Who is responsible
The Qave is responsible for your personal data (the controller under the EU's data protection regulation, GDPR).
Write to us at info@theqave.se about anything on this page. We answer within a month, usually much sooner.
What we keep, and why
- When you order
- Your name, email address and mobile number, what you order with your choices and notes, and for delivery your address and door details. We need them to cook your food, deliver it, tell you how your order is going and help if something goes wrong. Card payments are handled by Stripe: we never see or keep your card number.
- Your account
- If you sign in (with a code we email you, or with your Google account; never a password): your email address, name and mobile number, and your orders, bookings and membership in one place. Cards you choose to save are kept by Stripe, not by us, and you can remove them on your account page.
- Table bookings
- Your name, email address, mobile number, how many you are, and anything you tell us (a birthday, a high chair, an allergy). We also note whether you came: if a booking is missed a few times, we ask to confirm the next one before it is held.
- Events and tickets
- Your name, email address, mobile number, dietary needs and requests, so we can let you in, seat you and cook for you. If you join a waiting list, your name and email address, so we can tell you when a seat is free.
- Qave Flavours
- Your delivery address and door details, the delivery days and times you choose, allergies you tell us, your usual dishes and any pause. Your monthly payment is a subscription with Stripe.
- Messages, catering and private events
- What you write and how to answer you (name, email address, mobile number if you give it), and for catering or a private event the date, the number of guests and the place. We keep the conversation so whoever answers knows what was said.
- Allergies and dietary needs
- These can say something about your health. You choose what to tell us. We use it only to make and serve your food safely, show it only to the people who cook and serve it, and remove it when you ask us to delete your data.
- News and offers
- Only if you say yes, or, when you order, unless you untick the box (Swedish marketing law lets a restaurant tell its own customers about its food that way). We keep your email address, your name and when and how you said yes. Every email has a link to stop them, and so does your account page. When you click a link in one of our emails, we note that it was clicked, to learn what interests people.
- Visiting the website
- No tracking cookies and no analytics company. We count visits ourselves: which page, where the visit came from (Google, Instagram, an ad), phone or computer, and the language, as totals per day, never anything that says who you are. To stop abuse, our server looks briefly at your internet address; those notes are deleted within a few hours.
The legal grounds
- To keep our agreement with you
- Orders, bookings, tickets, Flavours and your account (GDPR article 6.1 b).
- Because the law says so
- Receipts and the bookkeeping behind every payment (Swedish bookkeeping law).
- Our legitimate interest
- Answering your messages, keeping the website safe, counting visits without knowing who you are, noting missed bookings, and news to customers who did not untick the box (article 6.1 f). You can object at any time.
- Your consent
- News when you ticked the box, and the allergies you choose to tell us (articles 6.1 a and 9.2 a). You can take it back at any time.
Who helps us
We never sell your data or share it for anyone else's advertising. These companies do work for us and see only what that work needs:
- Amazon Web Services
- Our servers and database, in Stockholm, and the emails we send you (Amazon SES).
- Stripe
- Card payments, saved cards and Flavours subscriptions. Stripe also decides some things itself, such as fraud checks, under its own privacy policy.
- When you type an address, the suggestions come from Google, and we check a delivery address with Google Maps to work out the distance. Google gets the address, not your name. If you choose to sign in with Google, Google tells us your email address and name, and Google's own privacy policy covers that step.
- Zoho
- The mailbox where emails you send us arrive.
Outside the EU
Where one of these companies handles data outside the EU or EEA, it does so under the protections the EU approves: the EU–US Data Privacy Framework or the EU's standard contract clauses.
How long we keep it
- Orders and payments
- Seven years after the year they happened, because the bookkeeping law says so. If you delete your data before then, your name, contact details and address are removed and only the amounts and dishes stay, without you.
- Your account
- Until you delete it.
- Table bookings, tickets and waiting lists
- Your details are removed a year after the date.
- Messages
- Two years after the last reply.
- Flavours
- Your deliveries as for orders. Your address, allergies and usual dishes until you delete your account.
- News
- Until you stop them. After that your email address stays on our do-not-email list, so we never email you again.
- Abuse protection
- A few hours.
- Server logs
- Our servers' technical logs are deleted after 30 days.
- Backups
- Our database keeps backups for up to 35 days, then they are gone.
What you can ask of us
- A copy
- On your account, under Your data, we email you everything we keep about you, in a form other services can read too.
- To change something
- On your account page, or write to us.
- To delete it
- On your account, under Your data, or write to us. We keep only what the bookkeeping law requires, without your name.
- To stop news
- With the link in any of our emails, or on your account page.
- To object or to limit
- Write to us, and we stop using your data for that purpose unless the law requires otherwise.
- To complain
- To us first, if you like, and always to Integritetsskyddsmyndigheten (IMY), Sweden's data protection authority, at imy.se.
How we keep it safe
Everything you send us travels encrypted. Sign-in codes are kept only as a scrambled fingerprint and expire within minutes; guests have no passwords to leak. Your card number never reaches us. The people who work here see only what their job needs, sign in with a password and a check of their device, and every change they make in the back office is logged.
When this page changes
If we change how we handle your data, we change this page and the date at the top. If the change matters to you, we email you.