Privacy Policy
Last updated: 2026-08-06
PromoChef takes the protection of your personal data very seriously. This policy explains transparently which data we collect, why, how long we keep it, and who we share it with. It complies with the General Data Protection Regulation (GDPR 2016/679) and Belgian law (30 July 2018).
1. Data controller
Frédéric Curto — individual person — Châtelet, Belgium
Email: support@promochef.eu
CBE number: to be added once assigned
PromoChef has not appointed a DPO as the activity does not meet the thresholds imposing designation (GDPR art. 37). Any question about your data can be addressed to the controller above.
2. Data we collect
a) Identification data (provided by you)
- Email address (mandatory to create an account)
- Password (hashed with bcrypt, never stored in plain text)
- Country and postal code (for local promotions)
- Preferred language
b) Preferences (provided by you)
- Dietary regime (vegetarian, gluten-free, halal, etc.)
- Household composition (adults, children)
- Indicative weekly budget
- Preferred supermarket brands
- Favourite recipes, disliked ingredients, declared allergies
c) Technical data (automatically collected)
- Truncated IP address (last 2 octets masked) — anti-fraud security
- Device type, operating system, app version
- History of generated menus (to refine recommendations)
We do NOT collect any sensitive data (medical health data, religious/political opinions, sexual orientation, biometric or genetic data). Declared dietary regime is NOT considered medical data under GDPR art. 9.
We use NO advertising cookies and NO third-party trackers (no Google Analytics, no Meta Pixel, no TikTok Pixel). See our Cookie Policy.
3. Purposes and legal basis (GDPR art. 6)
| Purpose | Legal basis |
|---|---|
| Create and manage your user account | Performance of contract (art. 6.1.b) |
| Generate personalised meal plans | Performance of contract (art. 6.1.b) |
| Display local promotions | Performance of contract (art. 6.1.b) |
| Process subscription payment | Contract + legal accounting obligation (art. 6.1.b + 6.1.c) |
| Send marketing newsletter | Consent (art. 6.1.a) — revocable anytime |
| Fraud prevention / security | Legitimate interest (art. 6.1.f) |
| Anonymous aggregated usage analytics | Legitimate interest (art. 6.1.f) |
4. Retention periods
- Active account: as long as your account exists.
- Inactive account: automatic deletion after 36 months of no login (warning email sent 30 days before).
- Invoices and billing data: 10 years (Belgian accounting legal obligation — art. III.86 CEL).
- Newsletter emails: until unsubscription (immediate removal).
- Security logs (truncated IP): 12 months maximum.
- Technical cookies: see Cookie Policy (30 days to 1 year).
5. Sub-processors (data recipients)
PromoChef uses technical providers (sub-processors under GDPR art. 28) to operate the service. Each has signed a GDPR-compliant Data Processing Agreement (DPA):
- MongoDB Atlas (database) — MongoDB Ireland Ltd, Dublin, EU — Data stored in Europe (Frankfurt) region. AES-256 at-rest encryption.
- Render Services (backend hosting) — Render, Inc., USA — Servers in Europe (Frankfurt) region — Covered by Standard Contractual Clauses (SCC).
- Cloudflare Pages (website hosting) — Cloudflare, Inc., USA — Global CDN network — Covered by SCC.
- Stripe Payments Europe Ltd (payments) — Dublin, EU — PCI-DSS Level 1 — Card data NEVER transits through our servers.
- Resend (transactional emails) — Delaware, USA — Covered by SCC.
- Anthropic PBC (Claude AI engine for recipe generation) — USA — Covered by SCC — Requests sent do NOT contain your name, email, or any direct identifier. Anthropic commits to NOT use PromoChef data to train its models.
We do NOT sell any personal data to any third party. No data broker, no advertising partner.
6. Transfers outside the EU
Some sub-processors are established in the United States (Render, Cloudflare, Resend, Anthropic). Transfers to these providers are covered by:
- The Standard Contractual Clauses (SCC) 2021/914 adopted by the European Commission, OR
- Certification under the EU–US Data Privacy Framework (DPF) for eligible providers (e.g., Cloudflare, Anthropic).
You may request a copy of the applicable safeguards by writing to support@promochef.eu.
7. Security measures
- Encryption in transit: TLS 1.3 on all communications (HTTPS mandatory).
- Encryption at rest: AES-256 on MongoDB Atlas and Render disks.
- Passwords: bcrypt hashing with cost factor 12 (impossible to reverse to plain text).
- Authentication: signed JWT tokens, expiring after 30 days of inactivity.
- Anti-brute-force: rate-limiting (5 attempts / 15 min), temporary IP blocking.
- Anti-CSRF: synchroniser tokens on all mutations.
- Automatic daily encrypted backups (30-day retention).
- Administrator access: strong authentication, audit logs.
8. Children and minors
PromoChef is a general service intended for an adult audience. Registration is reserved to persons aged at least 16 years (legal age of digital consent in Belgium — GDPR art. 8).
If you are a parent and believe a child registered without your authorisation, contact us at support@promochef.eu: the account will be deleted immediately.
9. Your GDPR rights
Under articles 15 to 22 of GDPR, you have the following rights:
- Right of access — obtain a copy of all your data
- Right to rectification — correct inaccurate data
- Right to erasure ("right to be forgotten") — delete your account and all data
- Right to restriction — freeze processing during a dispute
- Right to data portability — receive your data in structured JSON format
- Right to object — refuse certain processing (e.g., profiling)
- Right to withdraw consent anytime (for the newsletter, in particular)
- Right to set post-mortem directives regarding your data
To exercise any of these rights, write to support@promochef.eu with subject "GDPR Request". We will respond within a maximum of 30 days (legal deadline).
10. Complaint to the supervisory authority
If you believe that the processing of your data does not comply with regulations, you may lodge a complaint with the Belgian Data Protection Authority (APD/GBA) — Rue de la Presse 35, 1000 Brussels, Belgium — dataprotectionauthority.be — Tel. +32 (0)2 274 48 00.
If you reside in another EU country, you may also refer the matter to the data protection authority in your country of residence.
11. Changes to this policy
This policy may be updated to reflect legal or technical changes. The date at the top indicates the latest revision. In case of substantial change, we will inform you by email with at least 30 days notice before entry into force.
12. Contact
For any question regarding this policy or your personal data:
Email: support@promochef.eu
Post: Frédéric Curto, Châtelet, Belgium