Privacy Policy
Bône Hoxton
Last updated: 19/08/2026
1. Who we are
Bône Hoxton is a restaurant and bar operated by BONE SHOREDITCH LTD (company number 16288233), a company registered in England and Wales with its registered office at 10 Orsman Road, London N1 5QJ. Our venue address is 8-10 Orsman Road, London N1 5QJ.
In this policy, "we", "us" and "our" mean BONE SHOREDITCH LTD. We are the data controller for the personal data described below, which means we decide how and why it is used.
How to contact us about privacy: Email: reservation@boneshoreditch.co.uk Post: Data Protection, BONE SHOREDITCH LTD, 10 Orsman Road, London N1 5QJ
2. What this policy covers
This policy explains what personal data we collect when you book a table, visit or contact us, use our website, sign up to our mailing list, enquire about private hire, or apply to work with us. It also explains your legal rights and how to exercise them.
We are not required to appoint a Data Protection Officer, but the contact above is responsible for privacy matters
3. The personal data we collect
When you make or manage a booking This applies whether you book online through our website, by phone, by email or in person. We collect your name, telephone number, email address, party size, date and time, table preferences, notes you or our team add to your reservation (for example a birthday or a seating preference), booking history, no-shows and cancellations.
Dietary requirements and allergies If you tell us about an allergy, intolerance or dietary requirement, we record it so that our kitchen and floor team can serve you safely. Allergy information is treated as health data, which has extra protection in law. See section 5.
When you eat or drink with us Order details, spend, table and service records, and payment information. Card payments are processed by our payment provider. We receive confirmation of payment and limited card details such as the last four digits and card type. We do not store full card numbers.
CCTV We operate CCTV inside the venue and covering the exterior, for the safety of guests and staff, the prevention and detection of crime, and to help resolve incidents, accidents and disputes. Signage is displayed at the entrance and in recorded areas. Cameras are not installed in toilets, changing areas or any other private space. Footage is not routinely monitored, access is restricted to authorised managers, and it is retained for a limited period. See sections 10 and 16.
Marketing and mailing list Name, email address, telephone number where given, and your engagement with our emails such as opens and clicks.
Enquiries, private hire and events Your name, contact details, company or brand where relevant, the details of your enquiry, and any correspondence between us.
Feedback, reviews and complaints Anything you send us directly, and information you post publicly about us on review sites or social media where we respond.
Job applicants and staff CV, contact details, right to work documentation, references and interview notes. Recruitment and employment data is covered by a separate privacy notice given to applicants and staff.
When you use our website Cookies and similar technologies, IP address, browser and device information, and pages viewed. See section 7.
4. Why we use your data and our legal basis
What we use it forLegal basis under UK GDPRTaking, confirming and managing your bookingPerformance of a contract with you, or steps at your request before entering oneTaking payment and processing refundsPerformance of a contractRecording and acting on allergies and dietary requirementsExplicit consent for the health data element, plus our legal obligation on food safety and allergen informationContacting you about a booking, for example a change, delay or lost propertyPerformance of a contract, and our legitimate interests in running the venueKeeping financial, tax and accounting recordsLegal obligationSending marketing emails and offersConsent, or our legitimate interests where you are an existing customer and we rely on the "soft opt-in"Improving our menus, service and operations, including analysing booking and sales dataLegitimate interests in running and improving our businessResponding to enquiries, private hire requests and supplier contactLegitimate interests, or steps before entering a contractCCTV for safety, crime prevention and incident investigationLegitimate interests in protecting guests, staff and propertyHandling complaints, insurance claims and legal disputesLegitimate interests in defending our position, and legal obligation where an authority is involvedComplying with licensing, environmental health, food safety and health and safety dutiesLegal obligationRecruitmentSteps before entering a contract, and legitimate interests
Where we rely on legitimate interests, we have considered whether our interests are outweighed by your rights. You can ask us for details of that assessment, and you have the right to object. See section 11.
Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect anything we did before you withdrew it.
5. Allergies, dietary requirements and other health information
Information about allergies, intolerances and medical dietary needs is "special category" data under Article 9 of the UK GDPR. We collect it only where you choose to give it to us, and we use it solely to prepare and serve your food and drink safely and to train and brief our team.
By telling us about an allergy or dietary requirement when booking or ordering, you consent to us recording it and sharing it internally with the kitchen and service team who need it. You can ask us to delete it at any time, though we may then be unable to accommodate the requirement on future visits.
6. Marketing
We will only send you marketing emails or messages where you have opted in, or where you have previously booked or dined with us, we are marketing similar goods and services, and you were given the chance to opt out.
Every marketing email includes an unsubscribe link. You can also email us at reservation@boneshoreditch.co.uk at any time and we will remove you promptly. We keep a suppression record of unsubscribes so that we do not contact you again by mistake.
We do not sell your personal data, and we do not share it with third parties for their own marketing.
