address, for example, we can’t create an account.

If you choose Continue with Google, we only request the scopes openid, email and profile. We then receive your name, e-mail address, profile photo, Google account ID and language setting (locale). We never see your Google password, and we have no access to your e-mails, contacts, files or other Google services.

We use this data only to create your account, sign you in securely and pre-fill your profile. We never sell it, never use it for advertising and don’t share it with anyone except the processors we need to run the service, such as our hosting provider. We keep it as long as your account exists and delete it together with your account.

Horeca Benelux’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can revoke our access at any time at myaccount.google.com/permissions. To also erase the data we already received, delete your account on your privacy page or write to privacy@horecabenelux.com.

Reviews are public. Your stars, sub-scores, text and visit date are shown with your first name, the initial of your last name and your city, never your e-mail address. Businesses can reply publicly. Business profiles, vacancies, products, listings, events and partner pages are public too, including any contact details you add, and search engines can find them.

Moderation. Only logged-in users can write reviews. Anyone can mark a review as helpful or report it. Our team checks reported reviews against our terms and conditions and may remove content that breaks them; the author is told why. We don’t verify every single visit, we never remove reviews because they’re negative, and we don’t accept paid or incentivised reviews.

You manage your reviews on your reviews page. If you delete your account, your reviews are removed, unless you choose to keep them online anonymously as “Former member”.

Service e-mails, such as confirming your address, order confirmations, invoices, updates on your applications or listings and important account notices, are part of the service. They never contain advertising.

Newsletters and alerts are only sent with your consent, topic by topic: new jobs, events, new businesses nearby, news (including our weekly newsletter), the Marketplace and partner offers. Partner offers are advertising: you only get them if you opt in to that topic, and we send them ourselves without giving your address to partners.

• Double opt-in: after signing up you receive a confirmation e-mail, and we only start sending once you’ve clicked the link.
• Consent log: we record every consent you give or withdraw: date and time, what you agreed to, the version of the text and the source (signup form, account settings or the newsletter form in the footer). You can see your history on your privacy page.
• One-click unsubscribe: every newsletter and alert has an unsubscribe link at the bottom; no login needed.
• Your choice: set your topics and frequency (instant, daily or weekly) in your e-mail preferences.

We never sell your personal data. We only share it when that’s needed:

• Service providers: our hosting provider, an EU-based e-mail delivery provider, Stripe Payments Europe, Ltd. (Ireland) for payments, Google (only for sign-in, if you choose it) and the OpenStreetMap Foundation (maps, only after your consent or a click on “Show map”). Providers working for us are bound by a data processing agreement. For their own processing, Stripe, Google and OpenStreetMap follow their own privacy policies.
• HB Dine: for ordering at the table, the venue is the controller and Horeca Benelux acts as processor on behalf of that venue. We use that data only to get the orders to the team, never for our own purposes.
• Employers and De Flexijobber: your application goes to the employer and, for flexi jobs marked “via De Flexijobber”, also to De Flexijobber, a Belgian flexi-job platform. Each acts as a separate controller.
• Businesses, partners and sellers you contact: they receive your message and contact details so they can reply. Event tickets are sold by the organiser, under its own privacy policy.
• Authorities and advisers: only when the law requires it or to protect rights and safety; and, where necessary, our accountant or lawyer, who are bound by professional secrecy.

We store data within the European Economic Area (EEA) wherever possible. Where a provider processes data outside it (the OpenStreetMap Foundation is in the United Kingdom; Google may process data in the United States), we rely on an adequacy decision of the European Commission, such as those for the United Kingdom and for US companies certified under the EU-U.S. Data Privacy Framework, or on the Commission’s standard contractual clauses. You can ask for a copy of these safeguards at privacy@horecabenelux.com.

We keep data only as long as we need it, then delete or anonymise it.

Employers and De Flexijobber apply their own retention periods. We only keep data longer if it’s needed for an ongoing legal dispute.

We protect your data with:

• TLS encryption (https) on every connection;
• passwords stored only as a secure hash;
• access limited to team members who need the data for their work;
• data processing agreements with all our processors.

If a data breach puts your data at risk, we report it to the Data Protection Authority within the legal deadline and, if the risk is high, inform you directly.

You have the right to:

• access your data and get a copy;
• have it corrected or erased;
• restrict its processing;
• receive it in a portable format (portability);
• object to processing based on legitimate interest, and to direct marketing at any time;
• withdraw your consent at any time;
• not be subject to purely automated decisions (we don’t make any).

Most of this you can do yourself on your privacy page: view your consent history, download your data as a JSON file or delete your account. For anything else, e-mail privacy@horecabenelux.com. We answer within one month; for complex requests this can be extended by two months, and we’ll let you know. Requests are free, and we may ask you to confirm your identity.

Complaints. Please tell us first, so we can try to put things right. You can also contact a data protection authority:

• Belgium: Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données), Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, www.gegevensbeschermingsautoriteit.be / www.autoriteprotectiondonnees.be
• The Netherlands: Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl
• Luxembourg: Commission nationale pour la protection des données (CNPD), cnpd.public.lu

Horeca Benelux is aimed at hospitality professionals and adult guests. You must be at least 16 to create an account. If we learn that a younger child has an account, we delete it. Parents or guardians can contact us at privacy@horecabenelux.com.

We update this policy when our services or the law change; the version number and date at the top show which version applies. For material changes, we e-mail account holders and newsletter subscribers and show a notice on the site before the change takes effect. If a change needs your consent, we ask for it first.

Questions about this policy or your data? We’re happy to help.

• E-mail: privacy@horecabenelux.com
• Post: Horeca Benelux, attn. Privacy, Belgiëlei 129, 2018 Antwerpen, Belgium

Please never send us your password.