Guests: name, email, phone, reservation details, IP address (hashed)
Table companions: name and (optionally) email address, shared by the person who booked in order to invite them. Every message contains a personal link to choose which e-mails they still want, unsubscribe entirely, or have their details erased. This data is deleted automatically 60 days after the reservation.
3. Legal Basis
Performance of contract (reservation management)
Consent (marketing emails, reviews)
Legitimate interest (fraud prevention)
Legal obligation
4. Your Rights
As a guest, you have the following rights under the GDPR:
🔍
Right of Access
You can request what personal data we hold about you.
✏️
Right to Rectification
You can request correction of inaccurate data.
🗑️
Right to Erasure
You can request deletion of your data (right to be forgotten).
🚫
Right to Object
You can object to processing for marketing purposes.
📦
Right to Portability
You can receive your data in a structured, portable format.
5. Retention Periods
Reservation data: 2 years after the reservation
Guest profiles: until deleted by the restaurant or upon request
Hashed IPs: 6 months
6. Third Parties & Transfers
We do not sell data to third parties. Processing is carried out only by our processors:
AWS EU (hosting, Frankfurt)
Amazon SES EU (transactional emails)
Mollie (Belgium/EU — only when an online deposit is used)
Twilio (only for restaurants using WhatsApp reservations or the AI phone assistant — your name, phone number and reservation/order details are then processed through Twilio; during a call, Twilio converts your speech to text. No audio recordings are kept)
OpenAI (only for the AI phone assistant — the converted text is processed to understand your reservation or order; text transcripts are automatically deleted after 90 days)
Google Fonts (font delivery; your IP address is shared with Google)
Contentsquare (France — only with your consent: usage analytics and session recordings of our public pages, booking and ordering pages and the app's scheduling screens; staff names, hours, wages and absence reasons are masked and never recorded)
Apart from loading Google Fonts, no personal data is transferred outside the EU.
7. Cookies
We use necessary and functional cookies. In addition — only with your consent — we use Contentsquare to measure how visitors use our public pages, booking and ordering pages and the app's scheduling screens (clicks, scrolling, session recordings), so we can spot errors and stumbling blocks. Staff data shown on those screens (names, hours, wages, absence reasons) is masked and not recorded; neither is typed text. Some venues also use their own Google Analytics to see how guests reach a reservation, order or ticket through their site or campaigns. On our pages this only happens with your consent; inside the booking widget on a venue's own site, that site's cookie choice applies. There are no advertising cookies and we share nothing with ad networks.
Cookie
Purpose
Type
Retention
PHPSESSID
Keeps you signed in and maintains your session while you use the dashboard.
Necessary
30 days
cilurzo_default_tool
Remembers whether you prefer to open Reservations or Foodcost after signing in.
Functional
1 year
cil_toestemming
Remembers whether you accepted or declined analytics cookies (applies to cilurzo.be and hospitality.cilurzo.be).
Necessary
6 months
_cs_id, _cs_s (and other _cs_*)
Contentsquare: recognises a visit and a returning visitor to measure how the pages are used. Only after your consent.
Analytics
30 minutes to 13 months
_ga, _ga_*
Google Analytics of the venue where you book or order — only if that venue set it up, and only after your consent. That venue is responsible for this measurement; we pass it on.
Analytics
up to 2 years
Local storage. For your convenience we keep a few preferences locally in your browser (not cookies, never sent to our server): kiosk mode, reservation view preferences, dismissing the install tip and acknowledging this cookie notice.
Third-party services. Some pages load Google Fonts (typeface) directly from Google, which shares your IP address with Google. For restaurants using online deposits, payment is handled by Mollie, which may set its own cookies on its payment page. These parties set no cookies on our own domains.