Privacy Policy

1. Introduction

Welcome to TableMate, a service operated by LMG OPTIMIZE BV, a company registered under Belgian law with registered office in Belgium, and registered with the Crossroads Bank for Enterprises under number BE0785858168 ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform. This policy applies to all users of the TableMate platform, including restaurant owners, venue managers, and their authorized personnel.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Name and email address
• Business information (company name, VAT number)
• Billing address
• Payment information (processed securely through Mollie B.V.)

2.2 Venue and Product Data

When you use our services, we collect:

• Venue information (name, subdomain, settings)
• Product and category information
• Order data and customer information
• Usage analytics and performance metrics

2.3 Technical Information

We automatically collect:

• IP address and device information
• Browser type and version
• Usage data and interactions with our platform
• Cookies and similar technologies (essential only)

3. Legal Basis for Processing

We process your personal data based on the following legal grounds under Article 6 of the GDPR:

• Contract Performance (Art. 6(1)(b)): Processing necessary for the performance of our service agreement with you, including account management, service delivery, and payment processing
• Legal Obligation (Art. 6(1)(c)): Processing necessary to comply with Belgian and EU legal requirements, including tax and accounting obligations, anti-fraud measures, and responding to lawful requests from authorities
• Legitimate Interest (Art. 6(1)(f)): Processing necessary for our legitimate interests, including platform security, fraud prevention, service improvement, and system administration — balanced against your rights and freedoms
• Consent (Art. 6(1)(a)): Where applicable, for optional communications — you may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal

4. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our services
• Process payments and manage subscriptions
• Send transactional emails (order confirmations, receipts, password resets)
• Improve and optimize our platform
• Detect and prevent fraud and security issues
• Comply with legal obligations
• Communicate with you about service updates and support

5. Data Sharing and Disclosure

5.1 Third-Party Service Providers

We share data only with the following categories of trusted service providers, each acting as a data processor under appropriate data processing agreements:

• Mollie B.V. (Netherlands): Payment processing — subject to Mollie's privacy policy and PCI DSS compliance
• Hosting infrastructure (EU): Server hosting and data storage within the European Economic Area
• Transactional email provider (EU): Delivery of order confirmations, receipts, and account notifications
• Error monitoring service: Application performance monitoring and error tracking to maintain service reliability

5.2 Legal Requirements

We may disclose your information if required to do so by law, court order, or binding government request, or where strictly necessary to protect the rights, property, or safety of LMG OPTIMIZE BV, our users, or the public, in accordance with applicable law.

6. International Data Transfers

We primarily store and process your data within the European Economic Area (EEA). Where data is transferred outside the EEA (for example, by a sub-processor), we ensure appropriate safeguards are in place, including:

• European Commission adequacy decisions
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Other lawful transfer mechanisms under Chapter V of the GDPR

You may request information about the specific safeguards applied to international transfers by contacting privacy@tablemate.be.

7. Data Security

We implement appropriate technical and organizational measures to protect your personal information in accordance with Article 32 of the GDPR, including:

• Encryption of data in transit (TLS) and at rest
• Secure authentication and role-based access controls
• Regular security assessments and updates
• Restricted access to personal data on a need-to-know basis
• Incident response procedures for potential data breaches

No method of transmission over the Internet or electronic storage is completely secure. While we implement and maintain reasonable security measures in line with industry standards, we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your account.

8. Your Rights Under the GDPR

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

• Right to Access (Art. 15): Request a copy of the personal data we hold about you
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete personal data
• Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations
• Right to Restriction of Processing (Art. 18): Request that we restrict the processing of your personal data in certain circumstances
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format
• Right to Object (Art. 21): Object to the processing of your personal data based on legitimate interests
• Right to Withdraw Consent (Art. 7(3)): Withdraw your consent at any time, without affecting the lawfulness of processing based on consent before withdrawal

To exercise any of these rights, please contact us at privacy@tablemate.be. We will respond to your request within 30 days as required by the GDPR. If you are unsatisfied with our response, you have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données) at www.dataprotectionauthority.be.

9. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes described in this policy and to comply with our legal obligations. When you delete your account, we will delete or anonymize your personal data within 30 days, except where Belgian or EU law requires longer retention (e.g., tax and accounting records under Belgian tax law may be retained for up to 7 years). After the applicable retention period, data is securely deleted or irreversibly anonymized.

10. Cookies

We use only strictly necessary cookies to provide our services (authentication, session management, security). We do not use tracking, analytics, or advertising cookies. These essential cookies do not require consent under the ePrivacy Directive as they are necessary for the service you have requested. You can control cookies through your browser settings, but disabling essential cookies may prevent the service from functioning correctly.

11. Children's Privacy

Our services are directed at businesses and are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children under 18. If we become aware that we have inadvertently collected personal data from a child under 18, we will take steps to delete such data promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by email or through a prominent notice on our platform at least 14 days before such changes take effect. The "Last updated" date at the top indicates when this policy was last revised. Your continued use of the Service after the effective date of changes constitutes your acceptance of the updated policy. If you do not agree with the changes, you must stop using the Service and may request deletion of your account.

13. Disclaimer of Warranties

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SERVICE IS PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS. LMG OPTIMIZE BV MAKES NO WARRANTIES, EXPRESS OR IMPLIED, REGARDING THE SERVICE, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, OR THAT THE SERVICE WILL BE UNINTERRUPTED, ERROR-FREE, OR COMPLETELY SECURE. ANY RELIANCE ON THE SERVICE IS AT YOUR OWN RISK.

14. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE BELGIAN AND EU LAW:

• LMG OPTIMIZE BV shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, revenue, data, business opportunities, or goodwill, arising out of or in connection with your use of or inability to use the Service, even if advised of the possibility of such damages.
• LMG OPTIMIZE BV shall not be liable for any damages arising from: (a) unauthorized access to or alteration of your data caused by third parties or by your failure to maintain adequate security of your credentials; (b) interruptions, delays, or failures caused by third-party service providers (including payment processors, hosting services, and email providers); (c) force majeure events including but not limited to cyberattacks, natural disasters, government actions, pandemics, power outages, or telecommunications failures; (d) your failure to comply with these terms or to implement reasonable security practices.
• The total aggregate liability of LMG OPTIMIZE BV for all claims arising out of or related to this policy or the Service shall not exceed the total amount of fees paid by you to LMG OPTIMIZE BV in the twelve (12) months immediately preceding the event giving rise to the claim, or one hundred euros (€100), whichever is greater.
• Nothing in this section shall limit liability for damages caused by intentional misconduct (opzet/dol) or gross negligence (grove schuld/faute lourde) of LMG OPTIMIZE BV, or for any liability that cannot be excluded or limited under mandatory Belgian or EU law, including obligations under the GDPR for which LMG OPTIMIZE BV is directly responsible as data controller.
• Any claim arising under or in connection with this policy must be brought within twelve (12) months after the cause of action arises, after which the claim is permanently barred to the extent permitted by law.

15. Indemnification

You agree to indemnify, defend, and hold harmless LMG OPTIMIZE BV, its directors, officers, employees, and agents from and against any and all claims, damages, losses, liabilities, costs, and expenses (including reasonable legal fees) arising out of or related to: (a) your use of the Service in violation of this policy or applicable law; (b) your violation of any third-party rights, including intellectual property or privacy rights; (c) any data or content you submit, store, or process through the Service; or (d) your failure to maintain adequate security of your account credentials.

16. Governing Law and Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with Belgian law. Any disputes arising from or in connection with this policy shall be subject to the exclusive jurisdiction of the courts of Belgium. This does not affect your rights under mandatory consumer protection laws of your country of residence, where applicable.

17. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data protection rights, or have concerns about our data practices, contact us:

• LMG OPTIMIZE BV
• VAT: BE0785858168
• Email: privacy@tablemate.be