1. Who we are

Planty Kitchen is a trading name of PLANTY LONDON LTD, a private limited company registered in England and Wales (Companies House No. 14958330). Our registered office is Unit 20, The Circle, Queen Elizabeth Street, London SE1 2JE.

We’re the data controller for the personal information described in this notice — meaning we decide what gets collected and how it’s used.

If you want to talk to us about anything in this policy, email hello@plantylondon.com or call +44 7896 278832.

2. The short version

We collect the bare minimum needed to take your reservation, deliver your food, or answer your email. We don’t sell your data. We don’t run advertising on this site, and we don’t track your visit for analytics. You have rights under UK GDPR, and we’ll honour them. The full version below has the details, but that’s the gist.

3. What information we collect, and why

We collect different things in different situations. Here’s the breakdown.

3a. When you make a reservation

We collect your name, phone number, email address, party size, date and time, and any special requests (e.g. “window seat” or “birthday”).

We need this to actually hold a table for you. (Under UK GDPR, that’s called performance of a contract — Article 6(1)(b) if you’re keeping score.)

3b. When you order delivery

We collect your name, delivery address, phone number, email address, and your order. Our drivers occasionally need to call you about your order — that’s why we ask for your number.

Same lawful basis as reservations: we need it to actually deliver your food.

3c. When you email us

If you email hello@plantylondon.com, we keep your message and your email address so we can reply. We don’t add you to a marketing list — there is no marketing list.

We use this information based on legitimate interests (Article 6(1)(f)): the legitimate interest being “responding to people who get in touch with us.” That’s it.

3d. Payments (when we add Stripe)

When we start taking online payments, we’ll use Stripe as our payment processor. Stripe collects your card details directly through their secure forms — we never see, store, or handle card numbers. Stripe operates under its own privacy policy, which you can read at stripe.com/privacy.

If you pay in person at the restaurant, that’s handled by our card terminal provider in the same way.

Lawful basis: contract — we need to take payment to complete your order.

3e. Allergen information

If you tell us about a food allergy or dietary requirement (whether at the table, on the phone, or in a reservation), we treat that as special category data under Article 9 of UK GDPR — it’s information about your health, and we handle it more carefully. There’s a separate section about this at the end (Section 14).

3f. Cookies

We use a small number of strictly necessary cookies to make the website work. We don’t use analytics cookies, advertising cookies, or any third-party tracking. The cookie banner gives you the choice on anything beyond strictly necessary.

Full details in our Cookie Policy.

3g. CCTV (once we open)

When the restaurant is open, we’ll have CCTV in the dining area and entrance for safety reasons. Footage will be held for a short period and only reviewed if there’s an incident. We’ll update this section with full details (recording duration, who has access, retention period) before we switch the cameras on. Until then, there’s no CCTV operating — there’s nothing to disclose because there’s nothing being recorded.

4. Who we share your information with

We don’t sell your information. We don’t share it with advertisers, data brokers, or “marketing partners.”

Here’s everyone who actually touches your data, and why:

• Hostinger International Ltd — our hosting and email provider in the UK. Your reservation, order, and email data sits on their servers.
• Stripe (when we add online payments) — they process card payments. They never share your card details back with us.
• HMRC, Companies House, or other UK authorities — only if we’re legally required to (e.g. tax records, court order). We don’t volunteer information to third parties.

That’s the entire list. We’ll update this if it ever changes.

5. Where your information is stored

Your information is stored with Hostinger International Ltd, our hosting provider, in the United Kingdom. Email correspondence is also handled through Hostinger’s email services. All your data remains within UK borders. We don’t transfer your information internationally.

If we ever change hosting or email providers, we’ll update this policy and notify users where required by law.

6. How long we keep your information

What	How long	Why
Reservation records	6 years	This isn’t us being nosy — UK tax law (HMRC) requires restaurants to keep transaction records for that long.
Delivery order records	6 years	Same reason.
Card payment records	We don’t keep these — Stripe / our card terminal provider does.	Card data security is handled by certified processors, not us.
Email correspondence	24 months from your last message	Long enough to handle follow-ups; not so long it becomes archaeology.
Allergen information	Tied to your order — 6 years	We keep it with the order it relates to, then it goes when the order does.
CCTV footage (once active)	To be specified before launch	Typically 30 days unless an incident is recorded.

