Website Privacy Policy

Last updated: 8 August 2026

1. Who we are

This privacy policy explains how Street Cafe (St Albans) Ltd (“Street Cafe”, “we”, “us” or “our”) collects, uses and protects your personal data when you visit our website, make a reservation, sign up to our newsletter, buy a gift voucher, or otherwise get in touch with us. We are the data controller of the personal data described in this policy.

Address: 13 Catherine Street, St Albans, AL3 5BJ, United Kingdom
Email: info@streetcafe.com
Phone: 01727 294492
Company number: 10536237

We are not required to appoint a formal Data Protection Officer, but any privacy query, request or concern should be sent to the contact details above, marked ‘Privacy Enquiry’.

2. The personal data we collect

Depending on how you interact with us, we may collect the following categories of personal data:

Identity data – your name, and the names of guests in your party where relevant to a booking.
Contact data – email address, phone number, and postal address (for example if posting a gift voucher).
Booking and event data – reservation date, time, party size, table/event preferences, and details you provide about private dining or event enquiries.
Dietary, allergy and access requirements – information you choose to give us so we can safely cater for you (see section 3 below – this can be a ‘special category’ of data).
Transaction data – details of gift vouchers or other purchases, processed securely by our payment provider, Stripe. We do not store your full card details ourselves.
Marketing and communications data – your newsletter subscription status and preferences, and your marketing communication choices.
Technical and usage data – IP address, browser type and version, device information, and how you use our website, collected via cookies and similar technologies (see section 6).

3. Special category data (dietary, allergy and access needs)

Where you tell us about a food allergy, intolerance, medical dietary requirement, or accessibility need (for example when booking a table or a private event), this may count as special category data (health data) under UK GDPR. We only ask for this information where necessary to prepare food safely and provide you with a good experience, we only use it for that purpose, and we treat it with extra care. Our lawful basis for processing this data is your explicit consent (Article 9(2)(a) UK GDPR), given when you provide the information to us, and/or because processing is necessary for reasons of substantial public interest in ensuring food safety. You can withdraw this consent at any time by contacting us, though this may affect our ability to safely serve you.

4. How we collect your data

We collect personal data:

Directly from you, when you make a reservation, enquire about a private event, sign up to our newsletter, buy a gift voucher, contact us by phone, email or via the website, or interact with us on social media.
Automatically, through cookies and similar technologies when you use our website (see section 6).
From third parties who help us run our business, such as our payment processor (Stripe), our gift voucher partner (Vouchable), our email marketing platform (Klaviyo), and analytics or advertising platforms (Google, Meta, TikTok).

5. How we use your data and our legal basis

We only use your personal data where the law allows us to. Most commonly, this will be one of the following:

Purpose	What this covers	Lawful basis (UK GDPR Art. 6)
Handling table reservations	Processing bookings made via our website or by phone	Performance of a contract / steps prior to a contract (Art. 6(1)(b))
Managing private dining & event enquiries	Responding to enquiries about private hire, baby showers, birthdays and similar bookings	Performance of a contract; legitimate interests in responding to enquiries (Art. 6(1)(b), (f))
Sending our newsletter	Seasonal menu updates, themed nights and occasional offers to subscribers who sign up	Consent (Art. 6(1)(a)) – you can withdraw this at any time
Processing gift voucher purchases	Purchases made through our voucher partner, Vouchable	Performance of a contract; legal obligation (accounting/tax)
Responding to general enquiries	Messages sent via our contact details or contact form	Legitimate interests in dealing with and responding to enquiries (Art. 6(1)(f))
Operating and securing our website	Preventing fraud, misuse and technical faults; keeping the site running	Legitimate interests in the proper administration of our business (Art. 6(1)(f))
Analytics and site improvement	Understanding how visitors use our site so we can improve it	Consent, obtained via our cookie banner (Art. 6(1)(a))
Advertising and social media	Showing relevant ads on Google, Meta (Facebook/Instagram) and TikTok, and measuring their effectiveness	Consent, obtained via our cookie banner (Art. 6(1)(a))
Meeting legal and accounting obligations	Keeping records required by tax, food-safety and other law	Legal obligation (Art. 6(1)(c))

Where we rely on legitimate interests, we have considered that this processing is proportionate, that it would be within your reasonable expectations, and that it does not unduly impact your rights. You can ask us for more detail about this balancing test, or object to this processing, at any time (see section 10).

