Privacy Policy
How Coffee Beanz collects, uses, shares and protects your personal data when you use the mobile app, our web pages and our tools for establishments, and how to exercise your rights (GDPR).
Last updated : November 3, 2026
This is a translation provided for convenience; the French version prevails.
1. Who are we?
The Coffee Beanz app is published by [À COMPLÉTER : dénomination sociale], [À COMPLÉTER : forme juridique], with its registered office at [À COMPLÉTER : adresse du siège], registered with the Crossroads Bank for Enterprises (CBE) under number [À COMPLÉTER : n° d'entreprise BCE] (hereinafter “Coffee Beanz”, “we”).
For any question about your personal data: [À COMPLÉTER : e-mail vie privée]. We have not appointed a data protection officer (DPO), as this is not mandatory for our activity; requests sent to this address are handled directly by the team responsible.
2. What does this policy cover?
- the Coffee Beanz mobile app (iOS and Android), which lets you view the map of establishments, order ahead and collect your order to eat in or take away;
- our public web pages (including these legal information pages);
- the tools reserved for establishments: the web dashboard and the tablet app used in the kitchen and at the counter (see the Establishment staff section).
3. Who is responsible for what?
Coffee Beanz brings together establishments that we operate ourselves and partner establishments: independent businesses that sell their products through the app. The seller of each order is always shown before payment.
- Coffee Beanz is the data controller for the data relating to your account, the operation of the app, the security of the platform, promotions and support.
- The establishment you order from (ourselves or a partner) receives the data needed to prepare your order and hand it over to you, and remains the data controller for its own obligations (preparation, on-site customer service, accounting and tax). When a partner uses our tools (tablet, dashboard), we process this data on its behalf, as a processor, under an agreement compliant with Article 28 of the GDPR.
- Stripe processes your payment data as an independent data controller for its own obligations (payment security, prevention of fraud and money laundering). See Stripe's privacy policy.
4. What data do we process?
| Category | Data | Source |
|---|---|---|
| Account | Phone number (identifier, verified by SMS), password (stored only in encrypted form by our authentication provider — we never have access to it), display name, contact email address (optional), app language. | You |
| Orders | Establishment, products, combos and options chosen, eat in or take away, pickup day and time, any note, amount, discount applied, order status and history. | You, the establishment |
| Payment | Your card or payment method details are entered in Stripe's secure module and are never passed on to us. We only receive the identifier, amount and status of the payment (and of any refunds). | Stripe |
| Invoicing (if you request an invoice) | Name or company, billing address, optional VAT number and email, entered in the app; you can save them for your next requests. | You |
| Communications | Messages exchanged with the establishment about an order; requests sent via “Contact us” (category, description, contact email and phone number). | You, the establishment |
| Notifications | Your device's notification token and device type (iOS or Android), to keep you informed of the progress of your orders. | Your device |
| Location | If you allow it, your location is used only on your device to centre the map and find the nearest establishment. It is neither sent to our servers nor stored. The base map is loaded from CARTO, which sees the map area displayed and your IP address. | Your device |
| Anonymous statistics | Opening of a product or combo page (product, establishment, date) — without any account or device identifier. | The app |
| Technical data | IP address, device and operating system type and version, server technical logs (requests, errors), session data. | Your device |
Allergies and health. We do not ask you for any health data. If you voluntarily mention an allergy or intolerance in an order note or in a message, this information is used only to prepare your order and is passed on only to the establishment concerned; by providing it, you consent to this processing (Article 9.2.a of the GDPR). Please avoid including any other personal information there.
On your device. The app stores locally your cart, your preferences (language, notifications, chosen establishment), an offline copy of the catalogue and of your orders, as well as your session tokens (in the system's secure storage). This data stays on your device.
5. Why do we use your data and on what basis?
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and securing your account, identifying you (SMS code), managing your profile | Performance of the contract — terms of use (art. 6.1.b) |
| Taking, paying for and tracking your orders; passing them on to the establishment; informing you of their status; handling cancellations and refunds | Performance of the contract (art. 6.1.b) |
| Applying promotions (for example, checking that an offer is reserved for a first order or limited to one use per person) | Performance of the contract (art. 6.1.b) |
| Replying to your messages and support requests | Performance of the contract and legitimate interest in assisting you (art. 6.1.b and f) |
| Notifications about your orders | Performance of the contract (you can turn them off in your phone's settings) |
| Notifications about offers and news | Consent (art. 6.1.a) — off by default, adjustable in the app |
| Anonymous statistics on catalogue views, to improve the establishments' menus | Legitimate interest (art. 6.1.f) — anonymous data |
| Platform security, prevention of fraud and abuse (fake accounts, misuse of promotions) | Legitimate interest (art. 6.1.f) |
| Retention of orders and accounting records | Legal obligation (art. 6.1.c) — Belgian accounting and tax law |
| Establishing, exercising or defending legal claims | Legitimate interest (art. 6.1.f) |
We do not take any decision based solely on automated processing that produces legal effects concerning you, we do not carry out advertising profiling, and we neither sell nor rent out your data.
