Privacy Policy

1. Who we are

Bread & Wine is a restaurant at 2 Sherwood Rise, Nottingham NG7 6JN. In this notice, “we”, “us” and “our” refer to the organisation that operates the restaurant and decides how your personal information is used — the data controller.

To confirm: the full legal name of the organisation or sole trader operating Bread & Wine. The correspondence address has been confirmed as 2 Sherwood Rise, Nottingham NG7 6JN.

This notice covers our website, table requests, private-event enquiries, general correspondence and the public reviews displayed on our website. We handle this information under the UK GDPR and the Data Protection Act 2018, as amended.

2. Information we collect and where it comes from

• Contact details: your name and email address, plus your telephone number if you provide it.
• Table requests: your preferred date and time, number of guests, message, subsequent correspondence and relevant notes about how your request is handled.
• Event enquiries: your preferred or flexible date, type of occasion, number of guests, message and arrangements discussed with our team.
• Messages: your subject, enquiry, attachments sent by email and information you choose to share in follow-up conversations.
• Website and preference data: connection information such as your IP address, browser or device information, page requests, cookie choices and associated consent records.
• Public review information: the public reviewer name, rating, review text and date obtained from Google Maps through our review service, as described in section 7.

Most enquiry information comes directly from you through a form, email, telephone call or conversation. We may receive booking details from the person organising a group visit on your behalf. Technical information comes from your browser and the services that deliver the website.

Using an enquiry form and providing information is your choice. The forms identify the details needed to handle your request. Without those details we may be unable to respond or arrange a table or event. Optional fields can be left blank. You do not need to create a guest account to use these enquiry forms.

3. Why we use information and our legal bases

Arranging a table or private event

We use the details of your request to discuss availability, respond, make arrangements and manage a confirmed booking. Where you are making arrangements for yourself, our basis is taking steps at your request before a contract and performing that contract — Article 6(1)(b). For a business or group organiser who is not personally a party to the contract, our basis is legitimate interests — Article 6(1)(f): managing the enquiry and providing the requested restaurant service.

Answering messages and managing our relationship

We use correspondence to answer questions, handle service issues and follow up relevant arrangements. Our legitimate interests are providing customer service and keeping a necessary record of what has been agreed. Where needed, we also use relevant records to establish, exercise or defend legal claims, relying on our legitimate interest in protecting our legal rights. This does not turn a booking enquiry into permission to send marketing.

Operating and protecting the website

We use necessary technical information for delivery, troubleshooting, accessibility and protection against spam or misuse. Our legitimate interests are maintaining a usable and secure website. Our form protection uses a short-lived coded identifier derived from an IP address to limit repeated submissions; it does not add the raw IP address to the enquiry record.

Recording choices, meeting duties and displaying reviews

We record cookie choices to apply your preferences and demonstrate compliance with applicable consent requirements. We rely on legal obligations — Article 6(1)(c) — for required compliance records and responses to data-protection requests. Where optional processing requires consent, we rely on Article 6(1)(a); that consent must be obtained separately. Our legitimate interest in showing public Google reviews is helping guests assess the restaurant, subject to reviewers’ rights.

Where we rely on legitimate interests, we consider whether the processing is necessary and how it affects you. You may object, as explained in section 10.

To confirm: whether newsletters, analytics, advertising, online payments, CCTV or identifiable guest photography are used. Any actual additional activity needs its own accurate purpose, data categories, legal basis and retention information. Their absence from this draft is not a claim that they are switched off.

4. Health information and details of other guests

Information about an allergy, disability or medical condition can be health information, which receives additional legal protection. Please do not put detailed medical information into a general website message. Telephone our team to discuss the practical requirements for your visit.

To confirm: the restaurant’s process for requesting and recording any necessary health details, its Article 6 basis and Article 9 condition, who can see those details, and when they are removed. Merely entering health information into a form does not establish explicit consent.

If explicit consent is used for health information, it must relate specifically to the details and purpose concerned and can be withdrawn by contacting us. Withdrawal does not affect earlier lawful use. Our team would discuss how withdrawal affects the arrangements and any suitable alternatives.

