Privacy Policy

Privacy Policy

Privacy Policy

Last updated: 14 August 2025

This Privacy Policy explains how The Lavery (“we”, “us”, “our”), a trading name of Cromwell Place Ltd (company number 11550940), collects, uses, and protects your personal data when you interact with us, whether in person, online, or through our services.  We are committed to protecting your privacy and ensuring that your personal data is handled lawfully, fairly, and transparently in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

  1. Who We Are

The Lavery is a restaurant and events business located at 4–5 Cromwell Place, South Kensington, London, SW7 2JE. We are the data controller for the personal information we process.  Contact details for privacy matters: Email: info@thelavery.co.uk  Post: Data Protection, The Lavery, 4–5 Cromwell Place, London SW7 2JE

  1. Information We Collect

– Identity data – name, title, date of birth. – Contact data – email address, phone number, postal address. – Booking and event data – reservation details, dietary requirements, event preferences. – Payment data – billing address, payment card details (processed securely by third-party payment providers). – Marketing preferences – consent to receive newsletters, offers, or event invitations. – Employment data – for staff and applicants (CV, work history, right-to-work documents). – Website usage data – IP address, browser type, browsing patterns (via cookies and similar technologies).

  1. How We Use Your Information

– Provide and manage restaurant reservations, event bookings, and related services. – Process payments and issue invoices. – Communicate with you about your booking, enquiry, or employment application. – Send marketing communications where you have given consent (you can opt out at any time). – Improve our website and services through analytics and feedback. – Comply with legal obligations (e.g., record-keeping, tax, health & safety).

  1. Legal Basis for Processing

– Contract – to perform our obligations relating to your booking, event, or employment. – Consent – where you have agreed to receive marketing communications. – Legal obligation – to comply with UK laws and regulations. – Legitimate interests – to operate and improve our business, while respecting your rights.

  1. Who We Share Your Information With

We may share your personal data with trusted third-party service providers who help us operate our business, process bookings, manage payments, or deliver our services. These providers act as data processors or independent controllers depending on their role.  Current key service providers include: – SevenRooms – restaurant reservations & guest management (Privacy Policy – Lightspeed – point-of-sale & payment processing (Privacy Policy) – Xero – accounting & invoicing (Privacy Policy) – iVvy – event booking & management (Privacy Policy) – Deputy – staff scheduling & time management (Privacy Policy) – CharlieHR – HR and employee record management (Privacy Policy) – Parcel Tracker – delivery and parcel management (Privacy Policy/) – Microsoft Office 365 – email, file storage & collaboration (Privacy Policy) – WeTransfer – secure file transfer (Privacy Policy) – Pixable / Guestlist.com – event guest list management (Privacy Policy)  We may also share your data with professional advisers (lawyers, accountants, insurers) and regulatory authorities if required by law.  Please note: This list may change from time to time as we adopt new technologies or retire existing systems. The most current list will always be available upon request by emailing info@thelavery.co.uk.

  1. International Transfers

Some of our service providers may store or process your data outside the UK or EEA. Where this happens, we ensure that appropriate safeguards (such as UK-approved Standard Contractual Clauses) are in place.

  1. How We Protect Your Data

We implement technical and organisational measures to keep your data secure, including encryption, access controls, secure passwords, and regular staff training.

  1. How Long We Keep Your Data

– Booking records – 2 years after your last visit. – Event contracts and invoices – 7 years (for tax and accounting purposes). – Marketing data – until you withdraw consent or after 2 years of inactivity. – Employment records – up to 6 years after employment ends (unless otherwise required by law).

  1. Your Rights

You have the right to: – Access the personal data we hold about you. – Request correction of inaccurate or incomplete data. – Request deletion of your data (subject to legal obligations). – Object to processing based on legitimate interests. – Withdraw consent for marketing at any time. – Request data portability.  To exercise your rights, email info@thelavery.co.uk. We may require proof of identity before processing your request.

  1. Marketing Communications

If you have opted in, we may send you marketing emails about The Lavery’s restaurant, café, and events. You can opt out at any time by clicking the “unsubscribe” link in our emails or emailing info@thelavery.co.uk.

  1. Cookies

Our website uses cookies to improve functionality, enhance user experience, and analyse site traffic. Non-essential cookies (including analytics and marketing cookies) will only be set with your consent, obtained through our cookie banner.  For more information, see our Cookie Policy.

  1. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. Any changes will be posted on our website with the updated “Last updated” date.

Cromwell Place Ltd t/a The Lavery Registered in England & Wales, Company No. 11550940 Registered Office: 4–5 Cromwell Place, London SW7 2JE