Privacy policy

1. Who is responsible for your data

ZIXAR SRL, which operates the FoodIt.Be service, is the controller for the data described in this policy.

• Address: Rue de la Rosière 32, 7141 Carnières, Belgium
• Enterprise number: 1032.903.114
• Email for any question about your data: vie-privee [at] foodit.be
• Telephone: +32 476 33 47 56

We have not designated a data protection officer, because the law does not require one for our activity.

2. Who this policy applies to

It applies to:

• merchants who are signing up or have signed up for FoodIt.Be, their representatives and their staff who use the administration or the client area;
• visitors to the foodit.be and pro.foodit.be sites;
• people who contact us, who fill in a form from one of our ads on Facebook or Instagram, or who report content to us;
• people who visit our Facebook page or our Instagram account, for what is described in point 11.

It does not apply to the data of the merchants’ customers. For that data, the merchant is the controller and we act on the merchant’s behalf, as processor. See the privacy notice of the site concerned.

3. What data, why, on what basis and for how long

Sign-up and management of your account

• What data : Company name, legal form, address, enterprise number and VAT number, name and position of the representative, email, telephone, site identifier, login data
• Legal basis (GDPR, Art. 6) : Performance of the contract
• How long : For the duration of the contract, then erasure after six months of inactivity from the first day without service (Article 14.3 of the general terms and conditions)

Checking your VAT number in the European VIES register

• What data : VAT number, result and date of the check
• Legal basis (GDPR, Art. 6) : Pre-contractual steps and performance of the contract
• How long : For the duration of the contract, then ten years from the first day without service; if sign-up is refused: twelve months

Payment, direct debit and invoicing

• What data : Billing details, IBAN and BIC, mandate (reference, date, signature), payment status, invoices
• Legal basis (GDPR, Art. 6) : Performance of the contract; legal accounting and tax obligations
• How long : Invoices and sales statements: seven years, then erasure; mandate: ten years from the first day without service

Reminders, suspension and debt recovery

• What data : Amounts due, history of reminders and payments
• Legal basis (GDPR, Art. 6) : Legitimate interest: getting paid
• How long : Until paid in full, then five years (limitation period for periodic claims)

Proof that you accepted the general terms and conditions and the mandate

• What data : Version accepted, date and time, IP address, browser, language on arrival
• Legal basis (GDPR, Art. 6) : Legitimate interest: proving the contract
• How long : Ten years from the first day without service

Support and service-related messages

• What data : Your messages and our replies
• Legal basis (GDPR, Art. 6) : Performance of the contract; legitimate interest
• How long : Three years after the last exchange

Service security and logs

• What data : Application logs: site identifiers, technical codes and counts, with no data about your customers.
  Web server logs: IP address, date and time, full address requested including its parameters, browser.
  Date of your last login and open session.
• Legal basis (GDPR, Art. 6) : Legitimate interest: protecting the service and your data
• How long : Application logs: twelve months.
  Web server logs: thirty days, at our hosting provider.
  Date of last login: for the duration of the contract.
  Sessions: thirty days

Information about FoodIt.Be (news, tips)

• What data : Name, email
• Legal basis (GDPR, Art. 6) : Legitimate interest, within the limits of Article XII.13 of the Code of Economic Law and the Royal Decree of 4 April 2003
• How long : Until you unsubscribe

Replying to contact requests

• What data : Name, business, contact details, message
• Legal basis (GDPR, Art. 6) : Pre-contractual steps; legitimate interest
• How long : Twelve months from your request, if it goes no further on either side

Prospects collected through a form in our ads on Facebook or Instagram

• What data : First and last name, business name, trade, municipality or postcode, telephone, email, language.
  Identifiers of the ad, the campaign and the form, date and time of your answer, and your answer as Meta passes it on to us.
  Status of the contact, our notes, and the log of each call and each email
• Legal basis (GDPR, Art. 6) : Pre-contractual steps taken at your request: you asked to be contacted.
  Legitimate interest: following up and documenting this contact
• How long : Twenty-four months from the last contact, then automatic anonymisation.
  If you sign up, the record is anonymised within 30 days: your data then falls under the first row of this table

Advertising origin of your sign-up

• What data : The campaign parameters in the link through which you arrived (utm_source, utm_medium, utm_campaign, utm_content). These are campaign names, not information about you
• Legal basis (GDPR, Art. 6) : Legitimate interest: knowing which ads work
• How long : With your account, then erasure under the same conditions as the first row. After that we keep only totals that identify no one

Connecting your accounts with third parties: Meta, Mollie, Stripe, Brevo

• What data : The access token, stored encrypted, the identifier of the connected account, and the data we read in read-only mode, for example your spending per campaign. We cannot create or change an ad
• Legal basis (GDPR, Art. 6) : Performance of the contract: you request this feature.
  Legitimate interest where the connected account belongs to a member of your team
• How long : Until you disconnect the account, or until the end of the contract. The token is erased immediately on disconnection (point 12)

Handling notices of illegal content

• What data : Identity and email of the person submitting the notice, reported content, decision
• Legal basis (GDPR, Art. 6) : Legal obligation (Regulation (EU) 2022/2065, Articles 16 and 17)
• How long : Three years after the notice has been handled

Commercial references

• What data : Name and logo of the business, link to the site
• Legal basis (GDPR, Art. 6) : Legitimate interest, with a right to object
• How long : Until you object

Cookies and audience measurement on foodit.be and pro.foodit.be

• What data : Cookie identifiers, pages viewed, how you arrived on the site, truncated IP address
• Legal basis (GDPR, Art. 6) : Strictly necessary cookies: exempt from consent; audience measurement (Google Analytics): ZIXAR’s legitimate interest in knowing which pages are read. It is active from your arrival, and you can decline it at any time with the “Change my choice” link on the “Cookie policy” page
• How long : As set out in the list of cookies published on the “Cookie policy” page

Advertising: the Meta pixel on www.foodit.be

• What data : Address of the pages viewed and a click on a sign-up button, date and time, IP address, type of device and browser, identifier in the _fbp cookie, and the click on a Meta ad that brought you here (_fbc cookie)
• Legal basis (GDPR, Art. 6) : ZIXAR’s legitimate interest in measuring its ads and making its offer known. The pixel is active from your arrival, and you can decline it at any time, separately from audience measurement, with the “Change my choice” link on the “Cookie policy” page
• How long : Cookies: three months; what Meta keeps is governed by its own policy

Legal obligations and requests from authorities

• What data : Depending on the request
• Legal basis (GDPR, Art. 6) : Legal obligation
• How long : As required by law

When we rely on our legitimate interest, that interest is to run the service, to get paid, to be able to prove our rights and to protect the security of the service. You can object to this processing (point 8).

4. Mandatory data

The data marked as mandatory in the sign-up form is needed to conclude the contract and to collect the monthly fees. Without it, sign-up is not possible.

5. Automated decision

If your VAT number is not active in VIES, sign-up is refused automatically. You can ask for a person to review your situation, give your point of view and contest the decision, by writing to us at the address in point 1.

6. Who receives your data

• Our service providers, who act on our behalf: Cyber Technology SRL, trading as StrictlyHosting (BE 0474.407.105), which hosts our servers in the Netherlands and the email server of our management; Brevo (Sendinblue SAS), France, which sends the emails we send you: sign-up confirmation, invoices, reminders, suspension notices, messages about your domain name; Odoo SA (invoicing and accounting); OVH SAS (domain names and hosting of the professional mailbox created on each merchant’s domain name); Google (audience measurement for the foodit.be site, which you can decline).
• Meta Platforms Ireland Limited, when you fill in the form of one of our ads on Facebook or Instagram. The form is hosted by Meta, which passes your answer on to us. Meta also processes this data for its own purposes, as a controller, under its own privacy policy. We never send Meta a list of people.
• Meta Platforms Ireland Limited, also, unless you decline advertising on www.foodit.be: the Meta pixel passes your visit to the site on to Meta (point 11). For the collection and transmission of this data, ZIXAR and Meta are joint controllers; what Meta does with it afterwards is its sole responsibility.
• Our payment providers: Mollie B.V. (online payment of your first invoice and direct debit of your monthly fees) and Belfius Bank SA/NV (the bank account of ZIXAR, which receives the payouts from Mollie). They also process your data for their own legal obligations, as controllers.
• Our accountant, and our advisers (lawyer, bailiff) if there is a dispute.
• The authorities, where the law requires it.

