Privacy Policy
Last modified on June 30, 2025.
First and foremost, we are pleased that you are interested in the products and services of Le Pain Quotidien.
In this privacy statement, we inform you about how Personal Data you provide to us through various channels, including our Application, Website, and third-party social media channels, is processed by us.
It is possible that we may ask you to share certain Personal Data with us, including but not limited to your first name, last name, and email address (identification data). For certain specific obligations, you may need to provide us with additional information, such as payment and billing details.
We only collect the Personal Data necessary to inform you about our products and services, to communicate with you, to execute an agreement with you, to pursue our legitimate interest, and to comply with a legal obligation to which we are subject.
We base this on the legal grounds of contract performance, legal obligation, our legitimate interest, and, in some cases, your consent (see also Article 3).
The processing of your Personal Data is subject to this privacy statement. For questions and/or comments, please contact feedback@lepainquotidien.be.
By providing Personal Data, you are deemed to have acknowledged the use of your Personal Data in accordance with this privacy statement.
Article 1 – Definitions
“Affiliated Company” means any company that is affiliated to Le Pain Quotidien insofar as it meets the conditions for an “affiliated company” as set out in article 1:20 of the Belgian Code on Companies and Associations.
“Application” means the "Le Pain Quotidien" loyalty application developed for mobile devices with iOS and Android operating systems, customized and managed by Como AI Malta Limited, headquartered at Suite 10, 189 Marina Suites, Marina Street, Pieta PTA 9041 (Malta).
“Controller” has the meaning as defined in the General Data Protection Regulation 2016/679.
The Controller determines the purposes and means of the processing of Personal Data.
“Le Pain Quotidien” means Brunchco NV, trading under the name ‘Le Pain Quotidien’, a company organized and existing under Belgian law, with registered office at 1000 Brussels (Belgium), Avenue du Port 86/C and registered with the Crossroads Bank of Enterprises under number 0747.485.166.
“Personal Data” has the meaning as defined in the General Data Protection Regulation 2016/679, which is any information relating to an identified or identifiable natural person (also referred to as “data subject”).
“Processor” has the meaning as defined in the General Data Protection Regulation 2016/679, which processes Personal Data on behalf of the Controller.
“Website” means the website of Le Pain Quotidien: www.lepainquotidien.com.
Article 2 – Types of Personal Data
As part of our services, we collect and process various categories of Personal Data, including identity, contact, and financial information. These data may relate to you in your capacity as a customer, supplier, or client, as well as their personnel and employees. While it is not possible to provide a complete list of all the Personal Data we process, the following overview serves as an illustrative and non-exhaustive list:
General Personal Data:
- First and last name
- Gender
- Address details
- Phone number
- Email address
- Interaction data
- IP address (to the extent that we can identify you)
- Purchase history (to the extent that we can identify you)
- Other Personal Data that you provide to us or that we receive from third parties in the context of our services
Sensitive Personal Data:
- Financial data, such as your bank account number, if necessary
Article 3 – Processing purposes and legal bases
A. Legal and regulatory obligations
Customers
To comply with the obligations imposed on the Controller under legal and administrative requirements, as well as the provisions of the Civil Code and accounting legislation, we process certain data as part of our services. This includes identity and contact details, as well as financial data of our customers, clients, their personnel, and employees.
Suppliers and Subcontractors
To comply with legal and administrative obligations imposed on the Controller, as well as the provisions of the Civil Code and accounting legislation, we process identity and contact details and financial data of our suppliers and subcontractors. This also applies to their potential (sub)contractors, personnel, and employees.
Personnel
To fulfill the legal and administrative obligations imposed on the Controller and comply with applicable accounting legislation, we process identity and contact details and financial data of our personnel as part of personnel management and payroll administration.
B. Necessary for the performance of the contract
Customers
As part of our services, we collect and process the identity and contact details of our customers and clients, as well as their personnel and employees, as necessary for the performance of the contract. This includes executing our services, managing customer assignments, customer administration, and accounting. Additionally, in the pre-contractual phase, we process these data for contacting, negotiating, and providing/requesting information in relation to drafting and concluding a contract.
