Last updated: 2026-09-02

This Privacy Policy explains what personal data we collect when you use ohlilas.be (and the Restaurant's mobile app and QR table ordering), why we collect it, how long we keep it and what your rights are. We have tried to write it in plain language. If anything is unclear, contact us at ohlilas@hotmail.com.

1. Who is responsible for your data

The controller of your personal data is:

Oh Lilas Sushi (trading as Oh Lilas Sushi)
Rue du Commerce 29, 6900 Marche-en-Famenne
Company number (KBO/BCE): 1020.791.376
VAT: BE1020791376
E-mail: ohlilas@hotmail.com · Telephone: 084 313417

This is the Restaurant's own website. The Restaurant decides why and how your data is used. The website and ordering system are built, hosted and maintained for the Restaurant by our website developer and hosting provider, which acts as a processor: it only handles your data on the Restaurant's instructions and does not use it for its own purposes.

2. What data we collect and why

We only collect the data we need to take and fulfil your order.

Data Why we need it Legal basis
Name, telephone number, e-mail address To confirm your order, prepare it, contact you about it and hand it over to the right person Performance of the contract (art. 6(1)(b) GDPR)
Delivery address To deliver your order and to check that the address is inside our delivery area Performance of the contract
Your order: dishes, options, amount, delivery or collection time, order note To prepare the order, print it in the kitchen, and handle complaints Performance of the contract
Table number (QR ordering) To bring the order to your table Performance of the contract
Payment method and payment status (not your card details, see section 3) To know whether an order has been paid Performance of the contract
Order amount, VAT, date, invoice details Bookkeeping and tax obligations Legal obligation (art. 6(1)(c))
Account data (e-mail, password in hashed form, saved addresses, order history) if you create an account To let you log in and reorder faster Performance of the contract
Order frequency and spend per customer To offer loyalty rewards to regular customers and to prevent abuse of vouchers Legitimate interest (art. 6(1)(f)) — you can object, see section 6
Technical data: IP address, browser type, pages visited, time of request Security of the website, detecting fraud and automated abuse, error diagnosis Legitimate interest
Language preference, cart contents, table code To make the website work while you order Legitimate interest / technically necessary

"Performance of the contract" means: by placing an order you enter into a contract with the Restaurant, and we need this data to carry out that order. No separate consent is required for it. Providing the data marked "performance of the contract" is necessary to place an order; without it we cannot accept or deliver the order. Creating an account is optional.

Marketing: we do not send newsletters or advertising unless you have given your consent (art. 6(1)(a)). E-mails about your order (confirmation, on its way, ready for collection) and, where the Restaurant offers it, a voucher you have earned through your orders, are not marketing: they are part of the service you asked for.

Automated decisions: we do not take decisions about you based solely on automated processing that have legal or similarly significant effects. The automatic checks described in this policy (delivery area, bot detection) only affect whether an order or registration can be completed technically.

3. Who receives your data

We do not sell or rent your data. We share it only with the parties needed to fulfil your order:

  • our website developer and hosting provider — hosting and maintenance of the website and of the Restaurant's order-receiving system (the screen, printer or app in the Restaurant on which your order appears, and the monthly bookkeeping statement). Servers are located in the European Union.
  • The payment service provider (MultiSafepay, Stripe or Mollie, as shown at checkout) — when you pay online. The payment service provider processes your card or bank details itself as an independent controller; the Restaurant never sees or stores your card number. See the privacy policy of the payment service provider concerned for details.
  • Google LLC (Google Maps Platform) — when you enter a delivery address, the address (and only the address) is sent to Google's geocoding service to locate it and calculate the distance to the Restaurant, so that we can check the delivery area and delivery charge. Google may process this in the United States under the EU-US Data Privacy Framework.
  • Our delivery staff or courier — receive your name, address, telephone number and order for delivery.
  • Our accountant and the tax authorities — receive bookkeeping data (amounts, VAT, dates), which is aggregated per month and does not identify you as a customer.
  • Authorities — where we are legally required to do so.

4. How long we keep your data

Data Retention
Completed and refunded orders in the website 3 years after the order, then automatically anonymised and deleted (name, address, e-mail and telephone are removed)
Orders that were cancelled, failed or never paid Deleted automatically within a short period
Customer accounts Deleted after 3 years without any login or order; you can delete your account earlier by asking us
Copy of the order in the Restaurant's order-receiving and bookkeeping system The customer's contact details are kept for up to 6 months after your last order, then removed. The remaining record (dishes, amounts, date) no longer identifies you.
Server access logs (IP address, pages requested) Kept for a short period for security purposes, then deleted
Cookies See section 5

Where we have to keep something longer to comply with the law or to handle a dispute, we keep only what is needed for that purpose.

5. Cookies

This website uses only cookies that are needed to make ordering work. We do not use advertising cookies, social-media cookies or third-party analytics cookies on this website; these cookies are exempt from the consent requirement.

All cookies listed below are set by this website itself (first-party cookies) and cannot be read by third parties. Their contents are stored only in your browser; on our side, only the session data needed to process your order is kept, for the duration of the session.

Cookie Purpose Duration
PHPSESSID Technical session identifier that keeps your ordering session together from page to page Session
WooCommerce session and cart cookies (wp_woocommerce_session_*, woocommerce_cart_hash, woocommerce_items_in_cart) Remember what is in your cart while you order Up to 2 days
WordPress login cookies (wordpress_logged_in_*, wordpress_sec_*, wp-settings-*) Keep you logged in to your account and remember your account display settings 2 days, or 14 days if you tick "remember me"; settings cookies 1 year
chosen_lang Remember the language you chose 5 years
AC_qrtable, AC_qrtable_non_buffet Remember which table you are ordering from after scanning the QR code 4 hours (up to 14 days in buffet mode)
billing_*, delivery_method_* Remember the address and delivery choice you typed so you do not have to retype it if the page reloads Session / a few seconds
success_order_email Show the order-tracking button for the order you have just placed 12 hours
Notice cookies (shownotibyasiacuisine, _shopclosednoti_viewed) Remember that you have closed an information message (e.g. "we are closed today") Session
sidemenu_scroll_top Remember your position in the menu Session

You can delete cookies at any time in your browser settings; the website may then not remember your cart or login.

6. Your rights

Under the GDPR you have the right to:

  • access the personal data we hold about you and receive a copy;
  • rectify data that is inaccurate or incomplete (you can change your account details yourself after logging in);
  • erase your data, where we no longer need it — note that we may have to keep bookkeeping data that the law obliges us to keep, in which case we will tell you;
  • restrict processing while a dispute about the data is being resolved;
  • object to processing based on our legitimate interest, including to being included in the loyalty programme;
  • data portability: receive the data you gave us in a machine-readable format;
  • withdraw consent at any time, where processing is based on consent (for example marketing e-mails), without affecting processing that took place before.

To exercise a right, e-mail ohlilas@hotmail.com or write to the address in section 1. Tell us the e-mail address or telephone number you used when ordering so that we can find your data; we may ask you to confirm your identity. We answer within one month; if a request is complex we may extend this by two months and will tell you.

You also have the right to lodge a complaint with the Belgian Data Protection Authority: Gegevensbeschermingsautoriteit / Autorité de protection des données, Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels, contact@apd-gba.be, www.dataprotectionauthority.be. We would appreciate the chance to resolve your concern first.

7. Changes to this policy

We may update this policy when our website or the law changes. The date at the top shows the latest version.

Questions about your data: ohlilas@hotmail.com · 084 313417