After these periods, we delete or anonymise the data.

7. Your rights under UK GDPR

You have eight rights under UK GDPR. Here they are in plain English:

1. Right to be informed — to know what we do with your data. (You’re reading it.)
2. Right of access — to ask for a copy of the data we hold about you.
3. Right to rectification — to ask us to correct anything we got wrong.
4. Right to erasure — to ask us to delete your data, where we don’t have a stronger legal reason to keep it (e.g. tax records).
5. Right to restrict processing — to ask us to pause doing things with your data while we sort out a dispute.
6. Right to data portability — to ask for your data in a portable format so you can take it elsewhere.
7. Right to object — to tell us to stop processing data we hold under “legitimate interests.”
8. Rights related to automated decision-making and profiling — relevant if we ever made automated decisions about you. We don’t (see Section 11), but the right exists if that ever changes.

You also have the right to withdraw consent at any time, where we relied on consent in the first place (e.g. cookies, allergen information).

To exercise any of these, email hello@plantylondon.com. We’ll respond within one calendar month, as required by law. There’s no charge unless your request is excessive (UK GDPR’s word, not ours — and we’ll tell you upfront if we think it is).

8. Right to complain

If you think we’ve handled your data badly, you can complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator.

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We’d appreciate the chance to fix things first if you contact us before going to the ICO — but the ICO route is your right, and we won’t be offended.

9. Cookies and tracking

We use a small number of strictly necessary cookies. We don’t run analytics, advertising, or third-party tracking. Full details, including how to manage your preferences, are in our Cookie Policy.

10. Children’s privacy

Our website and services aren’t directed at children under 13. We don’t knowingly collect personal information from children under 13 without parental consent. If you’re a parent or guardian who thinks your child has given us their information without your permission, email us at hello@plantylondon.com and we’ll delete it.

11. Automated decision-making

We don’t use automated decision-making or profiling. No algorithm decides whether you can book a table or get a delivery — humans handle that. If we ever introduce anything that involves automated decisions with legal or similarly significant effects on you, we’ll update this policy first.

12. Changes to this policy

We’ll update this policy when our practices change. The “Last updated” date at the top tells you when we last revised it. If we make a material change (e.g. a new processor, a new lawful basis, a new category of data), we’ll do more than just update the date — we’ll flag it via the cookie banner or a direct email if we have your address from a previous interaction.

13. Contact us

For anything to do with this policy, your data, or your rights:

• Email: hello@plantylondon.com
• Phone: +44 7896 278832
• Post: PLANTY LONDON LTD, Unit 20, The Circle, Queen Elizabeth Street, London SE1 2JE, United Kingdom

We’ll respond within a reasonable time — at most one calendar month for formal data subject requests.

14. Special Category Data — Allergens

When you tell us about a food allergy or dietary requirement, that’s special category personal data under Article 9 of UK GDPR, because it’s information about your health.

We process this data under Article 9(2)(a) — your explicit consent. You give us consent by telling us about your allergy, and we use that consent narrowly: only to make sure your food is safe.

We use allergen information only for that purpose. We don’t use it for marketing, profiling, or anything else. We share it with our kitchen team and (if you’re ordering delivery) with the driver if it affects how the order needs to be handled.

You can withdraw consent at any time by emailing hello@plantylondon.com. If you withdraw during an active order, please tell us as early as possible. Once your meal is being prepared, we may continue using the allergen information to ensure your safety — under UK GDPR, your vital interests (Article 9(2)(c)) override consent withdrawal where there’s a genuine safety risk. We won’t keep using it after your order is complete.

Allergen data is held alongside the order it relates to and is kept for the same 6 years as the rest of the order record (HMRC requirement). After that, it’s deleted with the order.