Suppliers and Subcontractors
We collect and process the identity and contact details of our suppliers and subcontractors, as well as their potential (sub)contractors, personnel, and employees, for purposes such as contract execution, supplier/subcontractor management, and accounting. This also applies in the pre-contractual phase for contacting, negotiating, and providing/requesting information in relation to drafting and concluding a contract.
Personnel
We process Personal Data of our employees necessary for the execution of their employment contract in the context of personnel management and payroll administration, such as identity and contact details and financial information.
Applicants
We process the identity and contact details, as well as work history and other information commonly found on a CV (such as a photo), of job applicants when they provide this information to us. The Personal Data is processed to assess whether they qualify for a job with us. The processing of these data is necessary for the performance of a contract.
C. Legitimate interest
Customers
As part of our services, we collect and process the identity and contact details of our customers and clients, as well as their personnel and employees, based on our legitimate interest for direct marketing activities, such as sending promotional or commercial information.
Suppliers and Subcontractors
We collect and process the identity and contact details of our suppliers and subcontractors, as well as their potential (sub)contractors, personnel, and employees, based on our legitimate interest to ensure the proper functioning of our activities.
Personnel
We process the Personal Data of our employees in the context of personnel management and payroll administration based on our legitimate interest.
D. Consent
Customers
As part of our services, we collect and process the identity and contact details of our customers and clients, their personnel and employees, based on your consent for the use of cookies, the use of photos on our Website and social media pages, the use of testimonials on our Website, and direct marketing activities such as sending promotional or commercial information.
Personnel
We process the Personal Data of our personnel, such as photos used for commercial purposes or posted on our Website, based on their consent.
Applicants
When we wish to retain Personal Data related to an application longer than two months after the completion of the selection process, we will ask for your consent. From this point onward, we will process these Personal Data based on your consent.
Other Data
In addition to the data of customers, suppliers/subcontractors, personnel, and applicants, we also process Personal Data of others, such as potential new customers/prospects, useful contacts within our industry, network contacts, etc. This occurs through our Application, Website, third-party social networks, or other channels. The purposes of these processing activities are in the interest of our business activities, direct marketing, promotional games, contests, and other promotions, and public relations. The legal basis is our legitimate interest, the performance of a contract, and, in some cases, your consent.
Specifically, we may use the Personal Data we collect for the following purposes:
(i) to send you our newsletter, if you sign up via the Website;
(ii) to find stores near you, if you provide your location via the Website;
(iii) to locate you in order to offer you deals and/or promotions based on your location, if you agree to share your location with us via the Application;
(iv) to send you information about our products and services (via push notifications, SMS messages, email, and/or other channels), if you sign up for this;
(v) to provide you with our products and services (including the features, properties, and services of the Application) and to execute any agreements;
(vi) to make automated decisions that will result in you receiving various offers that we tailor in advance for you, if you sign up for this;
(vii) to process and handle potential complaints or requests;
(viii) to process your job application;
(ix) to help us evaluate, correct, or improve the Application, Website, and all related products or services of Le Pain Quotidien;
(x) for promotional games, contests, or other promotions, to process your participation in the promotional games or contests and inform you about the outcome of the promotional games, contests, or other promotions;
(xi) for direct marketing purposes;
(xii) for internal purposes, including business administration and archiving purposes.
Article 4 – Confidentiality of Personal Data
Whenever you provide Personal Data to us, we will handle this information in accordance with the provisions of this privacy statement and the legal obligations related to the processing of Personal Data, including the General Data Protection Regulation (GDPR) 2016/679.
We implement appropriate measures and procedures to secure and protect the Personal Data we collect via the Application, Website, or electronic correspondence. In this way, we commit ourselves, to the extent reasonably expected, to prevent unlawful processing of Personal Data and inadvertent loss or destruction of your Personal Data. However, despite these precautions, we cannot guarantee that your Personal Data will be protected if this data is transmitted or communicated outside the contact form on the Website through insecure channels or in another manner.