6. Cookies and similar technologies

Our website uses cookies and similar technologies to make the site work, understand how it is used, and (where you consent) to support marketing. When you first visit our website, you are shown a cookie banner where you can accept or reject non-essential cookies, and change your preferences at any time. Full details are set out in our separate Cookie Policy, summarised below:

Category	Purpose	Examples of providers
Strictly necessary	Required for the website and online booking/checkout to work; cannot be switched off	Our website platform, security (Cloudflare)
Functional / preferences	Remembers your settings and choices (e.g. cookie preferences)	Website platform
Statistics / analytics	Helps us understand how the site is used, in aggregate and anonymised where possible	Google Analytics
Marketing	Used to show relevant ads and measure campaign performance across sites	Google Ads, Meta (Facebook/Instagram) Pixel, TikTok Pixel
Social media	Lets embedded content (e.g. Instagram feeds) work, and may be set by the social network itself	Instagram/Meta
Payments	Enables secure card payments for gift vouchers and other online purchases	Stripe
Email marketing platform	Used if you sign up to our newsletter, to manage your subscription and preferences	Klaviyo

You can also control cookies through your browser settings, though blocking essential cookies may stop parts of the site (such as online booking) from working properly.

7. Who we share your data with

We share personal data only where necessary, with:

Service providers who process data on our behalf under contract, including our website host, payment processor (Stripe), gift voucher partner (Vouchable), and email marketing platform (Klaviyo).
Analytics and advertising platforms (Google Analytics, Google Ads, Meta/Facebook, Instagram, TikTok), where you have consented to marketing or analytics cookies.
Professional advisers, regulators and law enforcement, where we are required to by law.
A buyer, if we were to sell or transfer all or part of our business – your data would be transferred subject to the same protections in this policy.

We do not sell your personal data to third parties.

8. International transfers

Some of the third parties listed above (including Google, Meta, TikTok, Klaviyo and Stripe) may store or process data outside the UK, including in the United States. Where this happens, we rely on safeguards recognised under UK GDPR, such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses (as extended to the UK), or a UK adequacy regulation, to ensure your data continues to receive an appropriate level of protection.

9. How long we keep your data

We keep personal data only for as long as necessary for the purposes set out in this policy, including to satisfy any legal, accounting or reporting requirements. As a guide:

Booking and event enquiry data is typically kept for [insert period, e.g. 24 months] after your visit, to help manage repeat bookings and resolve any queries.
Newsletter data is kept until you unsubscribe or ask us to delete it.
Transaction records are kept for as long as required by UK tax and accounting law (currently at least 6 years).
Cookie and analytics data is retained in line with the retention periods set by each provider, as described in our Cookie Policy.

Where we no longer need personal data, we securely delete or anonymise it.

10. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

Be informed: Know how we collect and use your personal data – which is what this policy is for.
Access: Ask us for a copy of the personal data we hold about you.
Rectification: Ask us to correct any personal data that is inaccurate or incomplete.
Erasure: Ask us to delete your personal data, where there is no good reason for us to keep using it.
Restrict processing: Ask us to suspend our use of your personal data in certain circumstances.
Object: Object to our use of your personal data where we rely on legitimate interests, including for direct marketing.
Data portability: Ask us to transfer your data to you or to another organisation in a machine-readable format, where processing is based on consent or contract and carried out by automated means.
Withdraw consent: Where we rely on your consent (e.g. newsletter, non-essential cookies), withdraw it at any time.

To exercise any of these rights, please contact us at info@streetcafe.com or write to us at the address in section 1. We will normally respond within one month. This service is free of charge, unless a request is manifestly unfounded, excessive or repetitive, in which case we may charge a reasonable fee or decline to act.

11. Marketing preferences

We will only send you newsletter or marketing emails if you have opted in, for example by signing up on our website. Every marketing email includes an unsubscribe link, and you can also opt out at any time by emailing info@streetcafe.com. Opting out of marketing will not stop us sending you service-related messages, such as booking confirmations.

12. Children’s privacy

Our website is intended for adults making bookings and enquiries on behalf of their party, including where a booking or event (such as a baby shower or children’s celebration) involves children. We do not knowingly collect personal data directly from children through our website.

13. Changes to this policy

We may update this policy from time to time, for example to reflect changes in the law or in how we use your data. The ‘last updated’ date at the top of this page shows when it was last revised. We encourage you to review this policy periodically.

14. How to contact us or complain

If you have any questions about this policy or how we handle your data, please contact us at info@streetcafe.com or 01727 294492.

If you are unhappy with how we have handled your personal data, we would appreciate the chance to resolve it directly – please get in touch first. You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO): www.ico.org.uk, or by calling 0303 123 1113.