Privacy policy

Data controller

Personal data collected on latablebantu.com is processed by Ms Blandine Simon BENGUI, founder of La Table Bantu (single-shareholder simplified joint-stock company, SASU, being incorporated), address: [To be completed once the SASU is registered], email: contact@latablebantu.com.

Data collected

• Waitlist: email address, postcode (optional), sign-up date.
• Customer account: first and last name, email, phone, password (encrypted), delivery addresses, chosen relay point.
• Food preferences: no-chilli preference and allergies. Allergies are health data: they are only collected with your explicit consent and are used solely to adapt your dishes.
• Orders: dishes, plans, amounts, promo codes, loyalty points, referrals, status history.
• Payment: the transaction is handled by our payment provider; we do not store any card data.
• Delivery: time slot, instructions, proof of delivery (photo or signature), temperature readings.
• Communications: contact messages, complaints and replies.
• Browsing: technical data (IP address, connection logs) and, only if you accept, Google Analytics audience measurement.

Purposes and legal bases

• Performance of the contract: account, orders, subscriptions, delivery, relay pickup, loyalty and customer service.
• Consent: waitlist and news, allergy data, audience measurement. You can withdraw your consent at any time.
• Legitimate interest: website security, fraud prevention, service improvement, reminder emails about your current orders.
• Legal obligation: retention of accounting records and invoices.

Retention periods

• Waitlist: until you unsubscribe, and at most 3 years after your last contact.
• Customer account: for the duration of the relationship, then 3 years after your last order or activity.
• Allergy data: until you delete it or close your account.
• Invoices and accounting records: 10 years.
• Proof of delivery and temperature readings: 1 year.
• Technical logs: 1 year.
• Audience measurement cookies: 13 months at most; your consent choice is kept for 6 months.

Recipients and processors

Your data is intended for La Table Bantu and, as needed for the service, its drivers, partner relay points (name and pickup code only) and the following processors: Vercel (website hosting), Heroku / Salesforce (application server), Prisma (database), Resend (email delivery), Google (audience measurement, if you accept), OpenStreetMap (map display) and the French government Address API (address location). Your data is never sold.

Some of these providers are based in the United States. Transfers are covered by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

Your rights

You have the right to access, rectify, erase, restrict and port your data, to object, to withdraw your consent and to give instructions on what happens to your data after your death. You can exercise these rights from your account or by writing to contact@latablebantu.com. Every email contains an unsubscribe link.

If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr).

Cookies and trackers

The website uses trackers that are strictly necessary for it to work and exempt from consent: keeping you signed in, chosen language, order basket, closing information banners.

Only with your consent, the website sets Google Analytics audience measurement cookies (_ga, _ga_*), provided by Google Ireland Limited, to understand website traffic. You can accept, refuse or change your choice at any time via the "Manage cookies" link in the footer; refusing has no impact on your use of the website.

Security

Exchanges are encrypted (HTTPS), passwords are stored encrypted and access to data is limited to authorised people.