7. Cookies
Our website uses cookies and similar technologies. Strictly necessary cookies, which make the site work, do not require your consent. All other cookies, including analytics, advertising and embedded content such as maps, social feeds or booking widgets, are only set where you consent through our cookie banner.
You can change or withdraw your cookie preferences at any time via emailing us at reservation@boneshoreditch.co.uk, and you can block or delete cookies through your browser settings, though parts of the site may then not work properly.
8. Who we share your data with
We share personal data only where necessary, with:
Our booking and till provider, Tebi, which hosts our reservation and sales records
Our payment provider, which processes card transactions
Email marketing and CRM providers we use to send mailings
Our website host and analytics providers
IT, security and CCTV suppliers who support our systems
Professional advisers such as accountants, insurers and lawyers, where needed
Delivery, ticketing or third party booking platforms where you have booked through them
Regulators and authorities, including the police, environmental health, licensing authorities, HMRC and the ICO, where we are required to disclose or where it is necessary to protect people or investigate an incident
A buyer or successor, if we sell or restructure the business
All suppliers acting on our behalf are bound by written contracts requiring them to keep your data secure and to use it only on our instructions.
9. International transfers
Some of our suppliers process data outside the UK. Where that happens, we make sure the transfer is protected by one of the safeguards allowed under UK data protection law, such as an adequacy decision covering the destination country, or the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguards that apply.
10. How long we keep your data
Type of dataRetentionBooking and dining records[24] months from your last visitAllergy and dietary notes attached to a bookingKept with the booking record, or deleted sooner on requestPayment and transaction records6 years from the end of the relevant financial year (tax and accounting requirements)Marketing contact detailsUntil you unsubscribe, and then a minimal suppression record indefinitelyCCTV footage[30] days, unless retained longer for a specific incident, complaint, claim or investigationEnquiries and correspondence[24] months from the last contactComplaints and incident recordsUp to 6 years, reflecting the limitation period for legal claimsUnsuccessful job applications[6] months from the outcomeEmployee records6 years after employment ends
Where we no longer need your data, we delete it securely or anonymise it so it can no longer identify you.
11. Your rights
Under the UK GDPR you have the right to:
Be informed about how we use your data, which is the purpose of this policy
Access a copy of the personal data we hold about you
Rectification of inaccurate or incomplete data
Erasure of your data in certain circumstances, sometimes called the right to be forgotten
Restrict processing in certain circumstances
Data portability, meaning a copy of data you gave us in a commonly used machine readable format, where processing is based on consent or a contract and is automated
Object to processing based on our legitimate interests, and to object to direct marketing at any time, which is an absolute right
Withdraw consent at any time where we rely on it
Not be subject to solely automated decisions producing legal or similarly significant effects. We do not carry out this kind of automated decision making or profiling.
To exercise any right, email reservation@boneshoreditch.co.uk or write to us at the address in section 1. We will respond within one month. That period can be extended by two further months for complex requests, and we will tell you if that applies. There is normally no charge.
We may ask you for information to confirm your identity before we act on a request.
12. Complaints
If you are unhappy with how we have handled your personal data, please contact us first so we can try to put it right. You also have the right to complain to the ICO at any time:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline: 0303 123 1113 Website: ico.org.uk
13. Security
We use appropriate technical and organisational measures to protect your data, including access controls on our booking and till systems, restricted staff access on a need to know basis, staff training, and contractual protections with our suppliers. No system is completely secure, but we take reasonable steps to protect your information and we will notify you and the ICO where the law requires it following a personal data breach.
14. Children
Our venue and website are aimed at adults. We do not knowingly collect data about children except where a booking is made by a parent or guardian on their behalf, or where a child's dietary requirement is given to us for safety reasons. If you believe we hold a child's data without a proper basis, please contact us and we will delete it.
15. CCTV in more detail
Images of identifiable people are personal data, so our CCTV is operated in line with data protection law and the ICO's guidance on video surveillance.
Why: protecting the safety of guests and staff, deterring and investigating crime, and dealing with incidents, accidents, insurance claims and licensing matters.
Legal basis: our legitimate interests in protecting people and property, and compliance with our licensing and health and safety obligations.
Coverage: public areas of the venue and the exterior. Cameras are positioned to capture only what is necessary and are not placed in private areas.
Access: limited to authorised managers. Footage is disclosed outside the business only to the police or another authority with a proper request, to our insurers or legal advisers, or where we are otherwise required by law.
Retention: [30] days on a rolling automatic overwrite, unless a specific clip is preserved for an incident, complaint, claim or investigation.
Your rights: you can request footage of yourself. Please contact us as soon as possible, since footage is overwritten, and tell us the date, approximate time and where you were, along with a description or photo so we can locate you. We will redact or obscure other people who appear.
16. Changes to this policy
We may update this policy from time to time. The current version will always be available on our website privacy & Policy section and the date at the top shows when it was last changed. Where changes are significant, we will bring them to your attention.
Bône Hoxton is a trading name of BONE SHOREDITCH LTD, registered in England and Wales, company number 16288233.