Privacy statement
Version 1.0 · last updated 19 September 2026
Gyoza Bar respects your privacy and handles personal data carefully and in line with the General Data Protection Regulation (GDPR / AVG). This statement explains which personal data we process, why, on what legal basis, how long we keep it and what rights you have.
1. Who is responsible
The controller for the processing described here is the operator of Gyoza Bar, Witte de Withstraat 77A, 3012 BN Rotterdam, registered with the Dutch Chamber of Commerce under number 42111858.
For anything in this statement, email info@gyozabar.nl or call 010 - 226 0900. We have not appointed a data protection officer; we are not required to.
2. This website
No cookies, no analytics, no tracking
gyozabar.nl places no cookies of its own. We use no analytics package, no advertising pixels, no heatmaps and no tracking scripts. We do not build a profile of you, we do not recognise you on a return visit, and we cannot tell who you are while you browse. That is why you are not asked for cookie consent: under the Dutch Telecommunications Act consent is required for non-essential cookies, and there are none to consent to.
Server logs
The site is hosted on Vercel. Like any web server, the hosting platform records technical request data such as your IP address, the page requested, the time and your browser type. That happens to deliver the site and to protect it against abuse and overload. We do not use those logs to identify individual visitors and we do not combine them with anything else.
| Purpose | Legal basis |
|---|---|
| Delivering and securing the website | Legitimate interest (Art. 6(1)(f) GDPR) — a working, protected website |
No automated decision-making
We do not use automated decision-making or profiling that produces legal effects for you or similarly significantly affects you.
3. Third-party content
Two elements of the page are loaded from Google. To deliver them, your IP address and browser details are sent to Google:
- Google Fonts — the typefaces used across the site.
- Google Maps — the map in the location section. The map loads only when you scroll to it.
Google acts as an independent controller for that data and processes it under its own privacy policy, which you can read at policies.google.com/privacy. This may involve a transfer to the United States, for which Google relies on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses. We receive no information from Google about you and we set no cookies through these elements.
We also link to our Instagram and TikTok profiles. Those are ordinary links: nothing is loaded from those platforms until you click, and once you do, their own privacy policies apply.
4. The private hire form
If you send a private hire request through the form on this site, you go through a short set of questions about the occasion, the date, the number of guests, what the evening needs and how far along your plans are. Those answers contain no personal data by themselves. The final step asks for:
| Data | Required | Why |
|---|---|---|
| Name | Yes | To address you properly |
| Email address | Yes | To send you our answer |
| Company | No | To understand the context of the booking |
| Phone number | No | So we can call if that is quicker |
| Your message | No | Anything you want to tell us up front |
These details are emailed to info@gyozabar.nl. We use them only to answer your request and, if it goes ahead, to arrange the booking. We do not add you to a mailing list, we do not use your details for marketing, and we do not sell or trade them.
| Purpose | Legal basis |
|---|---|
| Answering your request | Steps prior to a contract at your request (Art. 6(1)(b) GDPR) |
| Arranging and carrying out a private hire | Performance of a contract (Art. 6(1)(b) GDPR) |
5. In the restaurant
We do not take reservations for regular evenings, so you can eat here without leaving any details at all. Simply walking in, eating and paying in cash requires no personal data from you.
If you pay by card, the payment is handled by our payment provider and by your own bank. We see that a payment succeeded and the amount; we do not receive or store your card number.
6. Who else sees your data
We share personal data only with parties that process it on our behalf, or where the law requires it. With each processor we have a data processing agreement. Our processors are:
| Party | What for |
|---|---|
| Vercel | Hosting of this website |
| Resend | Delivery of the emails sent from the form |
| Microsoft | Our email environment, where your message is received and answered |
We never sell personal data and we never pass it to third parties for their own marketing purposes.
7. How long we keep it
| Data | Retention |
|---|---|
| A private hire enquiry that does not go ahead | Up to 12 months, so we recognise you if you come back to it |
| A private hire that does go ahead | 7 years, because the invoice falls under the statutory tax retention period |
| General correspondence by email | As long as needed to handle it, then removed in our periodic clear-out |
| Server logs | Short-term, in line with the hosting platform's own retention |
Ask us to delete something earlier and we will, unless the law requires us to keep it.
8. Security
This website is served exclusively over an encrypted HTTPS connection. Access to our mailbox is protected with strong passwords and multi-factor authentication, and only the people who need it can get in. If a data breach occurs that poses a risk to you, we will report it to the Dutch Data Protection Authority and, where required, inform you.
9. Your rights
Under the GDPR you have the right to:
- Access — see which personal data we hold about you.
- Rectification — have incorrect data corrected.
- Erasure — have your data deleted, where no legal retention applies.
- Restriction — have processing paused while something is being sorted out.
- Portability — receive the data you gave us in a common file format.
- Objection — object to processing based on our legitimate interest.
- Withdraw consent — where processing rests on consent, withdraw it at any time, without affecting what happened before.
Email info@gyozabar.nl and we will respond within one month. We may ask you to confirm your identity first, so that we do not hand your data to someone else.
10. Complaints
If you think we are not handling your data properly, please tell us first — we would rather fix it. You also have the right to lodge a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl.
11. Changes
We may update this statement when the website or our way of working changes. The version number and date at the top tell you which version you are reading. The current version always applies.