Privacy Policy

1. Introduction

Orbis Table ("we," "our," or "us") is committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your data when you use our restaurant booking and management platform (the "Platform").

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By using our Platform, you consent to the data practices described in this policy.

2. Who We Are

Data Controller: Orbis Table

Registered Office: West 3, Asama Court, Newcastle Business Park, Newcastle upon Tyne, NE4 7YD, UK

Phone: 0191 6031150

Contact Email: privacy@orbistable.co.uk

Support Email: support@orbistable.co.uk

We are the data controller for personal information collected through our Platform. If you have any questions about this Privacy Policy or how we handle your data, please contact us using the details above.

3. Information We Collect

3.1 Information You Provide

When you use our Platform, we collect information that you voluntarily provide:

• Account Information: Name, email address, phone number, password (encrypted)
• Booking Information: Reservation details, party size, date and time preferences, special requests
• Payment Information: Billing address, payment card details (processed securely through Stripe and GoCardless; we do not store full card numbers)
• Communications: Messages, feedback, and support requests you send to us or to restaurants through the Platform
• Marketing Preferences: Your email and SMS subscription preferences

3.2 Information Automatically Collected

• Usage Data: Pages visited, features used, booking history, search queries
• Device Information: IP address, browser type, operating system, device identifiers
• Cookies and Tracking: Session cookies, analytics cookies, preference cookies
• Log Data: Server logs, error reports, performance metrics

3.3 Information from Third Parties

• Payment Providers: Transaction confirmations and payment status from Stripe and GoCardless
• Analytics Services: Aggregated usage statistics and performance data

4. How We Use Your Information

We process your personal data for the following purposes:

Purpose	Data Used	Legal Basis
Provide booking services	Account info, booking details	Contract performance
Process payments	Payment information, billing address	Contract performance
Send booking confirmations	Email, phone, booking details	Contract performance
Customer support	Contact info, communications	Legitimate interest
Improve our Platform	Usage data, analytics	Legitimate interest
Marketing communications	Email, phone (if subscribed)	Consent
Prevent fraud	IP address, device info, booking patterns	Legitimate interest
Legal compliance	As required by law	Legal obligation

5. How We Share Your Information

5.1 With Restaurants

When you make a booking, we share your name, contact details, party size, and special requests with the restaurant to fulfill your reservation.

5.2 With Service Providers

• Payment Processors: Stripe and GoCardless (PCI-DSS compliant)
• Cloud Hosting: Database hosting in EU/UK regions
• Email Services: For sending booking confirmations and notifications
• SMS Services: VoodooSMS (for Premium+ plan users)
• Analytics: Anonymized usage analytics for service improvement

5.3 Legal Requirements

We may disclose your information when required by law, court order, or regulatory authority, or to protect our rights, property, or safety.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.

6. International Data Transfers

Your data is primarily stored and processed within the United Kingdom and European Economic Area (EEA). If we transfer data outside the UK/EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the ICO, adequacy decisions, and binding corporate rules.

7. Data Retention

• Account Data: Retained while your account is active, plus 2 years after closure
• Booking Records: Retained for 2 years after the reservation date
• Payment Data: Retained for 7 years to comply with tax and accounting laws
• Marketing Data: Retained until you withdraw consent or 2 years of inactivity
• Analytics Data: Aggregated data retained for 2 years; anonymized data retained indefinitely

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your data (subject to legal obligations)
• Right to Restrict Processing: Request limitation on how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for marketing purposes
• Right to Withdraw Consent: Withdraw consent for data processing at any time
• Right to Lodge a Complaint: File a complaint with the ICO

To exercise any of these rights, please contact us at privacy@orbistable.co.uk. We will respond within 30 days.

9. Data Security

• Encryption: Data encrypted in transit (TLS 1.3) and at rest (AES-256)
• Access Controls: Role-based access with multi-factor authentication for staff
• Monitoring: Continuous security monitoring and intrusion detection
• Regular Audits: Security assessments and penetration testing
• Data Breach Response: Incident response plan with 72-hour ICO notification

10. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance your experience. See our Cookie Policy for full details.

11. Children's Privacy

Our Platform is not intended for individuals under the age of 16. We do not knowingly collect personal information from children.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a prominent notice on the Platform.

13. Contact Us and Complaints

If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the ICO: