1. WHO WE ARE
This website is operated by Trinity Food Services B.V. (trading as Nabati Eatery), registered with the Dutch Chamber of Commerce (KVK) under number 96447044, VAT identification number NL867614961B01, at Keizerstraat 168, 3011 GH Rotterdam, Netherlands.
We are the controller of the personal data described on this page, which means we decide why it is collected and what happens to it. We are one restaurant and are not required to appoint a Data Protection Officer, so anything on this page comes straight to us: info@nabatieatery.com or +31 6 25417757.
This website and our email are hosted by Dreamscape Networks International Pte Ltd.
2. WHAT THIS WEBSITE COLLECTS
You cannot order, pay or check out on this website, so we never see your card details here. Ordering happens on Uber Eats and Thuisbezorgd, which are separate companies with their own privacy policies; what you type there is theirs to explain, not ours. What this site collects is narrower than that:
- The contact form. Your name, email address, phone number and the message you write.
- The catering enquiry form. The same four, plus the date of your event, the number of guests, and anything you tell us about dietary requirements.
- Spam protection. Both forms use Google reCAPTCHA, which looks at how you interact with the page and sends that signal, together with your IP address, to Google.
- Bookings and enquiries by phone or email. Whatever you tell us so that we can hold the table or quote for the job.
- Website measurement. Pages viewed, approximate location, device and browser, through the cookies described in section 9.
- Server logs. Our host records the IP address of every request as ordinary security housekeeping.
We do not ask you for anything about your health, your beliefs or your background. If you tell us about an allergy or a dietary requirement so that we can cook for you, we use it to cook for you and for nothing else.
3. WHY WE ARE ALLOWED TO PROCESS IT
- To take steps at your request before a contract, and to perform one (Article 6(1)(b)). Answering your enquiry, quoting for catering, holding your table, and delivering a catering job you have booked.
- Your consent (Article 6(1)(a)). Non-essential cookies, marketing email, and publishing a review you have given us permission to publish. You can withdraw consent at any time and it costs you nothing to do so.
- Legal obligation (Article 6(1)(c)). Keeping invoices, and the records behind them, for the Dutch tax authority.
- Our legitimate interests (Article 6(1)(f)). Keeping the site running, keeping spam and abuse off our forms, and defending a legal claim if one is ever made. We have weighed these against your rights and consider them proportionate. If you disagree, section 8 tells you how to object.
4. WHO ELSE SEES IT
We do not sell or rent personal data, and we do not share it for anyone else’s marketing. These are the companies that handle it for us, or that receive it because of a tool running on this site:
- Dreamscape Networks International Pte Ltd — hosting for this website and our email.
- NitroPack — the caching and delivery layer that serves these pages.
- Google — Google Analytics and Google Site Kit for website measurement, and reCAPTCHA for spam protection on our forms.
- Meta — the Meta pixel, which reports how this website is used back to our Facebook and Instagram advertising.
- Our accountant, and the Dutch tax authority — invoices and the records behind them.
- Authorities, where the law requires it.
Some of these providers store or access data outside the European Economic Area. Where that happens we rely on the European Commission’s Standard Contractual Clauses, or another transfer mechanism permitted by Chapter V of the GDPR.
We do not make any decision about you by automated means, and we do not profile you.
5. HOW LONG WE KEEP IT
The GDPR does not set retention periods. Article 5(1)(e) requires only that we keep personal data no longer than is necessary for the purpose we collected it for, and Article 13(2)(a) requires us to tell you either how long that is or how we decide. Below is our answer, and where each period comes from.
- Enquiries that lead nowhere — 12 months. If you write to us and nothing follows from it — no booking, no catering job, no invoice — we delete the message and your details 12 months after your last contact. This is our own rule, made under Article 5(1)(e). No law sets it.
- Catering enquiries that became an invoice — 7 years. Once an enquiry turns into work we have invoiced, it becomes part of our accounts, and we are then required to keep it for seven years by the Dutch tax retention obligation (fiscale bewaarplicht, article 52(4) of the Algemene wet inzake rijksbelastingen). That is a tax obligation rather than a privacy one, and it overrides the 12-month rule above.
- Your cookie choice — 12 months. We have to be able to show that you consented, so we store what you chose and when. After 12 months the record expires and the banner asks you again.
- Google Analytics — 14 months. Measurement data is deleted by Google 14 months after your visit.
- A review you gave us permission to publish — until you withdraw it. There is no fixed end date. Tell us and we take it down.
6. HOW WE PROTECT IT
The site runs over HTTPS, access to enquiries within our team is limited to the people who need it to do their job, and our host is responsible for the security of the servers this site sits on. No system is perfect, and we would rather say that than promise otherwise.
7. WHAT WE DO NOT DO
- We do not sell your data, and we never have.
- We do not take payments on this website.
- We do not send marketing email unless you asked for it.
- Our services are not aimed at children under 16, and we do not knowingly collect their data. If you think a child has sent us something, tell us and we will remove it.
8. YOUR RIGHTS
Under the GDPR you can ask us to:
- show you the personal data we hold about you (Article 15);
- correct it if it is wrong or incomplete (Article 16);
- delete it (Article 17);
- restrict what we do with it (Article 18);
- hand it to you, or to someone else, in a portable format (Article 20);
- stop processing it where we rely on our legitimate interests (Article 21);
- stop sending you marketing, which we will do immediately and without asking why.
You can also withdraw consent at any time, which does not affect anything we did before you withdrew it.
Write to info@nabatieatery.com. We answer within one month. There is no charge, and we will not ask you to justify the request.
If you are not satisfied with how we have handled your data, you have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens. We would rather you came to us first, but that is your right and not ours to gate.
9. COOKIES
Essential cookies keep the site working and are set without asking, because the site cannot function without them. Everything else — measurement and advertising — is covered by our consent banner, and you can change or withdraw your choice at any time from the banner. Our Cookie Policy lists every cookie by name, what it is for and how long it lasts.
10. CHANGES TO THIS POLICY
We update this page when what we do changes. The date below is the last time it changed.
Last updated: 21 August 2026
11. CONTACT US
Email: info@nabatieatery.com
Phone: +31 6 25417757
Address: Keizerstraat 168, 3011 GH Rotterdam, Netherlands
Company: Trinity Food Services B.V. — KVK 96447044 — VAT NL867614961B01
