Privacy Policy

Who we are

Enchanted Bar & Desserts Ltd (trading as Enchant Bar, “we”, “us”, “our”) is the data controller for the personal information described in this notice. We operate enchantbars.uk and our venue at the address below, and we are registered in England & Wales.

• Postal address: First Floor, Contract House, Stafford Street, Stone, ST15 8QW
• Privacy contact: bookings@enchantbars.uk
• We handle privacy requests in-house; we have not appointed a statutory Data Protection Officer as we are not required to.

Information we collect

We only collect what we need to run bookings, serve you safely and improve our experiences.

• Booking details — name, email address, phone number, party size, date and time, table preference, occasion notes and your booking reference.
• Dietary, allergen and accessibility information you choose to share so we can serve you safely. Health-related details are special category data and we only use them for your visit.
• Pre-order and menu choices, including drinks packages ordered at the table via our tablets.
• Payment information — deposits, card authorisation holds, voucher purchases and refunds are handled by our payment provider. We receive confirmation, the last four digits and a transaction reference; we never see or store your full card number.
• Gift voucher details — purchaser and recipient names, delivery email, message and redemption status.
• Messages and enquiries you send through our contact form, email, phone or social media, and our replies.
• Messages you send to Merlin, our AI booking assistant, so he can suggest experiences and answer questions about visiting.
• Marketing preferences if you join the Circle, plus whether emails were delivered, opened or clicked.
• Reviews, feedback and any photos or tags you share with us publicly.
• Technical data — IP address, device and browser type, pages visited and interactions, collected through essential cookies and analytics.
• CCTV footage recorded in and around the venue for safety, crime prevention and dispute resolution.
• Staff and admin account data for team members who log into our admin panel.

Why we use it and our lawful basis

Under UK GDPR we must have a lawful basis for each use. Ours are:

• Contract — taking and managing your booking, handling deposits and card holds, processing pre-orders, issuing and redeeming vouchers, and contacting you about your reservation.
• Legal obligation — food safety and allergen records, health & safety, accounting and tax records, licensing obligations and responding to lawful requests.
• Legitimate interests — running and improving our venue and website, preventing fraud, no-shows and abuse of our booking system, securing our systems, keeping CCTV, handling complaints and defending legal claims. We balance these against your rights.
• Consent — marketing emails, non-essential cookies and analytics, and any special category (allergy/health) information you give us. You can withdraw consent at any time.
• Vital interests — acting on allergen or medical information in an emergency.

Marketing

We only send marketing emails where you have opted in, or where you have booked with us and we are contacting you about similar experiences (the “soft opt-in”). Every email includes a one-click unsubscribe, and you can also email us to be removed. We do not sell, rent or trade your data to third parties for their own marketing.

Cookies and analytics

Our site uses essential cookies and local storage to keep your booking session, signed-in state and preferences working. With your consent we also use analytics to understand how the site is used so we can improve it. You can clear or block cookies in your browser, but essential ones are required for booking to work.

Who we share it with

We share the minimum necessary with service providers who act on our instructions under contract:

• Our reservation and ordering platform, which stores bookings, pre-orders, enquiries and voucher records.
• Payment processors, who handle deposits, card authorisation holds and voucher payments.
• Email and messaging providers used to send booking confirmations, reminders and newsletters.
• Our AI assistant provider (Lovable AI Gateway, powered by Google AI) to generate replies from the messages you send to Merlin. We do not keep a permanent log of your chat messages.
• Hosting, database, storage and security providers that run this website and our backend.
• Professional advisers such as accountants, insurers and solicitors where needed.
• Police, regulators or other authorities where we are legally required, or to protect people from harm.

If our business is ever sold or restructured, your data may transfer to the new owner under the same protections.

International transfers

Some of our providers process data outside the UK. Where that happens we rely on UK adequacy regulations or the International Data Transfer Agreement/Addendum with appropriate safeguards, so your data keeps an equivalent level of protection.

How long we keep it

• Booking, pre-order and allergen records: up to 3 years after your visit for safety, complaints and claims.
• Payment and voucher transaction records: 7 years to satisfy accounting and tax law.
• Gift vouchers: for the life of the voucher plus 6 years.
• Contact enquiries and correspondence: 2 years after the matter is closed.
• Marketing subscribers: until you unsubscribe, plus a suppression record so we don't email you again.
• CCTV: normally 30 days, unless retained for an incident or investigation.
• Analytics and technical logs: up to 26 months.

When a retention period ends we securely delete or anonymise the data.

How we keep it safe

Access to booking and customer data is restricted to authorised staff accounts with individual logins and role-based permissions. Data is encrypted in transit, stored on access-controlled infrastructure with row-level security, and card details never touch our servers. We review access regularly and have a process for investigating and, where required, reporting personal data breaches to the ICO within 72 hours.

Your rights

Under UK data protection law you have the right to:

• Be informed about how we use your data (this notice).
• Access a copy of the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased where there is no ongoing legal or contractual reason to keep it.
• Restrict or object to processing, including objecting to direct marketing at any time.
• Data portability for information you gave us electronically.
• Withdraw consent at any time, without affecting processing already carried out.
• Not be subject to solely automated decision-making with legal or similarly significant effects — we don't do this.

Email bookings@enchantbars.uk to exercise any right. We may ask you to confirm your identity, and we respond within one month.

Children

Families are welcome at selected experiences, but our website and bookings are intended to be used by adults aged 18 or over. We only hold children's details where a parent or guardian provides them as part of a booking (for example a name or dietary need), and we do not market to children.

Other websites

Our site links to third-party platforms for ordering, loyalty and payments, and to our social media pages. Those services have their own privacy policies and we are not responsible for their content or practices.

Complaints

If you're unhappy with how we've handled your data, please contact us first at bookings@enchantbars.uk so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

Changes to this policy

We review this notice regularly and will update this page when our practices change. This version was last updated on 26 August 2026.