Privacy Policy

THE BOX TREE RESTAURANT PRIVACY POLICY

Last updated: September 2026

The Box Tree Restaurant respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and protect your personal information when you visit our website, make a reservation, purchase a gift voucher, contact us, dine with us, attend an event or otherwise interact with The Box Tree.

It also explains your rights under UK data protection law and how you can contact us if you have any questions about the way we use your information.

WHO WE ARE

The Box Tree Restaurant is operated by The Box Tree Restaurant Limited, with its registered office at Church Street, Ilkley, West Yorkshire, LS29 9DR, United Kingdom.

For the purposes of UK data protection law, The Box Tree Restaurant Limited is the data controller responsible for the personal information described in this Privacy Policy.

Our website is www.theboxtree.co.uk.

If you have any questions about this Privacy Policy or the way we use your personal information, please contact us using the details at the end of this Policy.

WHAT INFORMATION DO WE COLLECT?

The personal information we collect depends on how you interact with us and may include:

• your name;
• email address;
• telephone number;
• postal or billing address where required;
• reservation and dining information;
• gift voucher purchase information;
• payment and transaction information;
• correspondence and communications with us;
• dietary requirements, allergies or accessibility requirements that you choose to provide;
• marketing preferences;
• information about your interactions with our emails;
• technical information about your device and use of our website, including IP address, browser type and cookie information; and
• any other information you choose to provide to us.

We aim only to collect information that is relevant and necessary for the purposes described in this Policy.

HOW DO WE COLLECT YOUR INFORMATION?

We may collect personal information directly from you when you:

• make or enquire about a restaurant reservation;
• contact us by telephone, email, through our website or in person;
• purchase a gift voucher;
• subscribe to our newsletter or marketing communications;
• attend an event or dine at the restaurant;
• enter a competition or promotion;
• provide feedback or correspond with us; or
• otherwise use our website or services.

We may also receive information from third parties that provide services on our behalf, including restaurant reservation, payment, gift voucher, website, analytics and email marketing providers.

Where another person makes a reservation or enquiry on your behalf, we may receive personal information about you from that person.

INFORMATION ABOUT OTHER PEOPLE

If you provide personal information about another person, for example when making a restaurant reservation on behalf of other guests, you should ensure that you are entitled to provide that information to us and, where appropriate, that they understand how their information will be used.

Please avoid providing information about another person that is not necessary for the relevant reservation, enquiry or service.

HOW WE USE YOUR PERSONAL INFORMATION

We may use your personal information to:

• manage restaurant reservations and enquiries;
• provide our food, hospitality and other services;
• process payments and gift voucher purchases;
• communicate with you about your reservation, purchase or enquiry;
• manage dietary, allergy and accessibility requirements;
• provide customer service and respond to feedback;
• operate, maintain and improve our website;
• understand how guests use our website and services;
• prevent fraud and protect the security of our website, guests and business;
• maintain appropriate financial, tax and business records;
• send marketing communications where we are permitted to do so;
• manage competitions, promotions and events;
• establish, exercise or defend legal claims; and
• comply with our legal and regulatory obligations.

OUR LAWFUL BASES FOR USING YOUR INFORMATION

Under UK data protection law, we must have a lawful basis for processing your personal information.

Depending on the circumstances, we may rely on:

Contract – where processing your information is necessary to provide a service you have requested, manage a reservation or fulfil a purchase.

Legal obligation – where we need to process or retain information to comply with a legal requirement.

Legitimate interests – where processing is necessary for our legitimate business interests or those of a third party, provided those interests are not overridden by your rights and interests.

Consent – where you have actively agreed to a particular use of your information, such as certain forms of electronic marketing or the use of non-essential cookies. Where we rely on consent, you may withdraw it at any time.

DIETARY REQUIREMENTS & ALLERGY INFORMATION

When making a reservation, you may choose to provide information about allergies, intolerances, dietary requirements or other information relevant to your dining experience.

Some of this information may constitute special category personal data under UK data protection law.

Where required, we will process this information with your explicit consent or where another lawful condition permits us to do so. We use this information only where reasonably necessary to accommodate your requirements and provide our services safely.

RESTAURANT RESERVATIONS

We use OpenTable as our restaurant reservation provider to process and manage bookings.

When you make a reservation through OpenTable, your information may be processed by OpenTable in accordance with its own privacy policy and its arrangements with us.

Information provided through OpenTable may include your name, contact details, booking history, party size, dietary requirements, special requests and other information relevant to your reservation.

OpenTable may also send you reservation confirmations, reminders, amendments or cancellation communications on our behalf.

PAYMENTS

We use Worldpay as our payment provider to process payments, including payments relating to reservations, gift vouchers and other purchases.

We do not generally store complete payment card details ourselves. Worldpay processes payment information in accordance with applicable security standards and its own privacy terms.

We may retain transaction records where required for accounting, taxation, fraud prevention or other legitimate business purposes.

MARKETING & EMAIL NEWSLETTERS

If you subscribe to our newsletter or otherwise consent to receive marketing from us, we may use your contact details to send you news, restaurant updates, menus, events, offers and other information relating to The Box Tree.

