Privacy statement Jesdi

Version 1.1 · effective from 19 November 2026

This is a translation of the Dutch original. This document is governed by Dutch law. In case of any difference in meaning, the Dutch version prevails.

Jesdi supplies an online reservation system to restaurants and other hospitality businesses. In this privacy statement you can read which personal data we process, why, and what rights you have.

Have you made a reservation at a restaurant? Then that restaurant is responsible for your data and we are only the supplier of the system (processor). For questions, access or deletion, please see the restaurant's privacy statement or contact the restaurant. You can always unsubscribe from a restaurant's newsletter via the link at the bottom of every e-mail. See also Data of restaurant guests.

Who are we?

Jesdi, established at Eksterstraat 139, 1742ER Schagen, registered with the Netherlands Chamber of Commerce (Kamer van Koophandel, KvK) under number 42210195, is the controller for the processing operations described in this statement. You can reach us at info@jesdi.nl.

Which data do we process, why and on what legal basis?

Whose data	Which data	Why	Legal basis
Customers (restaurants) and their contact person	Name, e-mail address, telephone number, company name, address, company registration number (KvK), VAT number, payment details such as IBAN and direct debit mandate	Creating and managing the account, providing the service, invoicing and contact about the service	Performance of the contract
Customers	Which version of the terms and conditions and data processing agreement was accepted, when and by whom, with a hashed representation of the IP address	Being able to demonstrate that the agreement was concluded	Legitimate interest
Users of the back office and app	Name, e-mail address, encrypted password, login times, the days on which you use the back office or app, device data for push notifications	Secure login and sending notifications	Performance of the contract
Users who share an idea, vote or comment	Your idea, votes and comments, linked to your name, e-mail address and restaurant. Other restaurants see them without a name.	Improving Jesdi with your ideas, and being able to ask what you mean or let you know when it is ready	Legitimate interest
Anyone who e-mails us or fills in the sign-up form	The data you send us	Answering your question, processing your sign-up	Performance of the contract or legitimate interest
Anyone who logs in or tries to log in to the back office, the app or our admin	Email address or username, time, whether it succeeded, IP address, browser and operating system	Protecting accounts against break-ins: recognising and blocking suspicious attempts, and warning you about a login from a new device	Legitimate interest
Visitors to our website and the service	IP address, browser data, time, in server logs	Security, preventing misuse and resolving faults	Legitimate interest
Customers	Invoice data	Complying with the statutory tax retention obligation	Legal obligation
Anyone who uses the free visibility check on our website	Name and town of the restaurant, website, the result of the check, your email address, your consent (the text you ticked, the time and a hashed version of your IP address) and the website or campaign you came from	Running the check, emailing you the report and contacting you about your restaurant’s visibility and about Jesdi, by Jesdi or a Jesdi reseller (partner) in your region, who receives your details from us for that purpose only	Consent (you can withdraw it at any time via the link in the report)
Jesdi resellers (partners)	Name, contact person, email address, address, IBAN, logins to the partner portal	The partnership, paying the commission and logging in securely to the partner portal	Performance of the contract
Jesdi area managers	Name, contact person, email address, address, company and VAT number, IBAN, the digital acceptance of the agreement (name, time, hashed IP address), statements and logins to the portal	The cooperation, the statement and payment of the fee, and secure login to the portal	Performance of the agreement and legal retention obligation (accounting)
Applicants (area manager vacancy)	Name, email address, phone number, country and region, LinkedIn or website (if provided), your motivation and a hashed IP address	Handling the application and contacting you	Consent; we delete your data 4 weeks after a rejection, and at the latest one year after your application

We do not sell personal data and do not use it for advertising. For the staffing advice we add up the hours worked per restaurant by function (kitchen, service, bar); only those totals, never data about an individual employee, are included anonymously in averages across at least 5 restaurants. We do not take decisions based solely on automated processing.

How long do we keep data?

Account data: for as long as the customer uses the service, and up to 90 days thereafter.
Invoices and accounting records: 7 years, due to the statutory tax retention obligation.
POS data of restaurants that use the POS (receipts, payments and the POS journal): at least 7 years after the end of the financial year, due to the restaurant's statutory tax retention obligation; after that, deleted at the restaurant's request.
Proof of acceptance of the terms and conditions: for the duration of the agreement plus 2 years.
Server logs: no more than 90 days.
Log of login attempts (security): 180 days.
Visibility check: 12 months after the check. If you withdraw your consent, we delete your email address immediately; the business details of the check are then kept for at most 6 more months.
E-mails with questions: for as long as necessary to deal with the question, no more than 2 years.

