SLA Privacy Statement
Last modified: 14 July 2026
1. Who are we?
SLA Holding B.V. (“SLA”) is the controller for the processing of personal data as described in this
statement. Where an SLA location is operated by a group company or franchisee, SLA Holding B.V. acts as
the central point of contact, and internal arrangements have been made regarding the division of
responsibilities.
Address: Amstelveenseweg 124, 1075 XL Amsterdam
Chamber of Commerce (KvK): 57641188 — VAT: NL852670941B01
Contact: info@ilovesla.com
This statement applies to data we process from visitors to our website and ordering environment,
customers at our locations, and participants in Club SLA.
2. What data do we process and why?
a. Orders (pickup, delivery, catering)
We process your name, contact details, delivery/invoice address, and order and payment details in order
to fulfil your order.
Legal basis: performance of the contract.
b. Club SLA
We process your name and e-mail address, and — if you provide them yourself — your phone number
and date of birth (both optional), as well as your purchase and savings data, in order to award points,
provide rewards, and operate the programme.
Legal basis: performance of the contract.
We use your date of birth to give you a surprise on your birthday.
Legal basis: consent.
c. Personalised offers and profiling
Based on your purchase and usage data, we compile personalised offers (profiling). We do this on the
basis of your consent. You can withdraw that consent at any time via info@ilovesla.com.
d. Newsletter and direct marketing
If you sign up, we use your e-mail address to send you our newsletter and offers. You can unsubscribe at
any time via the link at the bottom of every e-mail.
Legal basis: consent, or legitimate interest for existing customers.
e. Website, statistics, and advertising
When you visit the website, we process your IP address, device and browsing data, and the pages you
view, in order to improve the website, measure visits, and — with your consent — show relevant
advertisements (see cookies).
Legal basis: legitimate interest (functional/statistics) and consent (marketing).
f. CCTV at our locations
Our locations may have camera surveillance to protect guests, staff, and property. This is indicated at the
location. We retain camera footage for a maximum of four weeks, or longer if footage is needed to
handle a reported incident.
Legal basis: legitimate interest (security).
g. AI-assisted communication and customer service
We use AI-assisted software to draft and send informational e-mails (such as order confirmations) and to
answer incoming questions and complaints (for example about allergens, opening hours, or orders). In
doing so, data such as your name, order details, and the content of your message are processed to
personalise and automate communication.
If the matter concerns a sensitive topic, such as a report of an allergic reaction, we ensure that it is
reviewed by an employee. You can always ask to be put in touch with an employee instead of receiving
an automated response.
Legal basis: performance of the contract (for order-related communication) or legitimate interest (for
other questions and customer service).
3. Cookies and similar technologies
We use cookies on the website. On your first visit, we ask for your consent to non-essential cookies via
the cookie banner. You can adjust your preferences at any time via the cookie settings, found in the
bottom left of the page.
- Functional and necessary cookies — needed to make the website and ordering environment
work (including language preference, logging in). No consent required. -
Analytical cookies (Google Analytics) — to measure and improve website usage. We have a data
processing agreement with Google. Placed after consent. -
Marketing cookies (Meta Pixel from Meta Platforms, for Facebook and Instagram) — to
measure the effectiveness of our advertisements and show you relevant ads on Facebook and
Instagram. Data may be shared with Meta as (joint) controller. Placed after consent.
You can delete or block cookies via your browser settings. Without certain cookies, the website may not
function optimally.
4. Who do we share data with?
We only share data with parties that perform services for us, including our ordering/POS provider (Vita
Mojo), payment service provider, delivery partners, e-mail and marketing service providers, providers of
AI-assisted tools, Google, and Meta. We enter into processing or cooperation agreements with these
parties. Where data is processed outside the EEA (for example by Google, Meta, or our AI provider in the
US), this is done on the basis of appropriate safeguards, such as certification under the EU-U.S. Data
Privacy Framework or the European Commission’s standard contractual clauses.
5. How long do we retain data?
We do not retain your data longer than necessary for the purpose for which it was collected, or as long
as required by law. Specifically: we retain order and invoice data for 7 years (statutory tax retention
obligation); Club SLA accounts that have been inactive for 24 months are deleted, including the points
balance; newsletter data is retained until you unsubscribe; camera footage for a maximum of four weeks
(see above).
6. Minors
If you are under 16, only provide data with the consent of a parent or guardian.
7. Security
We take appropriate technical and organisational measures to protect your data against loss and
unlawful processing.
8. Your rights
You have the right to access, rectify, erase, restrict, and object, and the right to data portability, as well as
the right to withdraw your consent. You can also object to direct marketing. Submit your request via
info@ilovesla.com. We respond within one month (with a possible extension of two months). If you
disagree with how your request was handled, you can file a complaint with the Dutch Data Protection
Authority (Autoriteit Persoonsgegevens).
9. Changes
We may amend this statement. The current version is always available at www.ilovesla.com.
10. Contact
Questions about privacy or cookies? E-mail info@ilovesla.com.