Privacy policy

1. Who we are

Avintas is operated by SKKILLS BV, with its registered office at Steenbrugsestraat 14, 8210 Zedelgem, Belgium and enterprise number BE1032213622.

For privacy questions or to exercise your rights, please use our contact form and mention that it is a privacy request.

2. Our role

Our role depends on whose data it is:

• Guest data (reservations, contact details, messages): the restaurant you book with is the controller. Avintas processes this data as a processor, on behalf of and according to the instructions of that restaurant.
• Data of our customers (accounts of restaurant owners and their staff, subscriptions and billing): here SKKILLS BV itself is the controller.

Are you a guest who wants to see, correct or erase your data? Please contact the restaurant first. Restaurants can export and erase a guest's data directly in Avintas. If you contact us instead, we will pass your request on to the restaurant concerned.

3. What data we process

• Account data: name, email address, password (stored only as an encrypted hash), language preference and your role within a restaurant.
• Restaurant data: name, address, opening hours, tables, menus and settings, and the details of your subscription.
• Guest booking data: name, email address, phone number, date, time and party size, special requests, the restaurant's notes and tags, and the visit and no-show history at that restaurant.
• Guest birthday (optional): only when you give it yourself, so the restaurant can send you a treat around your birthday. Never shown to others and removed on request.
• Payment data: payments for deposits, gift vouchers, tickets and subscriptions are handled by Stripe. We receive the amount and status of a payment, never your full card details.
• Messages: the confirmations, reminders and other emails or text messages we send on behalf of a restaurant, with their delivery status.
• AI conversations: what you type into the AI assistant or the AI host, and the replies.
• Technical data: log files including IP address, time and error messages, to keep the service secure and working.

4. Why, and on what legal basis

• To provide the service a restaurant has contracted us for: taking, confirming and reminding of reservations, assigning tables and processing payments (performance of a contract).
• To manage your account and bill your subscription (performance of a contract, and our legal accounting obligations).
• To secure the service, prevent abuse and trace errors (legitimate interest).
• To estimate the likelihood of a no-show from the visit history at the same restaurant, so the restaurant can send better-timed reminders (legitimate interest). This estimate never by itself leads to a booking being refused.
• To send a restaurant's newsletters and promotional emails (consent). Every promotional email contains a link to unsubscribe immediately.

5. Who we share data with

We do not sell personal data. We work with the following service providers, who as sub-processors each receive only the data they need for their task:

• DigitalOcean (hosting)
• Stripe (payments)
• Mailgun (email delivery)
• Anthropic (AI features)
• Twilio (text messages, only when a restaurant uses them)
• Better Stack (logging)
• Google Analytics (website statistics)
• PostHog (website statistics)

Some of these parties process data outside the European Economic Area. When they do, it is on the basis of the European Commission's standard contractual clauses or another lawful transfer mechanism.

Guest data is shared with the restaurant the guest books with. Beyond that, we only disclose data when the law requires us to.

6. How long we keep data

• Guest data is automatically anonymised three years after the guest's last visit to a restaurant. The reservations remain for the restaurant's statistics but can no longer be traced to a person.
• The log of sent messages is deleted after two years.
• Conversations with the AI assistant are deleted after 90 days.
• Account data is kept for as long as your account exists. When you delete your account, it is anonymised straight away.
• Invoices and the accounting records that go with them are kept for seven years, as Belgian law requires.
• When a restaurant is deleted, the data of its guests is anonymised straight away.

7. Security

Data is sent encrypted. Passwords are stored only as an encrypted hash. Within a restaurant, each staff member sees only what their role allows, and access by Avintas staff is limited to what support and administration require.

8. Your rights

You have the right to:

• see the data we hold on you (access);
• have incorrect data corrected (rectification);
• have your data erased (to be forgotten);
• have the processing restricted;
• object to processing based on legitimate interest, and always to direct marketing;
• receive your data in a common, machine-readable format (portability);
• withdraw any consent you gave, at any time.

You can change your name and language and delete your account yourself, in the dashboard settings. For anything else, please use our contact form; we reply within one month.

If you disagree with how we handle your data, you can lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels (gegevensbeschermingsautoriteit.be).

9. Cookies and local storage

To see how the site is used and to be able to improve it, we measure visits with Google Analytics (Google Ireland Limited) and PostHog (servers in the European Union). We use no advertising or profiling cookies, and we do not sell data.

We ask for your consent with a notice at the bottom of the page. Until you accept — and also if you decline — we measure without storing anything on your device: no cookies, no local storage, and an identifier generated by the measurement service itself that cannot be traced back to you. If you accept, we set these cookies:

The following are needed for the site to work. They are there without consent too, and the law does not require us to ask for them:

The booking widgets restaurants place on their own website measure nothing and set no cookies.

We keep your choice for a year, after which we ask again. You can revisit it at any time through the Cookie choice link at the bottom of every page — withdrawing consent is as easy as giving it. What we measured before you withdrew stays until the retention period below runs out.

Measurements at Google Analytics are kept for fourteen months. Measurements at PostHog stay with the project for as long as we use it; you can have them erased through our contact form.

10. Changes

We update this policy when the service or the law changes. The date at the top shows the latest change. We notify customers of significant changes by email in advance.