With whom do we share data?

We engage only parties that are necessary to provide the service, and where necessary we conclude a data processing agreement with them:

Strato GMBH for hosting and back-ups (NL);
STRATO AG for sending e-mail (Germany, EU);
the notification services of Google, Apple, Mozilla and Microsoft for encrypted push notifications (they cannot read the content);
Moneybird B.V. (Netherlands), for our accounting, sending invoices and the direct debit of customers' subscriptions;
our accountant, for our accounting records.

We only provide data to others if the law requires us to do so.

Transfers outside the EEA

We store data within the European Economic Area. Only encrypted push notifications pass through services that also operate outside the EEA; for these, the EU-U.S. Data Privacy Framework or standard contractual clauses of the European Commission apply.

Cookies

Our website and the service use only functional cookies that are necessary to log in and stay logged in. We do not use tracking, advertising or analytics cookies. That is why we do not ask for consent for cookies. The reservation widget on a restaurant's website does not place any cookies.

To see how our website is used, we count visits to jesdi.nl without cookies: which page, which website or campaign you came from, the type of device and the language. To count different visitors, your browser keeps a random number in the website's local storage (not a cookie, not readable by other websites). We store that number only in encrypted form, replace it after 13 months, and you can remove it by clearing this website's data in your browser. In addition, your device receives an anonymous daily identifier based on a key that is replaced every day. We do not store IP addresses, share nothing with others and do not link visits to a person. If Do Not Track is enabled in your browser, we do not count you. The counts stay on our own server and are deleted after 400 days. These are analytical data with little impact on your privacy; the legal basis is our legitimate interest in improving our website.

Security

We secure data with measures including encrypted connections (HTTPS), passwords stored in encrypted form, monitoring of login attempts with automatic blocking in case of abuse, strict separation between restaurants and regular back-ups. A comprehensive list can be found in Annex 2 of our data processing agreement.

Data of restaurant guests

If you make a reservation via a restaurant's website, the restaurant records your name, e-mail address, telephone number, the reservation and any comments in our system. The restaurant is the controller for this; we process those data only on behalf of the restaurant, in accordance with our data processing agreement. The restaurant can also see how often you have visited and, if it uses the Jesdi POS, what you spend on average and what you often order, so it can welcome you personally on your next visit.

You will only receive newsletters, a monthly menu or other marketing e-mails from the restaurant (such as a birthday greeting, an e-mail after a cancellation or no-show, or an invitation if you have not visited for a long time) if you ticked the box for this yourself when making your reservation. You can unsubscribe with one click at the bottom of every e-mail.
If you tick that box, you can also enter your birthday (day and month only, no year of birth). It is used for the birthday e-mail and so the restaurant can see it is your birthday when you book around that date. It is deleted if you unsubscribe.
If you have given that consent, the restaurant may send you one e-mail after your visit asking for a review (stars and optionally a short text). Leaving a review is voluntary. Only your stars, your text, the month of your visit and, if you tick the box, your first name with the initial of your surname appear on the restaurant's website. The restaurant can reply publicly. If your data is erased, your text and name disappear; the stars continue to count anonymously.
If the restaurant offers booking via Google and you book in Google Search or Maps, Google passes your name, e-mail address, telephone number and the reservation to the restaurant through our system. This does not sign you up for newsletters or marketing e-mails. Google's own privacy policy applies to what Google itself does with your data.
If you book through another platform the restaurant works with (for example DiningCity or Social Deal), your name, contact details and the reservation enter our system, directly from that platform. This does not sign you up for newsletters or marketing e-mails either, unless you give consent yourself.
You can view or cancel your reservation via the link in your confirmation e-mail.
Would you like access, correction or deletion? Please contact the restaurant; the restaurant can arrange this directly in our system. If you e-mail us, we will forward your request to the restaurant.

Your rights

You have the right to access your data, to have it corrected or deleted, to have its processing restricted, to object to processing based on legitimate interest, and to receive your data in a commonly used format (data portability). Send your request to info@jesdi.nl. We will respond within one month and may ask you to confirm your identity.

Do you have a complaint about how we handle your data? Let us know and we will work with you to find a solution. You also always have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Governing law

This privacy statement and the processing of personal data by Jesdi are governed by Dutch law, alongside the GDPR. This does not affect the rights you have under the GDPR, such as the right to lodge a complaint with the supervisory authority in the country where you live or work.

Changes

We may amend this privacy statement. The date at the top shows when this was last done. In the event of important changes, we will inform customers by e-mail.