Privacy policy

Who we are

Briola provides phone-controlled digital menu boards for food venues. For data collected through this website, the data controller is Timofej Taraszenko, sole proprietorship (eenmanszaak), Roeland Saverystraat 28, 8500 Kortrijk, Belgium, enterprise number 1043.139.285, email info@briola.be. We have not appointed a data protection officer.

Contact for privacy matters: see the legal notice.

What we collect

When you submit the demo booking form, or use it to ask for a written quote, we receive only this:

• your name;
• the name of your venue;
• the number of screens (optional);
• the number of venues you run (optional, except for a written quote);
• the language of the page you wrote from, so we know which language you prefer;
• how to reach you: a phone number or username for WhatsApp or Telegram, or an email address.

Your name, your venue and a way to reach you are required: without them we cannot reply. The numbers of screens and venues are optional, except the number of venues for a written quote. This site has no accounts, no payments and no tracking pixels.

Why we use it

Solely to answer your enquiry and to prepare the demo, mock-up or written quote you asked for. Legal basis: steps taken at your request before entering into a contract (GDPR art. 6(1)(b)) and our legitimate interest in replying to business enquiries (art. 6(1)(f)). We do not use this data for advertising and we never sell it. There is no automated decision-making and no profiling.

How long we keep it

For 12 months after our last contact, then it is deleted. If you become a customer, the data moves to our customer records and is kept as required by contract and law. You can request earlier deletion at any time.

If you want to work with us

If you write to us through the form for working with us, we receive your name, your email address, how you could help Briola and, if you fill it in, what you would like in return, plus the language of the page you wrote from, so we know which language you prefer. We use it only to talk with you about working together: steps you asked for before a possible agreement (GDPR art. 6(1)(b)) and our legitimate interest in finding people to work with (art. 6(1)(f)). Your name, your email address and how you could help are required; without them we cannot answer. We keep it for 12 months after our last contact, and it is seen and stored the same way as a demo request (see below).

If you become a client

Once we sign an agreement, we also process the details of your business and of the people we deal with there, the agreement itself, invoices and payments, your messages to our support and the technical data your players send to keep the boards running. We do this to carry out the agreement (GDPR art. 6(1)(b)) and to meet our accounting and tax obligations (art. 6(1)(c)). Invoices go out through the Peppol e-invoicing network via our e-invoicing provider, payments run through our bank or payment provider, and our accountant and the tax authorities see what the law requires. Your messages in the support chat of the app and the data from your players are kept on the servers of a hosting provider in the European Union, which works for us as our processor. If you write to our support by email, the message also reaches our mailbox at Microsoft and GoDaddy, and on WhatsApp or Telegram it passes through that service; the section on where your data goes, below, explains what that means. We keep invoices and accounting records for seven years, as Belgian law requires (Code of Economic Law, art. III.86). On the basis of our legitimate interest (art. 6(1)(f)), we also keep a record of which player we supplied to you, for ten years after delivery, so that we can trace a faulty player. On the same basis our servers keep technical logs, such as the IP address and time of each login to the app, to keep the service secure and to find faults, and if we keep a record of who published what, we keep it as our own evidence. We delete the logs once we no longer need them for these purposes, and that record once it can no longer serve as evidence. The rest we keep for as long as the agreement runs and then only as long as we may need it to settle a dispute. For the other personal data of your staff inside your account we work for you, as a processor; that is covered by the data processing agreement that comes with our offer.

The data processing agreement is also published on its own page: Data processing agreement.

Who sees it

Your message is read by Timofej Taraszenko, who runs Briola. Anyone who helps him answer it or administers our server works from within the EU, under a written agreement that obliges them to keep it confidential and to use it only for that work. Four providers handle it for us, each under a data processing agreement: our hosting provider Hetzner (Hetzner Online GmbH, Gunzenhausen, Germany), which hosts the server that receives the form; Brevo (Brevo SAS, Paris, France), which delivers it to us as one email; and Microsoft and GoDaddy, which provide the mailbox where that email arrives. We do not save you as a contact at Brevo, and Brevo sends you nothing. WhatsApp and Telegram are not our processors: they carry and keep messages under their own privacy policies (see the next section). Nobody else gets your enquiry, and we never sell your data.

