Privacy Policy
Last updated: 22 October 2026
1. Who is responsible
Swarte Walvis, operating Restaurant D'Swarte Walvis (The Black Whale), Kalverringdijk 13-15, 1509 BT Zaandam, the Netherlands, KvK 17140976, is the controller of your personal data as described in this policy. D'Swarte Walvis is part of Lacandon Groep. Questions about privacy: bookings@lacandon.nl.
2. Which data we collect and why
Table reservations (via our online reservation system)
Data: name, phone number, email, number of guests, date and time, allergies or wishes you share
Legal basis: performance of the agreement
How long we keep it: no longer than necessary, at most 2 years after your last visit
Group bookings, events and quotes (via our request form)
Data: name, company, contact details, event details, invoice details
Legal basis: performance of the agreement
How long we keep it: 7 years for financial records (legal tax obligation)
Contact form and email
Data: name, email, phone number, your message
Legal basis: legitimate interest in answering your question
How long we keep it: until your question has been handled, at most 1 year
Newsletter, only if you sign up
Data: name, email
Legal basis: consent
How long we keep it: until you unsubscribe
Gift cards and loyalty programme
Data: name, email, phone number, points and gift card balance, purchases and visits
Legal basis: performance of the agreement; consent for loyalty messages
How long we keep it: as long as your account or gift card is active; 7 years for financial records
Job applications
Data: CV, letter, contact details
Legal basis: consent and preparing an agreement
How long we keep it: 4 weeks after the procedure, or 1 year with your consent
Website statistics and cookies
Data: see our Cookie Policy
Legal basis: consent, or legitimate interest for strictly necessary cookies
How long we keep it: see Cookie Policy
Camera surveillance (in parts of the building, indicated by signs)
Data: images
Legal basis: legitimate interest in safety
How long we keep it: maximum 4 weeks, unless needed for an incident
We only use allergy and dietary information to prepare your visit safely, and only with your consent.
3. Who we share data with
We do not sell your data. We only share data with parties that help us run our business, under a data processing agreement:
our website and hosting provider (website and forms)
our online reservation system
our system for group and event requests
providers of website statistics, only with your consent
our newsletter, gift card and loyalty programme provider
our payment provider, accountant and IT suppliers
other companies within Lacandon Groep, when your request concerns one of our sister venues
Some of these suppliers may process data outside the European Economic Area. In that case, appropriate safeguards apply, such as the EU standard contractual clauses.
4. Your rights
You have the right to access, correct or delete your data, to restrict or object to processing, to data portability, and to withdraw your consent at any time. Send your request to bookings@lacandon.nl. We respond within one month. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl).
5. Security
We take appropriate technical and organisational measures to protect your data against loss and unauthorised access. Only staff who need your data for their work have access to it.
6. Changes
We may update this policy. The latest version is always on this page.