Hong Xiang SARL · Dudelange
Privacy and cookies
24 route de Burange, L-3429 Dudelange
Controller
Hong Xiang SARL, 24 route de Burange, L-3429 Dudelange, registered with the Luxembourg Trade and Companies Register under number B 104098, controls the data used by this service. Contact: [email protected] or +352 26 52 18 60.
Data we use
The service uses account identity and contact data, verification and session data, addresses, order, reservation and student-meal details, payment status and references, messages, notes, and limited technical and security logs. Raw card data is not stored.
Purposes and legal bases
The data is used to create the account, provide orders and reservations, and perform the contract or requested steps before it. It is also used for legal and accounting duties, and for security, fraud prevention and defence of the service where a legitimate interest applies. No advertising profile or newsletter is planned.
Recipients
Only authorised restaurant staff and necessary providers receive the data needed for their task. These providers are Railway Corp. for hosting the application and database in the EU West region, Cloudflare, Inc. for delivery, DNS service and network protection, Stripe Payments Europe, Limited, in Ireland, for card payments, Zoho Corporation B.V. and its ZeptoMail service in the European Union for service emails, and Twilio Ireland Limited for verification SMS. No data is sold or used for advertising purposes.
Retention
Orders, reservations and payment records are kept for ten years, a period required by Luxembourg accounting and tax obligations. The customer account is kept for as long as it exists and until its deletion. A session expires at most thirty days after it is created. Verification codes sent by email or SMS expire after a few minutes. Technical and security logs are kept for a maximum of twelve months. Weekly-menu PDFs are kept privately for three months.
Account deletion
You can delete your account from the My Account page, Security section. Deletion anonymises your customer record and ends your sessions. Orders and reservations already placed keep the name, email, phone number and address recorded at the time of the order, because these records serve as accounting evidence and must be kept for the legal retention period. They are no longer linked to an active account.
Essential storage
Language, cart, security, session and service continuity use only strictly necessary storage. No advertising or behavioural tracking is used, and no consent is requested for advertising or analytics.
International transfers
Stripe Payments Europe, Twilio Ireland and ZeptoMail process data within the European Union. Railway hosts the application and database in the EU West region in the Netherlands, but is a company established in the United States. Cloudflare, Inc. is also established in the United States and may process technical data outside the European Economic Area. These transfers rely on the European Commission's standard contractual clauses and, where the provider is certified under it, on the EU-US Data Privacy Framework.
Your rights
You may request access, correction, deletion where allowed, restriction, objection and portability where it applies. You may withdraw consent where consent is used. Some legal records must still be kept for their mandatory retention period.
Complaint
Contact Hong Xiang first with any question. You may also complain to the Commission nationale pour la protection des données, 15 boulevard du Jazz, L-4370 Belvaux, Luxembourg.
Required data and automation
Fields marked as required are needed to create the account or fulfil the request. No advertising profiling or solely automated decision with a similarly significant effect is planned.