Where your data goes

The server that runs this site and receives your form is in the EU, in Finland. Your enquiry can leave the EU at three points, each explained below: Brevo’s subcontractors and group companies, the companies behind our mailbox (Microsoft and GoDaddy), and WhatsApp or Telegram if you ask us to reply there.

• Our server, in the EU: this site runs on a virtual server that our hosting provider Hetzner hosts in its data centre in Finland. Like any website, this site receives your IP address with every page your browser requests: without it, the page could not be sent back to you. When you send a form, the server keeps a code computed from your address in its memory for about ten minutes, only to limit how many requests one address can send, and then forgets it. Legal basis: our legitimate interest in delivering the site and protecting its forms from abuse (GDPR art. 6(1)(f)).
• Brevo, in France: what you send through either form goes from our server to Brevo, an email service run by Brevo SAS in France, which delivers it to us as one email. Brevo runs its service on servers in France and Belgium. It works with subcontractors and companies of its own group, some of them in the United States and India, and may transfer data to them under standard contractual clauses and, for some of those in the United States, the EU-US Data Privacy Framework. You can ask us for a copy of those clauses.
• Our mailbox, at Microsoft and GoDaddy: that email, like any email you write us, arrives in our Microsoft 365 mailbox. Microsoft Ireland Operations Limited keeps it for us in Microsoft’s data centres in the EU and is itself responsible for the data it uses for its own business operations linked to the service. GoDaddy, which sold us the mailbox, can access it for administration and support, so your message may reach GoDaddy Europe Limited in the United Kingdom, a country outside the EU with an adequacy decision from the European Commission. Microsoft and GoDaddy may also transfer data outside the EU, including to the United States, where Microsoft Corporation and GoDaddy Operating Company, LLC are certified under the EU-US Data Privacy Framework; they also rely on standard contractual clauses. You can ask us for a copy of those clauses.
• WhatsApp and Telegram, only if you choose them: if you ask us to reply there, your messages also pass through that service, which processes them under its own privacy policy and is itself responsible for them. WhatsApp is provided in the EU by WhatsApp Ireland Limited, which may transfer data to the United States under the EU-US Data Privacy Framework. Telegram is provided by a company based in the United Arab Emirates, a country outside the EU without an adequacy decision from the European Commission; we use it only because you asked us to (GDPR art. 49(1)(b)).
• The phone, with no provider outside the EU: if you would rather nothing left the EU at all, call us. The phone is the only channel here that does not pass through a provider outside it.

Stored in your browser

The site stores a few interface values in your browser’s local storage: which theme you picked, whether the demo phone is open, where you dragged it, whether you dismissed its hint, and whether you stopped the page’s background motion. Each one is saved only when you make that choice yourself, and forgotten after six months. Nothing else is stored. There are no cookies, no analytics and no tracking pixels on this site, so there is no cookie banner to click. These values never leave your device.

Your rights

Under the GDPR you can request access, correction, deletion or restriction of your data, and data portability: a machine-readable copy you can take to another provider. Write to the address in our legal notice and we will respond within one month. You can also lodge a complaint with the Belgian Data Protection Authority (GBA/APD), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be. The GBA accepts complaints in Dutch, French or German. Where possible it asks you to contact us first and, if you have already made one of these requests to us, to allow a month for our reply; in clearly justified cases it waives this. If you live or work in another EU country, the supervisory authority there will hear your complaint too (GDPR art. 77).

Right to object. Where we rely on our legitimate interest (replying to business enquiries, finding people to work with, delivering this site and protecting its forms; for clients, also keeping a record of the players we supplied, our servers’ technical logs and any record of who published what), you can object at any time, for reasons that concern your own situation. Write to the address in our legal notice and we stop, unless we can show compelling legitimate grounds or need the data for a legal claim (GDPR art. 21).