Privacy Policy

Jeffrey's Private Breakfast Experience (“Jeffrey's”, “we”) decides why and how your personal data is processed. In the words of the GDPR, we are the controller.

You can reach us at:

August Petenlei 36, 2100 Deurne, Belgium

info@jeffreysbreakfast.be

+32 456 55 19 94

If anything in this policy is unclear, write to that address and a person will answer — there is no separate privacy department.

2.1 When you request a booking

The booking form asks for exactly what is needed to cook a breakfast at your table and to write back to you:

• the date you would like and the package you chose, including extra guests, champagne and caviar;
• your name, e-mail address and telephone number;
• the address where we would be cooking;
• how many of the guests are children;
• whether there will be pets in the house, and which;
• anything you tell us about getting in and setting up — stairs, parking, a kitchen that will not fit two people;
• allergies, intolerances and diets, including the boxes you tick and anything you write in your own words;
• a company name and VAT number, if you ask for the booking to be invoiced to a company;
• which consents you gave, and when.

Nothing on this page is optional theatre: every field above ends up either in the kitchen, in the van, or in the reply you get.

2.2 When you send a message through the contact form

Your name, e-mail address, telephone number and the message itself.

2.3 When you write to us some other way

If you contact us by e-mail, telephone, WhatsApp or Instagram, we see whatever that service shows us — for WhatsApp and Instagram that includes your profile name and number, and those services process the conversation under their own privacy policies, not ours.

2.4 Automatically, while you use the site

Both forms are protected by Cloudflare Turnstile, which checks that a request comes from a person rather than a script. To do that, Cloudflare receives your IP address and technical details about your browser, and may store a short-lived technical token in it. It is not used to profile you or to advertise to you.

The site counts visits with Cloudflare Web Analytics, which works without cookies and without following you to other sites. That is why this site has no cookie banner: there is nothing to ask you about.

While you fill the booking wizard in, your answers are kept in your own browser so a reload does not lose them. They stay on your device and reach us only when you press the final button.

What you tell us about allergies, intolerances and diets can say something about your health, or about the health of the people at your table. European law treats that as a special category of personal data and protects it more strictly than the rest.

We ask for it for one reason: Jeffrey shops for and cooks your breakfast himself, and he cannot cook around what he does not know. Before you can send the form you tick a box that explicitly allows us to use this information for that purpose — that consent (Article 9(2)(a) GDPR) is what makes the processing lawful.

We use it to prepare and serve your breakfast safely, and for nothing else. We do not pass it to anyone who is not involved in cooking or serving it.

You can withdraw that consent at any time by writing to us. We will delete the information; do note that from that moment we can no longer guarantee that a dish avoids what you had told us about.

Each kind of data has its own legal basis:

• Your request and the exchange that follows — to take steps at your request before a contract, and afterwards to perform it (Article 6(1)(b) GDPR).
• Allergies, intolerances and diets — your explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR).
• Spam protection and keeping the site standing — our legitimate interest in not having the form abused (Article 6(1)(f) GDPR).
• Invoices and bookkeeping — a legal obligation we cannot contract out of (Article 6(1)(c) GDPR).

We make no automated decisions about you, and we do not profile you.

5.1 Allergy and health information

Deleted or genuinely anonymised 30 days after the booking has been completed, unless the law or a live dispute requires us to keep it longer. Anonymised means it can no longer be traced back to you.

5.2 Requests that never became a booking

If you ask about a morning and nothing comes of it, we delete the request within 14 days of the last message about it — the whole message, including whatever you told us about allergies. It is the same information a completed booking has deleted after 30 days, and a request that led nowhere has no better claim to be kept.

Separately from that, the copy kept by Resend, the service that delivered the e-mail, expires on its own after 30 days (see section 7).

If you come back after that, you will be filling the form in again. That is a minute of your time, and it is the honest trade for not leaving health information sitting in a mailbox after a conversation that went nowhere.

5.3 Bookings, invoices and bookkeeping

Belgian law currently requires accounting documents and invoices to be kept for ten years, and we keep them for that long. This is also what lets us prove what was agreed if it is ever disputed.

5.4 Messages from the contact form

Kept as long as the conversation is useful, and deleted once it is not.

We do not sell your data and we do not hand it to anyone for their own purposes. It is seen by the services that make this site and Jeffrey's mailbox work, each of them bound by a contract to process it only on our instructions:

• Resend — delivers the e-mails this site sends, which means it handles the contents of your request.
• Google Workspace — the mailbox in which Jeffrey reads and answers them.
• Cloudflare — the platform the site itself runs on, which means the contents of both forms pass through it on their way to Resend; also the Turnstile check and the analytics described above.

Beyond that, we share data only where the law requires it — for instance with our accountant, or with the tax authorities.

Resend stores the content of the e-mails it delivers for 30 days, on servers in the United States. That is a transfer outside the European Economic Area, and it happens to every request you send through this site, because the request reaches Jeffrey as an e-mail.

Cloudflare runs the site on a worldwide network and handles each visit in the data centre nearest to the visitor — for someone in Belgium, normally one in Europe. It does not promise that, though, so your request may pass through a data centre outside the European Economic Area.

Both transfers take place under data processing agreements that rely on the European Commission's standard contractual clauses. If you would rather not have your request travel that way, send it by telephone or WhatsApp instead and nothing goes through our forms.

The connection between your browser and this site is encrypted. The mailbox that receives your request is protected by a password and a second factor, and Jeffrey is the only person who reads it.

No system is beyond reach. If personal data is ever breached in a way that puts you at risk, we will tell the Belgian Data Protection Authority within 72 hours and, where the law requires it, you as well.

Over the data we hold about you, you have the right to:

• ask what we hold and get a copy of it;
• have what is wrong corrected;
• have it deleted, where nothing obliges us to keep it;
• restrict what we do with it while something is being sorted out;
• receive it in a portable, machine-readable form;
• object to processing we base on our legitimate interest;
• withdraw a consent you gave, without that affecting what was lawful before.

Write to the address in section 1 and we will answer within one month. We may ask something that confirms it is really you — we would rather ask than hand your data to somebody else.

You can also complain to the Belgian Data Protection Authority: Gegevensbeschermingsautoriteit, Drukpersstraat 35, 1000 Brussel, contact@apd-gba.be. We would prefer you told us first, so we can put it right.

When this policy changes, the version and date at the top of the page change with it. The version you agreed to when you booked is the one that applied to that booking; ask us and we will send it to you.