en
Login
en
Login

Privacy Policy

"Kiesmo," "we," "us," or "our" operating under the trade name Kiesmo or Kiesmo Business or Kiesmo Zakelijk, provides meal boxes and corporate drop catering in the Netherlands. We respect your privacy and process personal data in compliance with the General Data Protection Regulation (GDPR / Algemene Verordening Gegevensbescherming - AVG) and Dutch data protection legislation.

1. Identity and Contact Details of the Data Controller

For direct website visitors, consumer group orders, and our direct commercial relationships, the Data Controller is:

  • Brand Name: Kiesmo

  • Chamber of Commerce (KvK) Number: 95398015

  • Registered Office: Rotterdam, the Netherlands

  • Privacy & GDPR Contact Email: info@kiesmo.com

(Note: For corporate B2B employee meal, your employer acts as the Data Controller, and Kiesmo acts as the Data Processor under our B2B Data Processing Agreement).

2. Personal Data We Collect

We only collect data necessary to fulfill meal deliveries, process transactions, manage corporate accounts, and maintain platform security:

  • Account & Contact Data: First and last name, corporate or personal email address, phone number, company name, office department, delivery address, and floor/desk drop instructions.

  • Order & Transaction Data: Meal selections, order dates/times, group cart associations, Minimum Order Value (MOV) fulfillment status, subsidy rule allocations, and invoice reference numbers. (We do not store complete payment card credentials; transactions are handled securely by PCI-DSS compliant payment service providers).

  • Technical & Usage Data: IP address, browser type, operating system, device identifiers, login timestamps, and functional session cookies.

  • Dietary & Allergen Information: When explicitly displayed by our partner kitchens or selected within an order, meal preferences (e.g., vegetarian, vegan, halal). (At this stage, Kiesmo does not store medical or comprehensive health profiles; we display restaurant-provided allergen labels directly).

3. Purposes and Legal Bases for Processing

We process personal data under the following legal bases pursuant to Article 6(1) GDPR:

Purpose of Processing

Category of Data

Legal Basis (Art. 6 GDPR)

Order Execution & Delivery: Managing group orders, order batches, kitchen prep slips, and office delivery drops.

Contact data, delivery details, meal selections.

Performance of a Contract (Art. 6(1)(b) GDPR).

Payment Processing & Invoicing: Managing B2B consolidated invoicing, employee co-pays, and supplier reconciliation.

Billing data, transaction logs, company details.

Performance of a Contract & Legal Obligation (Art. 6(1)(b)/(c) GDPR).

Tax & Financial Compliance: Complying with Dutch administrative and tax retention laws (Belastingdienst requirements).

Master invoices, financial records, transaction histories.

Legal Obligation (Art. 6(1)(c) GDPR).

Customer Support & Platform Operations: Responding to inquiries, order status updates, and preventing platform abuse.

Contact data, support chat/email logs, platform logs.

Legitimate Interest (Art. 6(1)(f) GDPR).

Direct Marketing (B2B): Sending service updates and relevant corporate catering solutions to registered business contacts.

Corporate name, business email address.

Legitimate Interest (or Consent where applicable).

4. EU Data Hosting & Server Location

All Kiesmo production databases and physical servers are located strictly within the European Union (EU).

We do not transfer personal data outside the European Economic Area (EEA) unless explicitly necessary for specific integrated tools (such as transactional email gateways), in which case transfers are secured via European Commission Standard Contractual Clauses (SCCs) and strict data protection agreements.

5. Sharing Data with Third Parties (Recipients)

We only share personal data with third parties where strictly necessary to execute our services or comply with statutory requirements:

  • Partner Kitchens & Caterers: Only the necessary order details (first name, meal selection, order reference, delivery window) required to prepare, pack, and label individual meal boxes. Kitchens are contractually prohibited from using this data for marketing or customer solicitation.

  • Delivery & Logistics Partners: Address, delivery contact, and recipient name to ensure accurate office delivery drops.

  • Payment Service Providers: Regulated payment gateways (e.g., Online Payment Platform, Adyen, Stripe) to process co-pays and invoices securely.

  • IT, Cloud & Software Vendors: Hosting, maintenance, and database providers operating under strict Data Processing Agreements (DPAs).

  • Government & Regulatory Authorities: The Dutch Tax Administration (Belastingdienst) or law enforcement agencies if legally compelled by Dutch law.

6. Data Retention Periods

We adhere to data minimization and do not keep personal data longer than necessary:

  • Order & Account Data: Retained for the duration of the commercial relationship. When an employee is removed from a B2B corporate dashboard or a user deletes their account, personal identifiers are permanently deleted within 30 days.

  • Financial & Invoicing Records: Kept for 7 years to satisfy mandatory Dutch statutory tax retention obligations (fiscale bewaarplicht).

  • Technical Server Logs: Retained for a maximum of 6 months for security, fraud prevention, and performance diagnostics.

7. Security Measures

We implement appropriate technical and organizational measures to safeguard personal data:

  • End-to-end SSL/TLS encryption for all web traffic and data transmissions.

  • Role-based access controls and multi-factor authentication (MFA) for administrative staff.

  • Regular security assessments, database backups, and vulnerability patching.

8. Cookies and Tracking

Kiesmo uses functional and analytical cookies to ensure our website and ordering platform work properly. Functional cookies (e.g., maintaining cart state, login authentication) are essential and do not require prior consent. Where non-essential analytical or marketing cookies are deployed, we request your prior consent via our cookie banner.

9. Your GDPR Privacy Rights

Under the GDPR (Articles 15–22), you have the right to:

  • Access: Request a copy of the personal data we hold about you.

  • Rectification: Request correction of inaccurate or incomplete data.

  • Erasure ("Right to be Forgotten"): Request deletion of your data when it is no longer required for its original purpose or statutory duties.

  • Restriction: Request temporary suspension of data processing under certain conditions.

  • Data Portability: Receive your data in a structured, commonly used, and machine-readable format.

  • Objection: Object to processing based on legitimate interests or direct marketing.

  • Withdraw Consent: Withdraw any previously given consent at any time.

To exercise any of these rights, contact us at info@kiesmo.com. We will respond within 15 days of receiving your request.

10. Complaints to the Supervisory Authority

If you have concerns about how we handle your personal data, you have the right to lodge a formal complaint with the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens (AP)

Postbus 93374, 2509 AJ Den Haag

Website: autoriteitpersoonsgegevens.nl

11. Amendments to this Policy

We reserve the right to update this Privacy Policy to reflect platform improvements, new features, or changes in legal regulations. Material updates will be highlighted directly on our website or communicated via email to registered account holders.