We aim to optimize the security of your Personal Data by limiting access to your Personal Data to persons with a "need-to-know" basis (for example: only Le Pain Quotidien and its employees, personnel, or subcontractors who need your Personal Data for the purposes described in Article 3 will have access to the data).
Article 5 – How do we collect your Personal Data and how lang are they retained?
Collection of Your Personal Data
We collect your Personal Data – without being exhaustive – in the following cases:
(i) when you sign up on the Website to receive our newsletter;
(ii) when you fill out the registration form developed by us to register for the Application;
(iii) when you register for the Application via your social media account;
(iv) when you register for the loyalty program ‘Tartine Club’;
(v) when you identify yourself to collect points within the framework of ‘Tartine Club’;
(vi) when you enter your location on the Website to find stores near you;
(vii) when you make a purchase via the Application;
(viii) when you use the Application, as a result of which we will make automated decisions, if you agree to this;
(ix) when you enter into an (employment) agreement with us;
(x) when you call, email, or correspond with us in any way other than through the Website;
(xi) when you participate in promotional games, contests, or other promotions organized by us on third-party social networks and/or websites;
(xii) when you apply for a position at Le Pain Quotidien.
We avoid collecting Personal Data that is not relevant to the purposes outlined in Article 3.
We may combine the Personal Data we collect with information provided to us by third parties, provided this is compatible with the purposes for which the data was originally collected. We will inform you of the types of Personal Data, as well as the source and purpose of this Personal Data. We process this Personal Data in accordance with this privacy statement.
Retention of Your Data
Personal Data will be retained and processed by us for a period necessary to fulfill the purposes of the processing.
Customer data and supplier or subcontractor data will, in any case, be deleted from our systems after a period of 7 (seven) years following the termination of the agreement, unless there is an ongoing dispute in which the Personal Data is still required.
We emphasize that removing the Application from your device does not result in the deletion or anonymization of your Personal Data. You must contact us if you wish for your data to be deleted.
Personal Data of employees will be deleted immediately and no later than five years after the termination of the employment relationship, except for Personal Data that we are required to retain based on specific legislation or in the event of an ongoing dispute where the Personal Data is still necessary.
Personal Data of applicants will be deleted after the relevant position has been filled, no later than 1 (one) month after the end of the application process, or after a period of 1 (one) year after consent was obtained to contact applicants about future job opportunities.
Other data will not be retained for more than 2 (two) years after the last meaningful contact with you, unless explicit consent has been obtained to retain this data for a longer period.
Article 6 – Transfer of Personal Data
We will not transfer any Personal Data to third parties located outside the European Economic Area. Exceptions may include subcontractors or employees who (i) are located in a country that the European Commission or the Minister of Justice recognizes as having an adequate level of protection for the processing of Personal Data, or (ii) store the Personal Data in accordance with the Standard Contractual Clauses of the European Commission, thus ensuring an adequate level of security for the processing of Personal Data.
Furthermore, we will not transfer Personal Data to other parties within the European Economic Area without your consent, unless:
(i) the transfer is necessary to allow affiliated companies, employees, agents, or subcontractors to provide a service or perform a task on our behalf, which is necessary for the execution of the contract we have with you or within the scope of our legitimate interest (including, but not limited to, providing marketing support, conducting market research, or providing customer service);
(ii) it is required by law.
Any transfer of Personal Data to a recipient as outlined above will be in compliance with the provisions of the General Data Protection Regulation 2016/679.
We ensure that measures are in place so that recipients do not use the Personal Data for purposes other than those explicitly listed in Article 3, and that recipients have implemented adequate technical and organizational measures to protect the data.
To ensure the security of Personal Data, we will always enter into a data processing agreement with the aforementioned recipients of the Personal Data.
We will take all necessary precautions to ensure that employees and personnel who have access to the Personal Data process it exclusively in accordance with this privacy statement and the legal obligations under the General Data Protection Regulation 2016/679.
Article 7 – Rights of the Data Subject
Under both Belgian and European data protection legislation, you have the rights described below. If you wish to exercise any of these rights, you must send us a written request at feedback@lepainquotidien.be.
