Privacy policy

1. Who is responsible for your data

ZIXAR SRL, which operates the FoodIt.Be service, is the controller of the data described in this policy.

• Address: Rue de la Rosière 32, 7141 Carnières, Belgium
• Company number: 1032.903.114
• Email for any question about your data: vie-privee [at] foodit.be
• Phone: +32 476 33 47 56

We have not appointed a data protection officer, as the law does not require one for our activity.

2. Who this policy applies to

It applies to:

• businesses that sign up or are signed up to FoodIt.Be, their representatives and their staff who use the administration or the customer area;
• visitors to the foodit.be and pro.foodit.be websites;
• people who contact us or report content to us.

It does not apply to the data of the shops’ customers. For that data, the business is the controller and we act on its behalf as a processor. Please refer to the privacy notice of the shop concerned.

3. What data, why, on what basis and for how long

Signing up and managing your account

• What data: Name, legal form, address, company and VAT number, name and position of the representative, email, phone, shop identifier, login data
• Legal basis (GDPR, art. 6): Performance of the contract
• How long: During the contract, then erasure after six months of inactivity from the first day without service (article 14.3 of the general terms)

Checking your VAT number in the European VIES register

• What data: VAT number, result and date of the check
• Legal basis (GDPR, art. 6): Pre-contractual measures and performance of the contract
• How long: During the contract, then ten years from the first day without service; if refused: twelve months

Payment, direct debit and invoicing

• What data: Billing details, IBAN and BIC, mandate (reference, date, signature), direct debit pre-notifications, payment status, invoices
• Legal basis (GDPR, art. 6): Performance of the contract; legal accounting and tax obligations
• How long: Invoices and sales statements: seven years, then erasure; mandate: ten years from the first day without service

Reminders, suspension and debt recovery

• What data: Amounts due, history of reminders and payments
• Legal basis (GDPR, art. 6): Legitimate interest: getting paid
• How long: Until full payment, then five years (limitation period for periodic claims)

Proof of your acceptance of the general terms and of the mandate

• What data: Accepted version, date and time, IP address, browser
• Legal basis (GDPR, art. 6): Legitimate interest: proving the contract
• How long: Ten years from the first day without service

Support and service messages

• What data: Your messages and our replies
• Legal basis (GDPR, art. 6): Performance of the contract; legitimate interest
• How long: Three years after the last exchange

Service security and logs

• What data: Application logs: shop identifiers, technical codes and counts, with no data about your customers.
  Web server logs: IP address, date and time, page requested, browser.
  Date of your last login and open session.
• Legal basis (GDPR, art. 6): Legitimate interest: protecting the service and your data
• How long: Application logs: twelve months.
  Web server logs: thirty days, at our hosting provider.
  Date of last login: during the contract.
  Sessions: thirty days

Information about FoodIt.Be (news, tips)

• What data: Name, email
• Legal basis (GDPR, art. 6): Legitimate interest, within the limits of article XII.13 of the Code of Economic Law and the Royal Decree of 4 April 2003
• How long: Until you unsubscribe

Replying to contact requests

• What data: Name, business, contact details, message
• Legal basis (GDPR, art. 6): Pre-contractual measures; legitimate interest
• How long: Twelve months if the request is not followed up

Handling reports of illegal content

• What data: Identity and email of the reporter, reported content, decision
• Legal basis (GDPR, art. 6): Legal obligation (Regulation (EU) 2022/2065, articles 16 and 17)
• How long: Three years after the report is handled

Business references

• What data: Name and logo of the business, link to the shop
• Legal basis (GDPR, art. 6): Legitimate interest, with a right to object
• How long: Until you object

Cookies and audience measurement on foodit.be and pro.foodit.be

• What data: Cookie identifiers, pages viewed, referral path, truncated IP address
• Legal basis (GDPR, art. 6): Strictly necessary cookies: exempt; audience measurement (Google Analytics) and other cookies: consent (Law of 30 July 2018, art. 10/2)
• How long: According to the list of cookies published on the “Cookie policy” page

Legal obligations and requests from authorities

• What data: Depending on the request
• Legal basis (GDPR, art. 6): Legal obligation
• How long: As required by law

Our legitimate interest, when we rely on it, is to run the service, to get paid, to be able to prove our rights and to protect the security of the service. You can object to this processing (point 8).

4. Mandatory data

The data marked as mandatory in the sign-up form is needed to conclude the contract and to collect the monthly payments. Without it, signing up is not possible.

