Privacy Statement

1. Who we are

Plus258 is a Mozambican-Portuguese catering company based at Amstellaan 31, 5691 HD Son (Netherlands), registered with the Dutch Chamber of Commerce (Kamer van Koophandel) under number 98160079. Contact: gabi@plus258.nl · phone +31 6 3827 2619.

We are the "data controller" for personal data processed via plus258.nl and our catering operations, as defined in the General Data Protection Regulation (GDPR).

2. What personal data we process

We process personal data that you provide to us yourself:

• Booking form: name, email address, phone number (optional), event type, guest count, date and any notes.
• Wholesale form: company name, contact person, email, phone, products of interest, desired quantity.
• Phone & email: if you contact us directly: your message and contact details.
• Invoicing: on confirmed bookings: address, optional VAT/CoC number for business invoices.

Additionally, Google Analytics (see section 5 and our cookie statement) processes anonymised usage data (anonymised IP address, pages visited, device, broad location).

3. What we use the data for

• Responding to your enquiry — sending a quote, answering questions, planning a tasting. Legal basis: performance of the contract (GDPR art. 6(1)(b)) or consent for general information requests (a).
• Delivering the catering — coordinating with you and the venue. Legal basis: performance of contract.
• Invoicing and statutory bookkeeping — Dutch fiscal retention period of 7 years. Legal basis: legal obligation (c).
• Improving the website — via anonymised statistics. Legal basis: legitimate interest (f).

4. How long we keep data

• Enquiries without a booking: 12 months after last contact, then deleted.
• Booking records + invoices: 7 years (fiscal retention obligation).
• Analytics data (GA4): Google's default 14 months.

5. Third parties that process data on our behalf

We share personal data only with parties that help us deliver our service, under data-processing agreements where required:

• FormSubmit (form delivery) — United States. We only send the data you enter in the form; FormSubmit forwards it to our email.
• Google Analytics 4 (statistics) — United States/EU. Anonymised IP, no profile-building for ads.
• Google (Gmail) — our business email runs on Google Workspace.
• Our own server infrastructure — hosted in the Netherlands.

Transfers outside the EEA (to the US) are based on Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework.

6. Cookies

Our website uses cookies for measuring visitor statistics. A full overview and opt-out instructions are in our cookie statement.

7. Security

We protect personal data with encrypted connections (HTTPS), access control to our email, and backups on encrypted storage. The number of people with access is limited to the founder and direct collaborators where necessary.

8. Your rights

Under the GDPR you have the right to:

• Request a copy of the personal data we process about you;
• Have incorrect data corrected;
• Have your data erased (where fiscal retention obligations do not block this);
• Restrict or object to processing;
• Request data portability;
• Withdraw consent for processing based on consent.

Send your request by email to gabi@plus258.nl. We respond within 30 days. You may also lodge a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

9. Changes to this statement

We may update this statement when our services or applicable law require it. The version date at the top is always current; we will also note substantive changes on this page.