In certain circumstances, we may also send electronic marketing to existing customers where permitted under applicable electronic marketing laws.

You can unsubscribe at any time by clicking the unsubscribe link contained within our marketing emails or by contacting us.

Our email marketing platform may collect information about engagement with our communications, such as whether an email has been opened and whether links have been clicked. We may use this information to understand the effectiveness of our communications and improve the information we send.

You have the right to object to the use of your personal information for direct marketing at any time.

WHO WE SHARE YOUR INFORMATION WITH

We do not sell your personal information.

We may share personal information where necessary with trusted third parties that provide services to us, including:

• OpenTable, our restaurant reservation provider;
• Worldpay, our payment provider;
• gift voucher platforms;
• email and marketing platforms;
• website hosting and technology providers;
• analytics providers;
• professional advisers, including accountants, insurers and legal advisers; and
• regulatory authorities, law enforcement bodies or other organisations where disclosure is required or permitted by law.

We require service providers processing personal information on our behalf to protect that information appropriately and use it only for the purposes for which it has been provided.

INTERNATIONAL TRANSFERS

Some of the service providers and technology platforms we use, including OpenTable, Worldpay and other providers, may process or store personal information outside the United Kingdom.

Where personal information is transferred internationally, we take appropriate steps to ensure that the transfer complies with UK data protection law. This may include relying on UK adequacy regulations or approved contractual safeguards.

HOW LONG WE KEEP YOUR INFORMATION

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including to satisfy legal, accounting, tax and reporting requirements.

For example:

• reservation and customer information will be retained for an appropriate period following your last interaction with us;
• financial and transaction records will be retained for the period required by applicable tax and accounting laws;
• marketing information will generally be retained until you unsubscribe, withdraw consent or object to receiving marketing, subject to retaining limited information necessary to ensure we respect your preferences; and
• correspondence may be retained where reasonably necessary for customer service, business administration or legal purposes.

We periodically review the information we hold and securely delete or anonymise information that is no longer required.

KEEPING YOUR INFORMATION SECURE

We take appropriate technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure, loss or destruction.

Access to personal information is restricted to employees, contractors and service providers who have a legitimate need to access it.

However, no internet transmission or electronic storage system can be guaranteed to be completely secure. You should therefore take appropriate care when sending personal information electronically.

YOUR DATA PROTECTION RIGHTS

Depending on the circumstances, UK data protection law gives you rights in relation to your personal information, including:

1. The right to be informed.
2. The right of access.
3. The right to rectification.
4. The right to erasure.
5. The right to restrict processing.
6. The right to data portability.
7. The right to object to processing.
8. Rights relating to automated decision-making and profiling, where applicable.

You also have the right to withdraw consent at any time where we rely on your consent to process your information.

These rights are not absolute and may be subject to exemptions or limitations under applicable law.

If you wish to exercise any of these rights, please contact us using the details below. We may need to request information from you to confirm your identity before responding.

COMPLAINTS

If you have concerns about how we handle your personal information, please contact us so that we can investigate your concerns.

You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

Further information is available at ico.org.uk.

USE OF COOKIES

Our website uses cookies and similar technologies.

Cookies are small files stored on your device that help websites operate and can provide information about how visitors use them.

Some cookies are strictly necessary for our website to function and do not require consent.

Other cookies, such as those used for analytics, advertising or certain third-party functionality, will only be used where the appropriate consent has been obtained.

Where applicable, our website’s cookie management tool allows you to accept, reject or manage non-essential cookies. You can change your preferences through the cookie settings available on our website.

You can also control cookies through your browser settings, although disabling certain cookies may affect the functionality of the website.

The specific cookies and similar technologies used on our website may change as our website and service providers change. Further details should be provided through our website’s cookie management tool or Cookie Policy.

ANALYTICS

We may use analytics services, including Google Analytics or similar technologies, to help us understand how visitors interact with our website.

These services may collect information such as pages viewed, approximate location, device and browser information, referral source and interactions with our website.

Where analytics technologies require consent under applicable law, they will not be activated until the appropriate consent has been provided through our cookie management system.

THIRD-PARTY WEBSITES & SOCIAL MEDIA

Our website may contain links to third-party websites and social media platforms.

If you follow a link to another website or platform, that organisation may collect and process information about you in accordance with its own privacy policy.

We do not control third-party websites and are not responsible for their privacy practices. We recommend reviewing the relevant privacy information before providing personal information to a third party.

Any comments, messages or other information you share with us through social media will also be subject to the terms and privacy practices of the relevant social media platform.

CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes to our business, website, service providers or legal requirements.

The latest version will be published on our website and the date at the top of this Policy will show when it was last updated.

CONTACT INFORMATION

If you have any questions about this Privacy Policy, how we use your personal information or wish to exercise your data protection rights, please contact:

The Box Tree Restaurant

35–37 Church Street

Ilkley

West Yorkshire

LS29 9DR

Email: info@theboxtree.co.uk