We are committed to protecting your privacy and handling your personal information in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy applies when you visit our website, make a reservation, place an order, sign up to hear from us or visit the restaurant.
01 Who we are
Vembanad Restaurant & Lounge is operated by [Registered Company Name] Ltd, registered in England and Wales under company number [Company Number], with its registered office at [Registered Address]. We are the data controller responsible for your personal information. Our ICO registration number is [ICO Registration Number].
02 Information we collect
Information you give us
- Contact details — your name, email address and phone number when you book, order or contact us.
- Booking details — date, time, party size, special occasions and seating preferences.
- Dietary and allergy information — which may reveal health information. We only use it to prepare your food safely, and only with your consent.
- Order and payment details — items ordered and delivery address. Card payments are processed securely by our payment providers; we do not store full card numbers.
- Feedback and correspondence — reviews, enquiries and messages you send us.
Information we collect automatically
- Technical data — IP address, browser type, device information and pages visited, collected through cookies and similar technologies (see Cookies).
- CCTV footage — recorded at our premises for safety and security.
Information from third parties
If you book or order through a third-party platform (such as a table booking service or delivery app), they will share the details needed to fulfil your booking or order with us.
03 How we use your information
We only use your personal information where the law allows us to. The table below explains what we use it for and our lawful basis for doing so.
| Purpose | Lawful basis |
|---|---|
| Managing reservations, orders and payments, and contacting you about them | Performance of a contract |
| Catering for allergies and dietary requirements | Your explicit consent |
| Sending news, offers and event invitations by email or SMS | Your consent (you can opt out at any time) |
| Responding to enquiries, feedback and complaints | Legitimate interests |
| Improving our website, menu and service | Legitimate interests |
| Keeping our guests, team and premises safe, including CCTV | Legitimate interests |
| Keeping financial records and meeting legal obligations | Legal obligation |
We will never sell your personal information.
04 Sharing your information
We only share your information with trusted organisations that help us run our business, and only as much as they need:
- table reservation and online ordering platforms;
- payment processors and our bank;
- delivery partners, for delivery orders;
- email and SMS marketing providers, if you have opted in;
- website hosting, IT and analytics providers; and
- our accountants, legal advisers and insurers.
These organisations must keep your information secure and may only use it on our instructions. We may also share information where required by law, for example with the police or regulators.
05 International transfers
Some of our service providers may store data outside the UK. Where this happens, we make sure appropriate safeguards are in place, such as UK adequacy regulations or the UK International Data Transfer Agreement, so that your information receives the same level of protection.
06 How long we keep your information
- Reservation records — up to 2 years after your visit.
- Financial and transaction records — 6 years, as required by HMRC.
- Marketing preferences — until you unsubscribe or withdraw consent.
- Allergy information — only for as long as needed for your booking or order, unless you ask us to save it for future visits.
- CCTV footage — around 30 days, unless needed to investigate an incident.
After these periods, we securely delete or anonymise your information.
07 Cookies
Cookies are small text files stored on your device when you visit a website. We use:
- Essential cookies — needed for the website to work, such as remembering your booking progress.
- Analytics cookies — help us understand how visitors use the site so we can improve it.
- Third-party cookies — set by embedded services such as maps, videos, booking widgets and social media.
We only set non-essential cookies with your consent. You can change your preferences at any time, or block cookies through your browser settings, although some parts of the website may then not work as intended.
08 CCTV
We operate CCTV in and around the restaurant to protect our guests, team and property, and to help prevent and detect crime. Signs are displayed where cameras are in use. Footage is accessed only by authorised staff and is shared only with the police or insurers where necessary.
09 Your rights
Under data protection law, you have the right to:
- access the personal information we hold about you;
- ask us to correct information that is inaccurate or incomplete;
- ask us to delete your information in certain circumstances;
- ask us to restrict how we use your information;
- object to our use of your information based on legitimate interests, and to direct marketing at any time;
- receive your information in a portable format (data portability); and
- withdraw consent at any time, where we rely on consent.
To exercise any of these rights, contact us using the details below. We will respond within one month and will not usually charge a fee. You can unsubscribe from marketing messages at any time using the link in any email or by replying STOP to any SMS.
10 Keeping your information secure
We use appropriate technical and organisational measures to protect your personal information, including secure (HTTPS) connections, access controls and trusted, PCI DSS-compliant payment providers. Only team members who need your information to do their job can access it. While no system is completely secure, we work hard to protect your data and will act promptly if a breach occurs.
11 Children
Our website and services are not aimed at children under 13, and we do not knowingly collect their personal information. Reservations and orders must be made by an adult.
12 Changes to this policy
We may update this policy from time to time to reflect changes in our practices or the law. The latest version will always be available on this page, with the date it was last updated shown at the top.
13 Contact us & complaints
If you have any questions about this policy or how we handle your information, or would like to exercise your rights, please contact us:
- Vembanad Restaurant & Lounge, [Full Address, Postcode]
- [Phone Number]
- [privacy@yourdomain.co.uk]
If you are unhappy with how we have handled your information, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk or on 0303 123 1113. We would, however, appreciate the chance to resolve your concerns first. Please also see our Terms & Conditions.