Privacy Policy

Introduction

Xenova B.V. ("we," "our," or "us") is committed to protecting your privacy and personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our restaurant, use our website, or engage with our services.

By using our services, you consent to the data practices described in this policy. If you do not agree with the practices described in this policy, please do not use our services.

Data Controller

Xenova B.V. is the data controller for the personal information we collect. Our contact details are:

Data Collection

The data we collect includes personal information that you provide directly to us, information we collect automatically when you use our services, and information we may receive from third parties. This includes:

• Contact Information: Name, email address, phone number, mailing address
• Reservation Information: Dining preferences, special requirements, party size, date and time preferences
• Communication Data: Records of your communications with us, including emails, phone calls, and messages
• Website Usage Data: IP address, browser type, pages visited, time spent on pages, referring websites
• Cookie Data: Information collected through cookies and similar technologies as described in our Cookie Policy
• Payment Information: Billing information and payment details (processed securely by our payment processors)

How We Use Your Information

We explain how we use your information to provide and improve our services, communicate with you, and comply with legal obligations. The use of your data includes:

• Service Provision: Processing reservations, providing dining services, and managing customer relationships
• Communication: Responding to inquiries, sending confirmation emails, and providing customer support
• Marketing: Sending promotional materials and special offers (with your consent)
• Website Improvement: Analysing website usage to improve functionality and user experience
• Legal Compliance: Fulfilling legal obligations and protecting our rights and interests
• Safety and Security: Ensuring the safety of our premises and preventing fraud

Legal Basis for Processing

Under GDPR, we process your personal data based on the following legal grounds:

• Contract Performance: To fulfil our contractual obligations when you make a reservation or use our services
• Legitimate Interests: For business operations, customer service improvement, and fraud prevention
• Consent: For marketing communications and non-essential cookies
• Legal Obligation: To comply with applicable laws and regulations

Data Sharing and Disclosure

We may share your personal information in the following circumstances:

• Service Providers: With trusted third-party service providers who assist us in operating our business
• Legal Requirements: When required by law, regulation, or legal process
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• Protection of Rights: To protect our rights, property, or safety, or that of our customers or others

We do not sell, rent, or lease your personal information to third parties for their marketing purposes.

Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods include:

• Reservation Data: Retained for up to 2 years after your last visit
• Marketing Communications: Until you unsubscribe or withdraw consent
• Website Analytics: Typically retained for 26 months
• Financial Records: Retained for 7 years as required by Dutch law
• CCTV Footage: Retained for up to 30 days unless required for legal purposes

Your Rights

Under GDPR and applicable data protection laws, you have the following rights regarding your personal data:

• Right of Access: Request copies of your personal data
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data in certain circumstances
• Right to Restrict Processing: Request limitation of processing in certain situations
• Right to Data Portability: Request transfer of your data to another service provider
• Right to Object: Object to processing based on legitimate interests or for marketing purposes
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, please contact us at privacy@xenova.world. We will respond to your request within one month.

Data Security

We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication procedures
• Staff training on data protection principles
• Secure disposal of data when no longer needed

International Data Transfers

Your personal data is primarily processed within the European Economic Area (EEA). If we transfer your data outside the EEA, we ensure appropriate safeguards are in place, such as:

• European Commission adequacy decisions
• Standard contractual clauses approved by the European Commission
• Binding corporate rules or certification schemes

Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your browsing experience, analyse website traffic, and personalise content. For detailed information about our use of cookies, please refer to our Cookie Policy.

Children's Privacy

Our services are not directed to children under 16 years of age. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the updated policy on our website and updating the "Last updated" date.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) if you believe we have not handled your personal data in accordance with applicable law.