Privacy policy

Personal data we process

Mesa Mesa processes your personal data because you use our services and/or provide it to us yourself. This may include: your first and last name, address details, language preference, telephone number, email address, IP address, data you provide in correspondence or by phone, location data, information about your activity on our website, your internet browser and device type, and your bank account number when making a payment.

Special or sensitive personal data

Our website does not intend to collect data about visitors younger than 16 years of age without parental or guardian consent. However, we cannot verify the age of visitors. We encourage parents to be involved in their children’s online activities. If you believe we have collected personal data about a minor without consent, please contact us at reserveringen@mesamesa.nl and we will delete this information.

Why we process personal data

Mesa Mesa processes your personal data for the following purposes: handling your payment, sending our newsletter, contacting you about our services, informing you about changes to our services and products, delivering goods and services, analysing your behaviour on the website to improve it, and complying with legal obligations such as tax administration.

Retention periods

We do not store your personal data longer than strictly necessary for the purposes for which it was collected. Technical data such as IP addresses and website usage data are retained for a maximum of 50 months. Identification, contact and financial data are kept as long as required for our administration and legal obligations.

Sharing with third parties

Mesa Mesa only shares your personal data with third parties if this is necessary for the performance of our agreement with you or to comply with a legal obligation. Reservations are processed in Placemat (see below); our Instagram feed is provided by Elfsight; website statistics are provided by Google Analytics.

Reservations via Placemat

When you book at Mesa Mesa, through our website, WhatsApp, by phone or at the restaurant, we record your reservation in Placemat. Placemat is the reservation system of Fifteen Hospitality B.V., the company Mesa Mesa is part of. Fifteen Hospitality processes your data only on our behalf and may not use it for anything else. Reservations you made before 3 November 2026 were processed by OpenTable.

Which data: your name, phone number and email address, the date, time and number of guests, your language, and what you enter yourself with your reservation, such as a special occasion or allergies. If you pay a deposit, the payment goes through Mollie or Rabobank; we do not see your card details. If you tell us about an allergy we use that only to serve you safely. As this is health data, we only process it when you give it to us yourself.

Within Fifteen Hospitality: the restaurants of Fifteen Hospitality use Placemat together. If you are also a guest at another restaurant of the group, they see your name, contact details and earlier visits; notes stay with each restaurant. If we are full, we can move your reservation to another restaurant of the group with your agreement. Your data is also used in the central environment of Fifteen Hospitality to improve our service and planning.

Who helps us: for email Resend, for payments Mollie and Rabobank. If our digital assistant answers you on WhatsApp or by phone, we also use Meta (WhatsApp), ElevenLabs (phone) and Anthropic (the AI that reads and answers your question). Some of these parties are outside the European Union; appropriate safeguards apply there, such as the standard contractual clauses of the European Commission.

How long: we keep your reservation as long as needed for the reservation and our administration; after that it is anonymised. Notes about your visit are deleted if you have not visited for 36 months. Our reservation module does not place cookies and does not track you. Only your own reservation page uses a necessary cookie to process your changes securely. Do you want to know which data we hold, or do you want us to delete it? Email reserveringen@mesamesa.nl. We can have all your reservation data forgotten in one go.

Cookies

Mesa Mesa uses functional, analytical and tracking cookies. A cookie is a small text file stored on your device when you first visit our website. Functional cookies are necessary for the website to work. Analytics cookies (Google Analytics) help us understand how visitors use the site; this data is processed in aggregated form. Third parties that may place cookies via our website include Google and Elfsight. You can opt out of cookies by configuring your browser to no longer store them, and you can delete previously stored cookies via your browser settings.

Your rights

You have the right to access, correct or delete your personal data. You can also withdraw your consent to data processing, object to the processing of your personal data by Mesa Mesa, and request data portability. Send your request to reserveringen@mesamesa.nl. To verify your identity we may ask for additional information. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

How we protect your data

Mesa Mesa takes the protection of your data seriously and takes appropriate measures to prevent misuse, loss, unauthorised access, unwanted disclosure and unauthorised changes. Our website uses TLS encryption (HTTPS). If you feel that your data is not properly secured or there are indications of misuse, please contact us at reserveringen@mesamesa.nl.

Calling us

When you call us, a digital assistant picks up and the call is recorded. What we do with those recordings and the details you give is described in the privacy statement for the phone assistant.