Skip to content

Privacy Policy

Last updated: April 2026

1. Who We Are

Saffron Restaurant ("we", "our", "us") is the data controller for the personal information we collect. We are located at 12 The Shambles, York, YO1 7LZ. If you have any questions about how we handle your data, please contact us at privacy@saffron-york.co.uk.

2. Data We Collect

We collect the following personal information:

  • Booking Information: name, email, phone number, date, time, party size, and any special requests or occasion details.
  • Dietary & Allergen Information: dietary preferences, food allergies, and intolerances you provide to ensure your safety.
  • Account Information: name, email address, and encrypted password when you create an account.
  • Payment Information: payments are processed securely by Stripe. We do not store your card details. Stripe's privacy policy applies to payment data.
  • Contact Enquiries: name, email, phone, and message content when you contact us.
  • Marketing Preferences: your opt-in status for marketing communications.

3. How We Use Your Data

  • To process and manage your table bookings and private dining enquiries
  • To accommodate your dietary requirements and allergen needs
  • To process payments for orders, vouchers, and events
  • To send booking confirmations and reminders
  • To respond to your enquiries and provide customer service
  • To send marketing communications (only with your consent)
  • To improve our services and website experience

4. Cookies

We use the following cookies:

  • Essential cookies: required for the website to function, including session management and authentication (rk_token, rk_tenantId).
  • Analytics cookies: to understand how visitors use our site, helping us improve the experience. These are anonymised.

You can control cookies through your browser settings. Disabling essential cookies may affect website functionality.

5. Third Parties

We share your data only with the following third parties, and only as necessary:

  • Stripe: payment processing. Subject to Stripe's Privacy Policy.
  • Email service providers: for sending booking confirmations and marketing emails.

We do not sell your personal data to third parties.

6. Data Retention

  • Booking data: retained for 3 years after your last booking for legal and service purposes.
  • Account data: retained until you delete your account or request deletion.
  • Payment records: retained for 7 years as required by UK tax law.
  • Marketing preferences: retained until you withdraw consent.
  • Enquiries: retained for 12 months after resolution.

7. Your Rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you
  • Rectify inaccurate or incomplete data
  • Erase your data ("right to be forgotten")
  • Restrict the processing of your data
  • Data portability — receive your data in a machine-readable format
  • Object to processing, including direct marketing
  • Withdraw consent at any time for marketing communications

To exercise any of these rights, email us at privacy@saffron-york.co.uk. We will respond within 30 days.

8. Legal Basis

  • Contract: processing bookings and orders you have requested
  • Legitimate interest: improving our services, customer support
  • Consent: marketing communications
  • Legal obligation: financial record-keeping

9. Contact & Complaints

If you have concerns about how we handle your data, please contact us first at privacy@saffron-york.co.uk.

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO):

  • Website: ico.org.uk
  • Helpline: 0303 123 1113
  • Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF