Privacy policy
In this privacy policy we explain which personal data Noorderlicht NDSM processes, why we do so, with whom we share data and what rights you have. We handle your data with care and comply with the General Data Protection Regulation (GDPR / AVG).
Controller and contact
The controller responsible for processing your personal data is:
- Noorderlicht NDSM (café-restaurant)
- NDSM-Plein 102, Amsterdam-Noord
- Email: [to complete: privacy contact email]
If a data protection officer (DPO) has been appointed, their details are stated here: [to complete: DPO contact details, if applicable].
What data we collect and when
We only collect personal data that you provide to us yourself when you fill in a form on our website or use a service. Depending on the situation, this concerns the following data:
| When | Which data |
|---|---|
| Reservation | Name, email address, phone number, notes, optionally company/invoice details |
| Contact form | Name, email address, message (emailed to our staff, not stored in the website) |
| Job application | Name, email address, phone number, cover letter, CV file |
| Newsletter signup | Email address |
| Event RSVPs and catering inquiries | Name, email address, phone number, details of the request |
| Webshop order | Name, email address, phone number, shipping address, order details |
| Product review | Name, email address |
| Back-in-stock alert | Email address |
In addition, on form endpoints we briefly process your IP address, in working memory only, to prevent abuse (so-called rate-limiting). This IP address is not stored.
Purposes and legal bases
We process your personal data for the following purposes, each on the basis of a legal ground:
- Handling orders and reservations — to process your reservation or order and communicate with you. Legal basis: performance of the contract and/or legitimate interest.
- Handling contact, catering, event and job-application requests — to respond to your question or request. Legal basis: legitimate interest (and, for job applications, taking pre-contractual steps at your request).
- Sending the newsletter — only if you have signed up for it. Legal basis: consent. You can unsubscribe at any time.
- Security and abuse prevention — short-lived IP rate-limiting on form endpoints. Legal basis: legitimate interest.
Who we share data with
We never sell your data. We do engage a number of processors that process data on our behalf. Where required, we have a data processing agreement with these parties:
- Brevo (Sendinblue) — sends all our transactional email and our newsletter.
- Mollie and Stripe — payment processing for the webshop and tickets. For payment you are redirected to the provider's own secure hosted checkout.
- Our hosting provider — supplies the servers on which the website runs.
- Google Maps — only when you load the map yourself on the contact page. See our cookie policy for details.
International transfers
Some of our processors (such as Brevo and Stripe) may process data outside the European Economic Area (EEA). In that case, appropriate safeguards — such as the European Commission's Standard Contractual Clauses — ensure an equivalent level of protection. [to verify: the exact transfer mechanisms per processor, with the operator/legal advisor.]
Retention periods
We do not keep your personal data longer than necessary for the purposes for which we collected them, or longer than legally required. [to complete: retention periods per category.] Financial and order records are subject to a statutory retention period of 7 years under Dutch tax law.
Your rights
Under the GDPR you have the following rights regarding your personal data:
- Right of access
- Right to rectification (correction)
- Right to erasure ("right to be forgotten")
- Right to restriction of processing
- Right to data portability
- Right to object to processing
- Right to withdraw consent given earlier
You also always have the right to lodge a complaint with the supervisory authority, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).
How to exercise your rights
Would you like to exercise one of the rights above, or do you have a question about your data? Send a message to [to complete: privacy contact email]. We may ask you to confirm your identity before we handle your request, and we will respond within the statutory period.
Changes to this policy
We may update this privacy policy from time to time, for example when our services or the law change. You can always find the most recent version on this page.