We never sell your data.

7. Transfers outside the European Economic Area

Your data stays in the European Economic Area, with three exceptions.

Audience measurement on the foodit.be site: Google processes this data in the United States, on the basis of the EU-US Data Privacy Framework and the standard contractual clauses of the European Commission. You can decline this audience measurement at any time.

Answers to the forms in our ads: your counterpart is Meta Platforms Ireland Limited, in Ireland, but Meta may process this data in the United States, at Meta Platforms, Inc., on the basis of the EU-US Data Privacy Framework and the standard contractual clauses of the European Commission. Once we have received the answer, we keep it on our servers in the Netherlands.

The Meta pixel on www.foodit.be, unless you decline it: Meta may process this data in the United States, at Meta Platforms, Inc., on the basis of the EU-US Data Privacy Framework and the standard contractual clauses of the European Commission.

8. Your rights

You can ask for access to your data, its rectification, its erasure, restriction of processing and portability. You can object to processing based on our legitimate interest and, at any time, to receiving information about FoodIt.Be. You can withdraw your consent at any time, without affecting what was done before.

Write to us at the address in point 1. We reply within one month. This period can be extended by two months for a complex request; we will then let you know. If we have doubts about your identity, we may ask you to confirm it.

You can lodge a complaint with the Data Protection Authority: Rue de la Presse 35, 1000 Brussels; +32 2 274 48 00; contact [at] apd-gba.be; www.dataprotectionauthority.be.

9. Security

We protect your data with appropriate technical and organisational measures: encryption of communications, access control, a separate database for each merchant, daily backups, security updates, access logs. Appendix 3 to Annex 1 of the general terms and conditions describes them in detail; you can view it in your client area, and the page https://pro.foodit.be/hebergement-et-securite/ sets out the main points without logging in.

10. The data of your site’s customers

For the data of your site’s customers, you are the controller and we are your processor. Annex 1 of the general terms and conditions describes our commitments. You must inform your customers: the template in Part B helps you do this.

11. Our Facebook page, our Instagram account and our ads

Our page and our account. ZIXAR publishes on a Facebook page and on a professional Instagram account. Meta provides us with aggregated statistics about the people who see and use these posts. We never receive a list of people or an individual profile. For these statistics, ZIXAR and Meta Platforms Ireland Limited are joint controllers within the meaning of Article 26 GDPR: this is what the Court of Justice of the European Union ruled on 5 June 2018 (Case C-210/16) for the administrator of a Facebook page. In its Page Insights Controller Addendum, Meta describes how responsibilities are shared, and it provides information to the people concerned, since Meta is the one collecting the data. You can exercise your rights with Meta, or with us: we pass your request on.

Our ads. We ask Meta to show our ads to people who have reacted to our posts or watched our videos, and to people who resemble them. Meta builds these groups itself, from data it already holds. We send Meta no list, no address, no customer file, and we never see who makes up these groups. We choose the criteria, Meta applies them: for that choice, we act together with Meta as joint controllers, in line with the European Data Protection Board Guidelines 8/2020 on the targeting of social media users. The legal basis for the processing Meta carries out on its own users is a matter for Meta and its policy.