5. Automated decision

If your VAT number is not active in VIES, the sign-up is automatically refused. You can ask for a person to review your situation, express your point of view and contest the decision by writing to us at the address in point 1.

6. Who receives your data

• Our service providers, acting on our behalf: Cyber Technology SRL, trading as StrictlyHosting (BE 0474.407.105), which hosts our servers in the Netherlands; Brevo (sending our emails); Odoo SA (invoicing and accounting); OVH or another registrar (domain names); Google (audience measurement of the foodit.be website, with your consent).
• Our payment providers: Mollie B.V. (online payment of the first invoice) and Belfius Bank SA (direct debit). They also process your data for their own legal obligations, as controllers.
• Our accountant, and our advisers (lawyer, bailiff) in the event of a dispute.
• Public authorities, where required by law.

We never sell your data.

7. Transfers outside the European Economic Area

Your data stays in the European Economic Area, except for the audience measurement of the foodit.be website: Google processes that data in the United States, on the basis of the EU-US Data Privacy Framework and the European Commission’s standard contractual clauses. This audience measurement only works with your consent.

8. Your rights

You can request access to your data, its rectification, erasure, restriction of processing and portability. You can object to processing based on our legitimate interest, and at any time to receiving information about FoodIt.Be. You can withdraw your consent at any time, without affecting what was done before.

Write to us at the address in point 1. We reply within one month. This period can be extended by two months for a complex request; we will let you know if so. If we have doubts about your identity, we may ask you to confirm it.

You can lodge a complaint with the Data Protection Authority: Rue de la Presse 35, 1000 Brussels; +32 2 274 48 00; contact [at] apd-gba.be; www.dataprotectionauthority.be.

9. Security

We protect your data with appropriate technical and organisational measures: encryption of exchanges, access control, a separate database for each business, daily backups, security updates, access logs. Appendix 3 of annex 1 of the general terms describes them in detail; you can read it in your client area, and the page https://pro.foodit.be/hebergement-et-securite/ sets out the essentials without signing in.

10. The data of your shop’s customers

For the data of your shop’s customers, you are the controller and we are your processor. Annex 1 of the general terms describes our commitments. You must inform your customers: the model in the appendix helps you do so.

11. Changes

Each version of this policy has a number in the format YYYY-MM-DD. We will inform you of any significant change by email or in your customer area.

Appendix. Model privacy notice for your shop

Note: this model helps the business inform its customers. It must adapt it to its situation, as it remains responsible for its content. ZIXAR cannot complete it on its behalf.

Protecting your data

Who processes your data? {Business name}, {legal form}, {address}, company number {number}, email {address}, is the controller of the data you entrust to us when ordering from this shop.

Why and on what basis?

• Preparing, delivering and charging your order: performance of the contract.
• Sending you the confirmation and tracking of your order: performance of the contract.
• Managing your customer account, if you create one: performance of the contract.
• Sending you our offers, if you have agreed: consent, which you can withdraw at any time.
• Publishing your review, if you leave one: consent.
• Compiling our sales statistics and protecting the shop against fraud: legitimate interest.
• Complying with our accounting and tax obligations: legal obligation.

Allergies. If you tell us about an allergy or other health information in a comment, you expressly agree that we use it only to prepare your order (GDPR, article 9, paragraph 2, a).

Necessary data. The data requested to place an order is necessary to process it. Without it, we cannot accept the order.

Transfers. {Your data stays in the European Economic Area, or specify the transfers and their safeguards.}

Who receives your data?

• ZIXAR SRL (FoodIt.Be), which hosts this shop and acts on our behalf, together with its own providers.
• {Mollie, Stripe or other}, our payment provider, which processes your payment data under its own responsibility.
• {Our delivery staff or delivery partner}, our accountant and, where required by law, the authorities.

How long? Orders: {period}; accounting records are kept for seven years. Customer account: until it is deleted or after {period} of inactivity. Offers: until you withdraw your consent. Reviews: {period}.

Your rights. You can request access to your data, its rectification, erasure, restriction of processing and portability, and object to processing based on our legitimate interest. Write to us at {email address}. You can also lodge a complaint with the Data Protection Authority, Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be.

Cookies. This shop does not place any audience measurement or advertising cookies by default. A banner asks for your choice before any tracker is placed and keeps that choice for six months. {If you add an audience measurement or advertising tool, describe it here.}