6. Who do we share your data with?
| Recipient | Role | Data concerned |
|---|---|---|
| The establishment of your order (ourselves or a partner) and its staff | Preparing and handing over the order, replying to your messages | Display name, phone number, order contents, note, messages |
| Clerk, Inc. (United States) | Authentication, sending SMS codes — processor | Phone number, encrypted password, sessions, name |
| Stripe (Stripe Payments Europe, Ltd., Ireland, and its affiliates) | Payments and refunds — independent controller | Payment data, amount, establishment |
| Railway Corp. (hosting, region EU West (Amsterdam)) | Hosting of our server and database — processor | All data of the service |
| Vercel, Inc. (United States) | Hosting of the website, the dashboard and the legal pages — processor | Technical data, data viewed by staff |
| Cloudflare, Inc. (United States) | Storage and delivery of catalogue photos and videos — processor | IP address when media are loaded |
| Expo (650 Industries, Inc., United States), Apple and Google | Delivery of notifications to your phone — processors | Notification token, notification content |
| CARTO (CartoDB, Inc.) | Base map showing the establishments | IP address, map area displayed |
| Sentry (Functional Software, Inc., United States — data hosted in the EU) | Technical error monitoring for the app and server — processor | Error report: device type, app version, technical message (no name, phone number or order content) |
We may also disclose data to the authorities where required by law, and to our advisers (accountant, lawyer), who are bound by professional secrecy. Our processors act only on our instructions and are bound by confidentiality and security commitments.
7. Transfers outside the European Union
Some providers are established in the United States. These transfers are governed either by the European Commission's adequacy decision on the EU–US Data Privacy Framework where the provider is certified under it, or by the standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures. You can obtain a copy of these safeguards by writing to [À COMPLÉTER : e-mail vie privée].
8. How long do we keep your data?
| Data | Duration |
|---|---|
| Account and profile | As long as your account is active. Deleted as soon as you delete your account (see below). |
| Orders and payments (contents, amount, date, establishment) | 10 years from the end of the financial year concerned (Belgian accounting and tax obligations). After your account is deleted, they are linked only to an anonymised account. |
| Requested invoices | 10 years from the end of the financial year (legal obligation), with the details shown on them. Details saved in your account are erased when it is deleted. |
| Messages relating to an order | Kept with the order, for no more than 2 years after it. |
| Contact requests | 2 years after the last exchange; the email address and phone number entered are erased as soon as you delete your account. |
| Loyalty points and rewards | Until your account is deleted. |
| Notification token | Until you sign out, delete your account, or the token is invalidated by Apple or Google. |
| Technical logs | 90 days maximum, unless a security incident is being investigated. |
| Anonymous statistics | No time limit: they cannot be used to identify you. |
| Payment data held by Stripe | In accordance with Stripe's policy and its legal obligations. |
9. Your rights
Under the GDPR, you have the following rights over your data: access, rectification, erasure, restriction of processing, portability (receiving your data in a structured format), objection to processing based on our legitimate interest, and withdrawal of your consent at any time (without affecting processing already carried out).
- In the app: change your name, email address and phone number in Profile › Settings › Account, manage notifications in Profile › Settings › Notifications, and delete your account in Profile › Delete my account.
- By email: write to [À COMPLÉTER : e-mail vie privée] from the email address linked to your account, or stating the phone number linked to it. We may ask you to confirm your identity (for example with an SMS code).
We respond within one month, which may be extended by two months for complex requests (in which case you will be informed). If you believe that your rights are not being respected, you can lodge a complaint with the Data Protection Authority (Autorité de protection des données), Rue de la Presse 35, 1000 Brussels — www.dataprotectionauthority.be.
10. Deleting your account
You can delete your account at any time, directly in the app (Profile › Delete my account). Deletion is immediate: your sign-in identity, name, email address, phone number, loyalty points, rewards and notification tokens are erased, and you are signed out. Past orders are kept for the legal period stated above, linked to an anonymised account. All the steps, including without access to the app: Delete your account.
11. Security
- all communications are encrypted (HTTPS);
- authentication is entrusted to a specialised provider; passwords are never stored in plain text;
- payments are processed by Stripe, which is PCI-DSS Level 1 certified;
- access to order data is restricted, by role, to the staff of the establishment concerned;
- on your phone, session tokens are kept in the system's secure storage (iOS Keychain, Android Keystore).
In the event of a data breach likely to result in a risk to your rights, we notify the Data Protection Authority within 72 hours and, if the risk is high, we inform you.
12. Minimum age
The app is intended for people aged at least 16 years. If you are under 16, do not create an account. If we learn that an account has been created by a younger person, we delete it.
13. Permissions requested by the app
- Location (optional, only while the app is in use): to show your position on the map and find the nearest establishment. Without it, the app works normally.
- Notifications (optional): to let you know when your order is ready or cancelled, or when an establishment writes to you.
The app does not access your contacts, your photos, your camera or your microphone, and does not use any advertising identifier. You can withdraw these permissions at any time in your phone's settings.
14. Establishment staff
For staff members who use the dashboard or the tablet, we also process their role and the establishment they belong to, as well as a log of sensitive actions (changes to the catalogue, prices or promotions, cancellations, etc.) for security and traceability purposes (legitimate interest). A staff member's access is removed when their establishment revokes it or when they delete their account.
16. Changes
We may update this policy, for example when we add a feature. The date of the last update is shown at the top of the page; in the event of a significant change, we will inform you in the app before it takes effect.