DRAFT FOR REVIEW — DO NOT PUBLISH WITH PLACEHOLDERS. This template must be tailored to the venue’s actual personal-data practices and approved by the client before publication.
1. Who we are
This website is operated by [LEGAL BUSINESS NAME], trading as [VENUE NAME]. Our postal address is [FULL BUSINESS ADDRESS]. Contact us about privacy at [PRIVACY CONTACT EMAIL].
2. The information we collect
When you contact us, request a reservation or enquire about an event, we may receive your name, contact information, requested date, number of guests and the information you choose to include in your message. [CONFIRM ANY ADDITIONAL CATEGORIES; DO NOT ASK FOR UNNECESSARY SENSITIVE INFORMATION.]
Our website may also process technical information necessary for its operation and security. The separate Cookie Policy explains cookies and similar technologies in use.
3. Why we use the information and our lawful bases
- General enquiries: to respond to questions about our services. [CONFIRM AND INSERT THE APPROPRIATE UK GDPR LAWFUL BASIS, E.G. LEGITIMATE INTERESTS WHERE ASSESSED.]
- Bookings and events: to discuss, arrange and manage requested reservations or functions. [CONFIRM WHETHER CONTRACT / PRE-CONTRACTUAL STEPS OR ANOTHER BASIS APPLIES.]
- Security and abuse prevention: to protect the website and its visitors. [CONFIRM LAWFUL BASIS AND SECURITY SUPPLIERS.]
- Marketing, if used: [DESCRIBE ANY MARKETING, THE LAWFUL BASIS, PECR REQUIREMENTS AND HOW PEOPLE OPT OUT. DELETE IF NOT APPLICABLE.]
4. Who receives the information
Information may be processed by our website hosting provider, website support provider, email service and the form, security or booking services we use. [NAME THE ACTUAL PROVIDERS OR CLEAR CATEGORIES, AND EXPLAIN ANY SHARING WITH THIRD-PARTY BOOKING PROVIDERS.]
5. International transfers
[STATE IF INFORMATION IS TRANSFERRED OUTSIDE THE UK, THE DESTINATIONS AND THE RELEVANT LEGAL SAFEGUARDS; OR STATE THAT NO SUCH TRANSFERS OCCUR IF VERIFIED.]
6. How long we keep information
[SET AN ACTUAL ENQUIRY-RETENTION PERIOD OR CRITERIA, INCLUDING EMAIL INBOXES, HOSTING BACKUPS AND ANY FORM ENTRY STORAGE.] We will not retain personal data longer than necessary for the stated purposes, subject to legal obligations.
7. Your rights
Depending on the circumstances, you may have rights to access, correct, erase, restrict, object to processing of, or receive copies of your personal data. Where processing relies on consent, you may withdraw that consent. Contact [PRIVACY CONTACT EMAIL] to make a request. Some rights have exceptions depending on the lawful basis.
You also have the right to complain to the UK’s Information Commissioner’s Office (ICO): ico.org.uk.
8. Cookies and external websites
Our Cookie Policy explains the cookies and similar technologies used on this website, including any consent controls. Links to Facebook, Instagram, TikTok, online booking providers or maps may lead to external websites with their own privacy practices. [CONFIRM WHICH THIRD-PARTY SERVICES ARE ACTUALLY USED.]
9. Contact details and changes
For privacy questions, contact [PRIVACY CONTACT EMAIL]. We review this notice when our services or handling of personal information changes.
Last reviewed: [DATE AFTER CLIENT APPROVAL]