Privacy statement
Last updated: 1-11-2026 · This statement is available in Dutch and English; the Dutch version prevails.
BarMaat is a till and tab system for club bars. This statement explains which personal data is processed, why, how long it is kept and what your rights are.
1. Who is responsible?
- The club using BarMaat is the controller for the data in its own environment: accounts of bar staff and managers, guests' names on tabs, orders, regular guests and suppliers. For questions about that data, please contact the club first.
- BarMaat provides BarMaat and is the processor of that data (see the data processing agreement). For the website, demo environments, trial requests, platform accounts and invoicing of clubs, BarMaat is itself the controller.
BarMaat
[adres]
Privacy questions: [e-mail]
2. Which data, for what purpose and on what legal basis?
| Data | Purpose | Legal basis (GDPR art. 6) | Retention |
|---|---|---|---|
| Account: name, email address, password (hashed), language and appearance choice, last login | Logging in and access to the till and management | Performance of a contract (b) | Until you delete the account or the club removes you |
| Signing up with a name only (bar shift) | Temporary access to the till | Legitimate interest of the club (f) | Deleted automatically 30 days after access has expired |
| Bar roster: name, email address, shifts and PIN code (hashed, and encrypted for reminders) | Emailing the PIN code and reminders, giving access to the till during the shift, and letting a shift be handed over | Legitimate interest of the club (f) | Deleted automatically 30 days after the last shift |
| Permissions and roles, with period | Determining who may do what | Performance of a contract (b) | As long as the account exists |
| Guests' names on tabs and orders, with what was ordered and paid | Keeping and settling tabs | Legitimate interest of the club (f) | After a period chosen by the club (default 12 months) the name is replaced by a number; amounts remain for the accounts |
| Activity log (who, what, when, IP address) | Security and accountability (e.g. cash differences) | Legitimate interest (f) | IP address erased after 90 days, entries deleted after 24 months |
| Failed login attempts (email, IP address) | Protection against break-in attempts | Legitimate interest (f) | 1 day |
| Demo environment (IP address when requesting) | Preventing abuse | Legitimate interest (f) | The demo is deleted completely within 24 hours |
| Trial request: club details, contact person, first manager, IP address | Reviewing and starting a trial | Pre-contractual steps (b) | Rejected: 90 days; IP address erased 30 days after handling |
| Club contact and billing details, invoices, emails sent | Subscription, invoicing and communication | Contract (b) and legal obligation (c) | Invoices 7 years (tax law); email log 24 months |
| Improvement requests | Improving the service | Legitimate interest (f) | Until handled and no longer needed |
| Contact form: name, email address, club, message, IP address | Answering your question; preventing abuse | Legitimate interest (f) | IP address erased after 30 days; handled messages deleted after 12 months |
| Confirming your email address and resetting your password (one-time link) | Making sure the email address is yours; regaining access | Performance of a contract (b) | Links expire after 7 days (confirmation) or 1 hour (reset). Accounts and requests that are never confirmed are deleted after 7 days |
| Website visitor statistics | Seeing how many people visit the website and where they come from | Legitimate interest (f) | Only daily counts. No IP address is stored; a visitor is only recognised within one day by an encrypted code that is erased after that day |
We do not use the data for other purposes, do not sell it and do not create profiles. There is no automated decision-making.
3. Cookies and local storage
BarMaat uses no tracking, analytics or advertising cookies and loads nothing from third parties. The visitor statistics above work without cookies. So we do not ask for cookie consent. We only use what the app needs to work:
| Name | Purpose | Retention |
|---|---|---|
barmaat_sid | Session cookie: stay logged in | 30 days |
barmaat_lang | Chosen language | 1 year |
barmaat_theme | Chosen appearance (light/dark) | 1 year |
| Browser local storage | Orders waiting for a connection, order of people on the till and tour progress | Until sent or until you clear your browser data |
4. Who receives data?
- Hosting: [hostingpartij en land].
- Backups: only if a club sets this up, to the storage (S3) chosen by the club and/or as a zip by email to the club's managers, optionally encrypted with a password. Before a backup is restored, a copy of the current data is kept on the server; it is deleted after 90 days.
- Email: via the mail server configured by the club or the platform.
Data is not transferred outside the European Economic Area unless stated above and with appropriate safeguards.
5. Security
The connection is encrypted (HTTPS). Passwords are stored hashed only, secret keys (such as for backups and mail servers) encrypted. Everyone only sees what belongs to their role, and each club only sees its own data. BarMaat itself does not look at a club's data either, unless a manager of that club gives temporary permission (for support) or the law requires it.
6. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection. Much of this you can do yourself under My account:
- Access and portability: "Download my data" gives all your data in one file.
- Rectification: change your name under My account.
- Erasure: "Delete account" erases your account and login details. Orders you rang up remain in the club's accounts, but without your name.
For data in a club's environment (for example your name on a tab), please contact that club. For other questions: [e-mail]. We respond within one month.
If you disagree with how we handle your data, you can lodge a complaint with your data protection authority (in the Netherlands: the Autoriteit Persoonsgegevens).
7. Changes
We may update this statement. The date at the top shows when it was last changed.