Privacy Policy
This translation is provided for convenience. In case of any discrepancy between this translation and the Dutch version, the Dutch version prevails.
1. Controller and contact
Qnack is an ordering and management platform for restaurants and hospitality businesses, operated by Halil Ertekin — 2Run, sole proprietorship, enterprise number 1038.480.317, VAT BE1038480317, Rollekens 83, 2400 Mol, Belgium. Qnack is the controller for platform accounts, technical operation, security, subscriptions and platform communications. For restaurant content, menus, order fulfilment, delivery and customer relationships, the restaurant (tenant) you order from can be a separate controller. Privacy questions: privacy@qnack.be. Qnack has not appointed a data protection officer because this is not required under Article 37 GDPR; privacy@qnack.be is the point of contact. We process personal data in accordance with the GDPR and the Belgian Act of 30 July 2018. One Qnack account works at every Qnack restaurant. When you sign up on a restaurant's page or order there, you also become that restaurant's customer: Qnack then shares your account details (name, email, phone number) and your orders only with that restaurant, which uses them as a separate controller for your orders and its customer relationship (Art. 6(1)(b) GDPR). Other restaurants do not see this data; you only get news from a restaurant with your separate consent for that restaurant. Under Account › My restaurants you can leave a restaurant at any time: the customer relationship and the marketing consent for that restaurant end, while your orders and invoices are kept for as long as the law requires.
2. Data we process
Account and contact details (name, email, phone number), order and delivery data (items, address, notes, status), invoice and payment status data (Qnack does not store card numbers), preferences and consent choices, support messages, and technical data such as IP address, browser or app version and a device identifier generated by the app or browser. For couriers we also process the device used, online status, location while online in the courier app, delivery status and the handover position. When a restaurant uses Table pay, digital gift cards or birthday discounts, we also process the amount paid and the tip, the name and email address of the buyer and recipient of a gift card, the card balance and its use and, only if you provide it yourself, your birthday (day and month, never the year).
3. Purposes and lawful bases
• Placing and handling orders, payments, delivery, order confirmations and status updates, and managing your account: performance of a contract (Article 6(1)(b) GDPR). • Invoices, bookkeeping and tax: legal obligation (Article 6(1)(c)). • Security, fraud and abuse prevention, error monitoring, managing sign-in sessions per device (also when several couriers share one courier login) and keeping the platform reliable: legitimate interest (Article 6(1)(f)). Our interest is a safe, working ordering service; we limit this to technical data and short retention periods. • Showing the customer where the courier carrying their order is during the active delivery: legitimate interest of the customer and the restaurant in a predictable delivery. • Promotional emails or push messages, analytics: consent (Article 6(1)(a)), which you can withdraw at any time.
4. Payments, billing and integrations
Qnack is not the merchant of record for restaurant orders and does not collect restaurant turnover into its own account for later payout to tenants. Depending on the restaurant's configuration, the order payment is processed through the restaurant's Stripe, Mollie or other configured payment provider account. For platform subscriptions and integrations, Stripe, Mollie, RevenueCat, Billit and Peppol service providers may receive the data needed for that service. We share only what is necessary. Table pay payments (including tips) and gift card sales also run through the restaurant's payment provider. For the optional AI features (see section 12), OpenRouter, Inc. and Anthropic PBC (both United States) act as processors.
5. Location, push, camera and QR
Customers: location is used only when you allow it on your device, for example to show nearby restaurants. Couriers: while you are online in the courier app, your location is shared with Qnack — also in the background — together with the identifier of your device. It is used to assign and complete deliveries, to show the customer the courier carrying their order during that delivery and to record where an order was handed over. Going offline in the app stops location sharing on that device. If the restaurant has switched on route history, the route driven is stored while the courier carries an order (not while idle or offline), so the restaurant can review deliveries and disputes afterwards; the restaurant must inform its couriers beforehand. Camera access is requested for QR scans, profile images or delivery proof. You can withdraw device permissions at any time in your device settings.
6. Messages and notifications
We send order confirmations and status updates by email and push. If you leave a phone number, you can also receive the order confirmation on WhatsApp. We also send the verification code for your phone number by WhatsApp. These messages are sent through the restaurant's own WhatsApp account or, when that is unavailable, through Qnack's (2Run) WhatsApp number or through our provider of SMS and WhatsApp messaging infrastructure (named in section 14), so the sender may appear as "2Run". Promotional messages are sent only with your consent and every message lets you unsubscribe.