If you organise a group visit, share only the guest information needed for the arrangements, make the guests aware of this notice and do not send somebody else’s health details without an appropriate basis. Our website enquiry forms are intended for adults arranging visits; they do not ask for children’s names or dates of birth.

5. Who receives your information

Enquiries are stored in our website’s private staff panel. Authorised staff and administrators use them to handle your request. If email notifications are enabled, a copy is also sent to the configured restaurant mailbox through our email service.

• Hosting, email, IT support and backup providers: provide the systems used to store, deliver, support and recover the website and correspondence.
• Elementor services: provide the Cookiez preference tool and an accessibility widget. The configured consent service can receive your consent identifier, choices, page URL, browser information and request metadata when you make a cookie choice.
• Google: receives browser requests for externally hosted fonts and, when you load the map or visit a Google link, information connected with that service.
• SerpAPI: retrieves publicly available Google review information for our server. The review request does not send the website visitor’s form details to SerpAPI.
• Professional advisers, authorities or courts: may receive relevant information where needed to meet a legal duty, obtain advice or handle a legal claim.

To confirm: the actual hosting, email/SMTP, backup and support providers, relevant service arrangements and any other recipients. WP Mail SMTP is the delivery plugin, not necessarily the organisation providing the mailbox or email transport.

Service providers that process information on our behalf must have appropriate contractual and security arrangements. Some external platforms also use information for their own services under their separate privacy notices. Public review information displayed by us is visible to website visitors.

6. Cookies, maps and external website services

Cookies and preferences

Cookiez provides the website’s cookie preference controls and records choices. You can reopen them using “Cookie settings” in the footer. Browser settings can also restrict or remove cookies, although removing a stored choice may cause the preference tool to ask again.

The separate Cookie Policy is intended to explain the actual storage technologies, providers, purposes and durations. Agreeing to this Privacy Policy is not consent to optional cookies or electronic marketing.

To confirm: the final cookie and storage inventory, including WooCommerce attribution scripts and accessibility preferences, their purposes and durations, and which are blocked or exempt. The current presence of a consent tool is not evidence that every optional service is blocked correctly.

Google Maps

The map in the Contact section is loaded when you choose “Show Google Map”. Loading it connects your browser to Google, which can receive technical information and use cookies or account information under its own rules. You can read our address without loading the map. “Open in Google Maps” and directions links take you to Google separately. Hiding an already loaded map does not undo information already sent to Google.

Fonts, accessibility and social links

Externally hosted Google Fonts require your browser to contact Google to retrieve font files. The Elementor accessibility widget also connects to its provider to load the tool. Those connections reveal technical request information such as an IP address and browser details; they are different from submitting an enquiry.

Instagram and Facebook links take you to those platforms. Their handling of information is governed by their own notices. For more information about the named website providers, see Google’s Privacy Policy and Elementor’s Privacy Policy.

7. Public Google reviews

Our review section republishes information from the publicly accessible Bread & Wine Google Maps listing through SerpAPI. This includes the reviewer’s public display name, star rating, review text and date, and links to the source. It is not obtained from a private booking or contact message.

We use these details to show genuine guest feedback, relying on the legitimate interest described above. The website keeps a local cached copy to avoid fetching the reviews on every visit. A reviewer can contact us to object to this use or request the removal of their information from our website. We will assess the request and explain the outcome. Changes to the original review on Google must be handled through Google; we cannot change its records.

To confirm: how the required privacy information is provided to individuals whose data we receive indirectly, including public reviewers and identifiable guests named by a group organiser, or which properly assessed and documented exception applies. Public availability does not automatically remove this requirement, and asking an organiser to share this notice does not transfer our responsibility.

8. International transfers

Using external providers can involve personal information being stored or accessed outside the United Kingdom. A provider’s overseas headquarters alone does not establish where a particular record is processed.