We will inform you of the action to be taken within 1 (one) month of receiving your request. This period may be extended by up to 2 (two) months if the request is complex, in which case we will inform you within 1 (one) month of the original request about the reasons for the delay. If we decide not to comply with your request, we will notify you within 1 (one) month of receiving the request about why it remains unfulfilled.
The Right of Access to Personal Data
You have the right to request that we provide all the Personal Data we hold about you and to request a free copy of this data, provided that the rights of other data subjects are not affected. If you request additional copies, we may charge you a reasonable fee equal to the administrative cost of making these copies.
The Right to Rectify Personal Data
We kindly ask you to ensure that the Personal Data in our database is as accurate and complete as possible. If you believe that the data we have is incorrect or incomplete, you are asked to notify us as described above. We will then correct or supplement your Personal Data as soon as possible.
The Right to Erase Personal Data
You have the right to request the erasure of your Personal Data without undue delay in the following cases:
(i) If it is no longer necessary to retain the Personal Data for the purposes for which it was collected or otherwise processed;
(ii) If it is legally required;
(iii) If the Personal Data was obtained when you were a minor;
(iv) If the Personal Data was obtained without your explicit consent;
(v) If you withdraw your consent for processing based on consent.
(vi) However, there are certain general exclusions to the right to erasure.
These exclusions include situations where processing is necessary for:
(i) Compliance with a legal obligation; or
(ii) The establishment, exercise, or defense of legal claims.
The Right to Restrict the Processing of Personal Data
In the following cases, you have the right to restrict the processing of your Personal Data:
(i) If you contest the accuracy of your Personal Data;
(ii) When the processing is unlawful, but you do not want the Personal Data to be erased; or
(iii) If you object to the processing of your Personal Data, pending the verification of that objection.
If the processing is restricted on this basis, we may continue to store your Personal Data. However, we will only process the data with your explicit consent for the establishment, exercise, or defense of legal claims, to protect the rights of another natural or legal person, or for reasons of substantial public interest.
The Right to Object
You have the right to object to our processing of your Personal Data in the following cases:
(i) If we process your Personal Data for direct marketing purposes (including profiling for such purposes) based on our legitimate interest;
(ii) Due to your specific situation (your particular personal circumstances).
The Right to Data Portability
If you wish to exercise your right to data portability, we will transfer your Personal Data to a data controller of your choice in a structured, commonly used, and machine-readable format.
The Right to Withdraw Consent
To the extent that the legal basis for our processing of your Personal Data is your consent, you have the right to withdraw your consent at any time. However, this withdrawal will not affect the lawfulness of the processing carried out prior to the withdrawal.
The Right to Lodge a Complaint with a Supervisory Authority
You may contact the Data Protection Authority at any time by sending an email to contact@apd-gba.be or by mailing a written request to the Data Protection Authority, located at 1000 Brussels (Belgium), Drukpersstraat 35. You have the right to lodge a complaint with the competent court.
Article 8 – Third Party links
It is possible that the Application and Website contain links to other applications/websites that are not managed by us, such as LinkedIn. While we make every effort to ensure that these links lead only to websites with corresponding security and confidentiality standards, we are in no way responsible for the protection and confidentiality of Personal Data, including the data you provide on other websites once you leave the Application or Website.
We emphasize the importance of proceeding carefully and always consulting the privacy statement applicable to the relevant application/website before providing Personal Data on other websites.
Article 9 - Modifications
We reserve the right to amend this privacy statement at any time by publishing a new version on our Application/Website.
We recommend that you regularly check the Application/Website to verify whether you agree with any changes to this privacy statement.
In any case, you will be informed of any changes to this privacy statement by email, provided we have your email address.
Article 10 - Cookies
Le Pain Quotidien uses "cookies" whenever you use the Website. A "cookie" is information sent from the server to your device and stored on the device's hard drive. Cookies help Le Pain Quotidien recognize your device when you use the Website. This allows Le Pain Quotidien to make the experience more user-friendly and provide you with personalized service.
For more information, please refer to our cookie statement, which you can find on our Website cookie statement.