Privacy Policy

How Beyond Ordering collects, uses, stores and protects personal data

This is an English translation of the Dutch “Privacybeleid”. In case of any discrepancy, the Dutch version prevails.

Beyond Ordering BV, with its registered office at Brusselsesteenweg 255, 9090 Melle, Belgium, registered with the Crossroads Bank for Enterprises under number 0760.305.893 (hereinafter “Beyond Ordering”, “we”), values your privacy. We comply with the General Data Protection Regulation (GDPR) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data. This privacy policy explains which personal data we process, why, for how long, and what rights you have.

Article 1: Scope

1.1 This privacy policy applies to the processing of personal data through:

• the websites beyondordering.com and qrrefund.com;
• the Beyond Ordering platform and the QR refund platform (together: “the Platform”);
• our contacts with clients, prospects, suppliers and partners.

1.2 Personal data means any information by which a natural person can be identified directly or indirectly.

Article 2: Who is responsible for your data?

2.1 Beyond Ordering as controller. Beyond Ordering is the controller for the data it processes for its own purposes: visitors to our websites, people who contact us directly, and contact persons of clients, prospects, suppliers and partners.

2.2 The organiser as controller. Do you order, pay or top up at an event or venue that uses the Platform, or request a refund of a deposit or credit there? Or do you use the Platform as a staff member of an organiser? Then the organiser or operator of that event or venue is the controller. Beyond Ordering processes that data as a processor, on behalf of and in accordance with the instructions of the organiser, under a data processing agreement. The organiser’s privacy policy explains how it handles your data. Please address questions and requests about that data to the organiser. If they reach us, we forward them to the organiser.

2.3 For a limited number of purposes, Beyond Ordering does process that data as controller: the security of the Platform, the prevention of fraud and abuse, and compliance with legal obligations that apply to Beyond Ordering itself.

2.4 You can reach us by post at the address above or by e-mail at info@beyondordering.com.

Article 3: How do we collect data?

3.1 We collect personal data when you:

• visit our websites;
• fill in a contact form, request a quotation or contact us in another way;
• enter into an agreement with us or work with us as a contact person of a client, supplier or partner;
• create or use an account on the Platform;
• order, pay, top up or request a refund through the Platform (in that case as a processor, see Article 2.2).

Article 4: Which data do we process as controller, why and for how long?

4.1 Website visitors.

• Data: IP address, browser and device data, pages visited, cookie identifiers.
• Purpose: running, securing and improving the website, and compiling visitor statistics.
• Legal basis: legitimate interest for necessary cookies; consent for analytics and marketing cookies.
• Retention: according to the cookie settings, at most 13 months.

4.2 Contact and quotation requests.

• Data: name, e-mail address, telephone number, organisation, job title and the content of your message.
• Purpose: answering your question and preparing a quotation.
• Legal basis: pre-contractual steps at your request, or our legitimate interest in answering questions.
• Retention: 2 years after the last contact, unless it leads to an agreement.

4.3 Clients, suppliers and partners.

• Data: name, contact details and job title of contact persons, invoicing and payment details, company number, contracts and correspondence.
• Purpose: performing the agreement, invoicing, providing support and keeping our accounts.
• Legal basis: performance of the agreement and legal obligations.
• Retention: the term of the agreement, and then 10 years for accounting records as required by law.

4.4 News and commercial information.

• Data: name, e-mail address, organisation and how you interact with our e-mails (opens and clicks).
• Purpose: informing clients and interested parties about new features and services.
• Legal basis: legitimate interest for existing clients; consent for other persons.
• Segmentation: we divide contacts into groups, for example by sector, role or interest shown in earlier e-mails, so that we send more relevant information. You can object to this at any time.
• Retention: until you unsubscribe. Every e-mail contains a link to do so.

4.5 Security and fraud prevention.

• Data: technical logs, IP addresses, device IDs and transaction references.
• Purpose: securing the Platform and preventing and detecting fraud, abuse and money laundering.
• Legal basis: legitimate interest and legal obligations.
• Retention: at most 12 months, unless the data are needed for an ongoing investigation or a legal obligation.

4.6 We do not take decisions based solely on automated processing, including profiling, that have legal effects for you.

Article 5: Data we process as processor

5.1 As a processor for the organiser (Article 2.2), we process, depending on how the organiser uses the Platform:

• contact details you provide yourself, such as your e-mail address for a confirmation or support;
• IBAN and account holder name, solely for a refund;
• identification codes of cashless carriers and QR codes;
• order, payment and transaction data, insofar as linked to an identifiable person;
• technical data such as IP address and device data;
• account data of the organiser’s staff who use the Platform: name, e-mail address and usage logs.

5.2 We use this data only to process orders, payments, top-ups and refunds, to provide support and to secure the Platform. The organiser determines the retention period. After the end of our cooperation with the organiser, we delete or anonymise the data, unless a legal obligation requires us to keep it longer.

Article 6: Who do we share data with?

6.1 We share personal data only where necessary for the purposes in this privacy policy, with:

• our processors: Google Cloud / Firebase (hosting and database), Brevo (e-mails) and Naxai (text messages), and service providers for our website and cookie management (such as Webflow and Cookiebot), analytics and advertising, customer management and newsletters, accounting and IT support. They process the data only on our instructions and are contractually bound by the same security and confidentiality obligations;
• the organiser of the event or venue where you order, pay or request a refund;
• payment service providers and banks, which process payments and refunds as independent controllers;
• public authorities, where the law requires us to.

6.2 We do not sell your personal data.

Article 7: Transfers outside the European Economic Area

7.1 We store personal data in data centres within the European Economic Area (EEA). Where a processor processes data outside the EEA, this only happens with appropriate safeguards, such as an adequacy decision of the European Commission (including the EU-US Data Privacy Framework) or the European Commission’s standard contractual clauses.

Article 8: Security

8.1 We take appropriate technical and organisational measures to protect personal data against loss, unauthorised access and misuse, including encrypted connections, encrypted storage, access management and regular back-ups. Only staff who need the data for their work have access to it, and they are bound by confidentiality.

8.2 In the event of a personal data breach, we act in accordance with the GDPR: where required, we notify the breach to the Data Protection Authority and to the data subjects or, where we act as processor, to the organiser.

Article 9: Your rights

9.1 You have the right to:

• access your personal data;
• have incorrect data corrected;
• have your data erased (“right to be forgotten”);
• have the processing restricted;
• receive your data in a common format or have it transferred (portability);
• object to processing based on legitimate interest, and always to direct marketing;
• withdraw your consent at any time.

9.2 Send your request to info@beyondordering.com. We may ask you to prove your identity. We respond within one month of receipt. This period may be extended by two months if the request is complex; in that case we will let you know.

9.3 If your request concerns data from an event or venue (Article 2.2), please address it to the organiser. We help the organiser respond to your request.

Article 10: Minors

10.1 Persons under 13 may not provide us with personal data without the consent of a parent or guardian.

Article 11: Cookies

11.1 Our websites use necessary cookies to function properly. We only place preference, statistics and marketing cookies with your consent, which you can give, refuse or withdraw through the cookie settings on the website. Which cookies we use and how you manage your choice is explained in our Cookie Policy.

Article 12: Complaints

12.1 If you have a complaint about the processing of your personal data, please contact us first at info@beyondordering.com. You may also lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, tel. +32 (0)2 274 48 00, contact@apd-gba.be, www.dataprotectionauthority.be.

Article 13: Changes

13.1 We may amend this privacy policy. The current version is always available on our website. We inform clients by e-mail of significant changes.

Version October 2026

‍