The Meta pixel. From your arrival on www.foodit.be, and unless you decline it, the Meta pixel tells Meta that you visited the site and whether you clicked through to sign up. We use this to measure which ads bring visitors, and to show our ads to people who have visited the site. For the collection and transmission of this data, ZIXAR and Meta Platforms Ireland Limited are joint controllers within the meaning of Article 26 GDPR, as the Court of Justice of the European Union held on 29 July 2019 (case C-40/17, Fashion ID); Meta describes in its Business Tools terms and its controller addendum how responsibilities are shared. What Meta then does with this data is its sole responsibility. You can decline it at any time with the “Change my choice” link on the “Cookie policy” page; the site then deletes the _fbp and _fbc cookies it holds, and the pixel no longer loads.

If you do not want to see our ads, the ad settings of your Facebook or Instagram account let you limit them, and you can hide an advertiser. Write to us if you want us to act: we will tell you what we can do, and what only Meta can do.

12. Disconnecting a third-party account and having your data erased

This point concerns the accounts you connect to your site yourself: your Meta ad account, your Mollie or Stripe account, your Brevo account.

What we keep. An access token, stored encrypted, the identifier of the account you connected, and the data we read in read-only mode, for example your spending per campaign. We never keep your password. For a Meta ad account, the token is that of the Facebook account of the person who made the connection.

How to disconnect. In your site’s administration, under Settings then Providers, the “Disconnect” button erases the token immediately and ends our access. You can also remove access from Facebook: Settings, then “Business integrations”, then remove FoodIt.Be. Both routes work; the first one also erases what we had kept.

How to request erasure. Write to vie-privee [at] foodit.be, stating the account concerned. We erase the token, the identifier of the connected account and the data read, and we confirm this to you in writing, within one month. If a legal obligation requires us to keep a record, we tell you which one.

13. Changes

Each version of this policy has a number in the format YYYY-MM-DD. We inform you of any significant change by email or in your client area. A version already published is never corrected without changing its number, except for an error that affects neither what we process, nor why, nor for how long.

Annex. Template privacy notice for your site

Note: This template helps the merchant inform their customers. The merchant must adapt it to their situation, because they remain responsible for its content. ZIXAR cannot complete it for them.

Protecting your data

Who processes your data? {Business name}, {legal form}, {address}, enterprise number {number}, email {address}, is the controller for the data you give us when you order on this site.

Why and on what basis?

• Preparing, delivering and taking payment for your order: performance of the contract.
• Sending you the confirmation and tracking of your order: performance of the contract.
• Managing your customer account, if you create one: performance of the contract.
• Sending you our offers, if you have agreed to this: consent, which you can withdraw at any time.
• Publishing your review, if you leave one: consent.
• Producing our sales statistics and protecting the site against fraud: legitimate interest.
• Meeting our accounting and tax obligations: legal obligation.

Allergies. If you tell us about an allergy or other health information in a comment, you explicitly consent to our using it only to prepare your order (GDPR, Article 9(2)(a)).

Required data. The data requested to place an order is needed to process it. Without it, we cannot accept the order.

Transfers. {Your data stays in the European Economic Area, or describe the transfers and their safeguards.}

Who receives your data?

• ZIXAR SRL (FoodIt.Be), which hosts this site and acts on our behalf, as well as its own service providers.
• {Mollie, Stripe or another provider}, our payment provider, which processes your payment data under its own responsibility.
• {Our delivery staff or our delivery partner}, our accountant and, where the law requires it, the authorities.

How long? Orders: {period}; accounting records are kept for seven years. Customer account: until it is deleted or after {period} of inactivity. Offers: until you withdraw your consent. Reviews: {period}.

Your rights. You can ask for access to your data, its rectification, its erasure, restriction of processing and its portability, and you can object to processing based on our legitimate interest. Write to us at {email address}. You can also lodge a complaint with the Data Protection Authority, Rue de la Presse 35, 1000 Brussels, www.dataprotectionauthority.be.

Cookies. By default, this site places no audience measurement or advertising cookies. A banner asks for your choice before any tracker is placed and keeps that choice for six months. {If you add an audience measurement or advertising tool, describe it here.}