7. Error monitoring and analytics
To find and fix faults, our own error-monitoring service (hosted in Germany) receives technical error reports: error details, page, browser or app version and IP address. We do not record user sessions. Visitor analytics (Umami, hosted on our own servers in Germany, without cookies) is only loaded after you accept analytics cookies.
8. Retention
Account data is kept while your account is active. When you delete your account, your profile data is removed or anonymised immediately; remaining copies (for example backups) are gone within 30 days. Invoices and the financial data of orders (amount, VAT, date) are kept for 10 years for accounting and tax purposes (Article 60 Belgian VAT Code, Article 315 Income Tax Code); the customer's name, contact details and address in order records are anonymised after 7 years. The courier's live position is continuously overwritten and per-device positions are kept for at most 12 hours; the handover position of a delivery and the route history are deleted after 90 days. Security and audit logs are deleted after 12 months, error reports after 90 days. Phone numbers of SMS and WhatsApp campaign recipients are deleted after 12 months. These periods are enforced automatically.
9. Recipients and transfers
Data can be shared with the restaurant you order from, its authorised staff, couriers when needed for delivery, payment and invoicing providers, hosting and content-delivery providers (Hetzner, Cloudflare), email, push (Apple, Google, Expo) and messaging providers (WhatsApp/Meta, our SMS and WhatsApp messaging infrastructure provider), support tools, the accountant the restaurant designates for the Accountant package, print and hardware partners for Qnack Shop orders and authorities where legally required. The full list of subprocessors is in section 14. We prefer processing inside the EEA. Where a provider processes data outside the EEA (for example in the United States), we rely on an adequacy decision such as the EU-US Data Privacy Framework or on standard contractual clauses. The optional AI features use OpenRouter, Inc. and Anthropic PBC (both United States) as processors; for these transfers we rely on the EU-US Data Privacy Framework (where the recipient is certified) or on standard contractual clauses (SCC).
10. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection, including objection to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time without affecting earlier processing. You can delete your customer account in the app or on the website. We respond within one month. Contact: privacy@qnack.be. Qnack is not intended for children under 13.
11. Complaints
You may lodge a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be.
12. Automated decisions and AI
Qnack does not make solely automated decisions that produce legal or similarly significant effects for you. AI and reporting features are assistive tools for restaurant administrators and their output can be reviewed by authorised users. For optional AI features (such as translating and drafting menu and message texts, or marketing and reporting suggestions) that a restaurant administrator starts, we send the content needed for that feature to OpenRouter, Inc. and/or Anthropic PBC (United States), acting as processors. Transfers outside the EEA rely on the EU-US Data Privacy Framework or standard contractual clauses (SCC). We send only what the requested feature needs.
13. Marketing messages from restaurants and from Qnack
• Restaurant marketing: a restaurant (tenant) can send email and push campaigns to its own customers through Qnack. For this, the restaurant is the controller of its customer data and Qnack (2Run) acts as its processor, sending messages only on the restaurant's instructions. Campaigns go only to customers who gave that restaurant marketing consent, confirmed it through the link in a confirmation email (double opt-in) and have not unsubscribed. When you order as a guest, the marketing checkbox is optional and unticked by default; your order never depends on it. In the dashboard the restaurant sees a contact list of its customers, both registered and guest (name, contact details and consent status), to manage this consented marketing. • Platform marketing: Qnack (2Run) sends promotion about the Qnack platform itself as controller, only to people who gave consent to Qnack marketing (for example when signing up on qnack.be or in the Qnack app), on the basis of consent (Article 6(1)(a) GDPR). Qnack does not use a restaurant's customer list for its own promotion. • Push messages: push notifications use the push token of your device, delivered through Apple, Google and our push delivery service Expo. The token is removed when you sign out or when your device no longer accepts messages, and you can turn notifications off in your device settings at any time. • Unsubscribe: every marketing email contains an unsubscribe link that takes effect immediately for the restaurant or for Qnack that sent it. You