To confirm: the countries relevant to our hosting, email, consent/accessibility and review services; whether any transfer is restricted under UK law; and the actual protection used for each transfer. Where applicable, this may be UK adequacy regulations or an International Data Transfer Agreement or UK Addendum, with the necessary assessment. The applicable mechanisms and a way to obtain information about them must be inserted here before publication.

You can ask us for information about the safeguards relevant to your personal information using the contact details below.

9. How long we keep information

To confirm: the retention periods or specific decision criteria for enquiry records, confirmed bookings/events, correspondence, technical logs, consent records and backups. The current staff-panel plugin has no automatic deletion schedule; marking a request as archived does not delete it.

The schedule needs to distinguish arranging a visit or event and resolving its follow-up from keeping particular records for a legal duty or claim. Any longer retention should relate to the information actually needed for that purpose, rather than retaining the entire original message by default.

Information can exist in more than one place, including the staff panel, email and backups. Removing a panel record does not remove a copy from a mailbox or backup. The final schedule must explain how those copies are managed and when expired information is deleted or anonymised.

The form protection uses a 10-minute expiry for temporary coded identifiers. The review plugin treats cached public reviews as valid for up to 48 hours and removes expired copies when checked. These expiry settings do not guarantee physical deletion from every store at that exact moment. Cookie and consent-record retention is to be completed in the Cookie Policy and the relevant provider schedule.

10. Your data-protection rights

Depending on the information and the legal basis concerned, you may have the right to:

• ask for access to your personal information and information about its use;
• have inaccurate information corrected or incomplete information completed;
• ask for information to be erased or its use restricted in the circumstances provided by law;
• receive and transfer information you supplied where the portability rules apply, including qualifying automated processing based on consent or contract;
• withdraw consent where we rely on it, without affecting earlier lawful processing;
• complain to us and to the ICO, the UK’s data-protection regulator.

Your right to object: you can object to our use of your information based on legitimate interests for reasons relating to your particular situation. We must stop that use unless we can demonstrate an applicable overriding ground or it is needed for legal claims. If your information is used for direct marketing, you can object at any time and we must stop using it for that purpose; you do not have to give a reason.

Contact info@breadandwine.uk to make a request. We may need proportionate information to verify your identity or understand a request. We normally respond to a rights request within one calendar month. The law allows extensions or pauses in certain circumstances, for example complex requests or reasonably necessary clarification of an access request; we will explain any applicable change to the timeframe.

Rights are subject to legal conditions and exceptions. For example, erasure may not apply to information that must be kept to meet a legal obligation or deal with a legal claim. Requests are normally free of charge; any lawful refusal or charge will be explained. See the ICO’s information for the public.

11. Security and automated processing

The enquiry panel is designed to restrict access to authorised staff and administrators, with separate permissions for settings. Appropriate access controls, maintenance, email security and backup management remain part of the restaurant’s responsibility. No website or email system can promise absolute security.

Table and event requests are reviewed by our team and are subject to confirmation. The enquiry system does not make a solely automated decision to confirm a booking. Anti-spam checks can temporarily prevent a repeated submission; if you cannot use the form, contact us by telephone or email.

To confirm: that no other system makes solely automated decisions with legal or similarly significant effects, and that the actual staff access and security arrangements match this notice.

12. Contact us or make a privacy complaint

For a privacy question, rights request or complaint, email info@breadandwine.uk, telephone 0115 919 5854 or write to Bread & Wine at 2 Sherwood Rise, Nottingham NG7 6JN. Explain your concern and how you would like us to contact you.

We will acknowledge a data-protection complaint within 30 days, investigate it without undue delay and keep you informed of progress and the outcome. This acknowledgement timeframe is separate from the rules for responding to a rights request.

You also have the right to complain to the ICO, the UK’s data-protection regulator. Visit ico.org.uk/make-a-complaint, telephone 0303 123 1113 or write to Information Commission’s Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester M1 7BL. Contacting us first can help resolve the issue.

13. Changes to this notice

We will update this notice when our services, providers or processing change and show the revision date. Where required, we will explain a new use of your information before it starts and obtain any necessary separate permission. A change to this notice does not itself give us consent to new processing.