Privacy Policy

Who we are

This website is operated by Lasagna Lab ("we", "us"), located at Zonnebaan 50, 3542 EG Utrecht, the Netherlands, and registered with the Dutch Chamber of Commerce (KVK) under number 42162018. We are a lasagna and meatball delivery and pickup service in Utrecht and the controller of your personal data as described in this privacy policy. For any privacy questions you can contact us at hello@lasagnalab.nl.

What data we collect

When you place an order, we ask for the information we need to deliver it or have it ready for you:

• your name;
• your delivery address (street, house number, postcode and city) — only if you have it delivered;
• your phone number and email address;
• whether you have it delivered or pick it up, your preferred delivery or pickup time and any notes you add.

If you mention an allergy or dietary need in the notes yourself, that is information about your health. We use it only to prepare and deliver (or hand over) your order safely.

If you pay online, Mollie provides us with the amount, the payment method, the status and a reference of your payment. With iDEAL | Wero we can also see the name and account number you paid from, and with a credit card the name on the card and its last four digits. We never see your full card details or your banking login.

How we use your data

We use your data only for your order: to process your payment (and any refund), to prepare and deliver it (or have it ready for pickup), to contact you if needed, and to send you an email confirmation — and to protect the order form against abuse (see below). We do not sell your data and we do not use it for third-party advertising.

Legal basis

We process your data because it is necessary to fulfil your order (performance of a contract, Article 6(1)(b) GDPR). Data we must keep for our accounts is kept to meet a legal obligation (Article 6(1)(c) GDPR). We protect the order form against abuse on the basis of our legitimate interest in a secure website (Article 6(1)(f) GDPR).

Hosting, email and payments

Our website and ordering system run on Cloudflare. When you place an order, we store it in a Cloudflare database so we can prepare it and deliver or hand it over. At checkout we use Cloudflare Turnstile to prevent abuse by bots; it checks technical data about your browser and connection (such as your IP address). For providing these services, Cloudflare acts as a processor on our behalf. Cloudflare also uses these technical signals to improve Turnstile's bot detection, for which it acts as an independent controller; see Cloudflare's Turnstile privacy addendum.

To send order and confirmation emails we use Resend, an email service that also acts as a processor on our behalf. Resend processes the data contained in the email solely to deliver the email and not for its own purposes.

Online payments are handled by Mollie B.V. in Amsterdam, a payment service provider supervised by De Nederlandsche Bank (the Dutch central bank). You pay on Mollie's secure payment page. We give Mollie only the amount, your order number and the links that bring you back to our website after paying; we do not pass on your name, address, phone number, email address or notes. Mollie processes your payment details (such as your account or card number, IP address and device data) as an independent controller: to carry out the payment, to prevent fraud and to meet its legal obligations, such as anti-money-laundering rules. Where Mollie uses parties outside the European Economic Area, it relies on safeguards such as the standard contractual clauses. See Mollie's privacy statement.

Resend stores the emails, and so your order details, in the United States. Cloudflare may also process data outside the European Economic Area, because its network is global. This happens only on the basis of the EU-US Data Privacy Framework (an adequacy decision of the European Commission) or the European Commission's standard contractual clauses. You can request a copy of the standard contractual clauses from us.

Retention

We keep order data no longer than necessary to handle your order and to meet our legal obligations. Data we need for our accounts is kept for as long as the law requires (in the Netherlands, generally 7 years). If you don't complete an online payment, we delete the details of that unfinished order as soon as the payment has expired or been cancelled, and within 30 days at the latest.

Cookies and analytics

We do not use tracking cookies or advertising trackers, so no cookie banner is required. If we measure website statistics, we do so in a cookieless, privacy-friendly way that does not identify you personally.

Your rights

You have the right to access, correct or delete your data, to restrict its processing and to data portability. You may also object to processing based on our legitimate interest. To exercise these rights, contact us at hello@lasagnalab.nl or by phone at +31 6 86353026. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).