can also withdraw consent through the restaurant or privacy@qnack.be. • Retention: as proof of consent we record when and where you gave consent, a fingerprint of the consent text shown to you, and when you confirmed or unsubscribed. An unconfirmed consent is cleared after 30 days. Consent and unsubscribe records are kept as long as the customer account exists, so that an unsubscribe keeps being respected. For email and push campaigns we keep only totals (number of recipients and messages sent), not a copy per person; for SMS and WhatsApp campaigns, see the next point. • SMS and WhatsApp campaigns: a restaurant can also send campaigns by SMS or WhatsApp, paid with prepaid credits (section 17 of the Terms of Service). These go only to customers who gave that restaurant a separate opt-in for that channel (an unticked box, separate from email marketing) and have not withdrawn it. As proof we record the time, the source, a fingerprint of the consent text, the IP address and the browser. You can withdraw at any time through the unsubscribe link in the SMS or by replying STOP; a STOP sent to Qnack's shared number stops that channel for every restaurant on Qnack. Messages are only sent between 9:00 and 20:00 (Belgian time). The restaurant is the controller and Qnack (2Run) its processor. For each campaign we keep, per recipient, the phone number and the delivery status, because they are needed to credit back undelivered messages and to handle unsubscribes; the phone number is deleted after 12 months; the rest of the campaign data stays in the restaurant account and is deleted together with the restaurant's data when the account ends (section 12 of the Terms of Service). • Review requests: after a completed order the restaurant can have Qnack send one email or push message asking for a review on Google. If you just left feedback, you get it as a follow-up unless you unsubscribed; otherwise only with confirmed marketing consent. Everyone who gets a request gets the same Google link, whatever rating they gave. At most one request per restaurant every 60 days; every email has an unsubscribe link. The restaurant is the controller and Qnack its processor.
14. Subprocessors
Qnack (2Run) works with the following subprocessors. New subprocessors are announced to restaurants at least 30 days in advance (section 12 of the Terms of Service). For transfers outside the EEA, see section 9. • Hetzner Online GmbH (Germany): hosting, database and backups. • Google LLC (United States): Google Drive, only for an extra backup copy that we encrypt ourselves before it leaves Hetzner; Google cannot read the content. The copy is deleted after 30 days. • OpenStreetMap Foundation (United Kingdom): Nominatim geocoding; converts the delivery address of an order (street and number, postcode and municipality, without name or phone number) into coordinates for route planning. Transfers to the United Kingdom rely on the European Commission's adequacy decision. • Cloudflare, Inc. (United States): DNS, content delivery and security. • Own mail server managed by 2Run: sending emails. • Apple, Google and Expo (United States): sign in with Apple or Google and push notifications. • Meta Platforms Ireland Ltd. (WhatsApp Business): WhatsApp order confirmations, verification codes and the WhatsApp order channel. • Twilio Inc. (United States): SMS and WhatsApp messaging infrastructure: restaurants' SMS and WhatsApp campaigns, verification codes and the fallback route for messages. • Stripe (Stripe Payments Europe Ltd., Ireland) and Mollie B.V. (Netherlands): payments, including Table pay, tips and gift cards, and platform subscriptions. • RevenueCat, Inc. (United States): subscriptions through the app stores. • Billit (Belgium): Peppol e-invoicing. • OpenRouter, Inc. and Anthropic PBC (United States): optional AI features, including AI Upsell. • Error monitoring (GlitchTip) and visitor analytics (Umami) run on our own servers in Germany and are not an external party. • Simian B.V., trading as Reclameland (Netherlands): printing of menu cards and door stickers ordered in the Qnack Shop; receives the content to print and, because Reclameland delivers directly to the restaurant, the name, delivery address and phone number. • Vistaprint B.V. (Netherlands): printing of QR table stands ordered in the Qnack Shop; receives the content to print and, because Vistaprint delivers directly to the restaurant, the name, delivery address and phone number. • bpost NV (Belgium): delivery of Qnack Shop orders that 2Run ships itself; receives name, delivery address and phone number. • Hardware suppliers: if a supplier ships hardware directly to a restaurant, it receives only name, delivery address and phone number and is named here beforehand. For Qnack Shop orders 2Run itself is the controller of the delivery details of the ordering restaurant; the print, shipping and hardware partners above receive only those details and the content to print, not data about the restaurant's guests.
Last updated: 11/11/2026