Privacy
notice.

Who is responsible?

CIROPIZZA B.V. (Ciropizza) is responsible for your personal data. In the GDPR (in Dutch: the AVG) this is called the “controller”.

Ciropizza — PizzalabAmsterdamsevaart 202032 EA HaarlemKVK 92876714ciropizzahaarlem@gmail.com

What data we use and why

We only use personal data when we need it. This is what we use:

• —Visiting this website. The website host can receive your IP address, requested pages, browser details and the time of your visit. We use this to show the website, diagnose failures and protect it from abuse. Legal basis: our legitimate interest in a working, safe website. Logs are needed only while they help diagnose failures or security incidents. Contact us for the host’s actual log retention details.
• —The Restaurant Guru badge. Our pages show an award badge from Restaurant Guru. Its image and fonts load from Restaurant Guru’s server (awards.infcdn.net), which receives your IP address, browser details and the page you are on when the page loads. No cookies are set for this by our website. Legal basis: our legitimate interest in showing the award.
• —Ordering. When you order by phone or online, we use your name, required contact details, order and payment details, and your address if delivery is available. We need the required details to fulfil your order. Without them, we cannot complete it. Legal basis: our agreement (contract) with you. We delete ordinary order data when the order is complete and customer-service issues are resolved, unless it is needed for a dispute or a legal duty. Accounting records subject to Dutch tax retention rules are kept for 7 years. Their legal basis is a legal obligation, not your consent.
• —Emailing or calling us. We use the contact details and message you give us to answer you. Giving your name is voluntary. We need a way to reply if you want an answer. Legal basis: our legitimate interest in answering questions, or steps you request before a contract. We delete messages when the question is resolved and follow-up is no longer required, unless they are needed for a dispute or a legal duty.
• —Applying for a job. We use your name, contact details, CV and other details you choose to send us to assess your application. Legal basis: steps before an employment contract. We delete applications within 4 weeks after the procedure ends. With your separate consent, we keep an application for up to 1 year for future vacancies. You can withdraw this consent by contacting us.

We do not sell your data. We do not make decisions with legal or similarly significant effects on you based only on automated processing.

Who else receives your data?

We use service providers to run the website and restaurant:

• —our hosting provider, to run this website;
• —Google (Gmail), for our email;
• —Sitedish, for online orders;
• —Restaurant Guru, which serves the award badge image and fonts.

Providers may process data for us, or for their own service-specific purposes under their terms. Their roles depend on the service and our arrangements with them. Using Sitedish does not remove our responsibility for orders handled on our behalf.

Some providers may process data outside the European Economic Area (EEA). The countries and transfer rules depend on the service and account. Contact us for the details that apply to your data and how to obtain a copy of any applicable safeguards. We do not claim that a particular transfer safeguard covers every provider or account.

We may also share data when the law requires it, or when necessary to deal with a legal claim.

Links to other websites

Our website links to Sitedish (online ordering), Google Maps and Instagram. These links do not embed those services here. When you follow a link, the other website can receive your IP address and browser details. Its own privacy and cookie information applies to its service. We remain responsible for restaurant order data handled on our behalf.

Cookies and browser storage

No optional analytics is active on this website. If you make a choice in Cookie settings, we save a necessary preference in your browser’s local storage. It remembers your choice for 180 days. Local storage is not a cookie. Our legitimate interest is to remember and respect your choice.

You can clear browser storage yourself. Saving a new privacy choice starts a new 180-day preference period. An expired choice is no longer used.

Fonts and videos are hosted with this website. They do not load from Google Fonts or an embedded video platform.

Your rights

Where the GDPR (AVG) applies, you can:

• —see the personal data we have about you;
• —have incorrect data corrected;
• —ask for deletion, unless we have a lawful reason to keep the data;
• —ask to limit processing where the legal conditions are met;
• —object to processing based on legitimate interests, for reasons linked to your situation;
• —receive data you provided in a common machine-readable format, when processing is automated and based on consent or a contract (data portability);
• —withdraw your consent at any time, if we use your data based on consent;
• —file a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.

To use your rights, send an email to ciropizzahaarlem@gmail.com. We respond without undue delay and within one month. For complex or numerous requests, the law allows up to two additional months. We tell you within the first month if an extension is needed and why. We may ask for information needed to confirm your identity. Some rights have legal limits. For example, tax records may need to be kept, and an objection may be refused where overriding lawful grounds or legal claims apply.

Questions?

If you have any questions about your privacy, contact us:

ciropizzahaarlem@gmail.com06 39499644

We may update this notice. The date at the top shows the latest version.