UK GDPR-compliant privacy notice for guests and customers, covering bookings, orders, CCTV, guest Wi-Fi, and loyalty programmes — required under Articles 13/14 UK GDPR and the Data Protection Act 2018 for essentially any business processing personal data.
⚠️ This is a blank template, not legal advice: check the wording with a lawyer and adapt it to your jurisdiction and your case.
Required fields not filled: 9. The PDF will have blank lines in their place to fill in by hand.
Click a field label in the text and type, or use the form. Empty fields become blank lines in the PDF.
CUSTOMER PRIVACY NOTICE
() Effective date:
This notice explains how (the "Company", the data controller) collects, uses, and protects your personal data, in accordance with the UK GDPR and the Data Protection Act 2018.
1. DATA CONTROLLER 1.1. is the data controller. Our ICO registration number is .
2. WHAT DATA WE COLLECT AND WHY 2.1. CCTV: the premises are monitored by CCTV to prevent and detect crime and to protect the safety of staff and customers, on the basis of our legitimate interests. Signs are displayed at the entrance and in monitored areas. Footage is kept only as long as needed for that purpose (normally no more than 31 days) and is disclosed to the police or other authorities only where we are lawfully required or permitted to do so. Cookies: our website uses cookies and similar technologies. Cookies that are strictly necessary for the site to work are set automatically; analytics and advertising cookies are set only with your consent, which you may change or withdraw at any time through the cookie settings, in line with PECR.
3. LEGAL BASIS FOR PROCESSING 3.1.
4. SHARING AND INTERNATIONAL TRANSFERS 4.1.
5. RETENTION 5.1.
6. YOUR RIGHTS 6.1. 6.2. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data has been mishandled. 6.3. Direct marketing: we send marketing messages only where you have consented or, for existing customers, on the "soft opt-in" basis permitted by PECR for our own similar goods and services. Every message includes a simple way to unsubscribe, and you may object to direct marketing at any time at no cost.
7. CONTACT US 7.1. Questions about this notice, or requests to exercise your rights, may be sent to .
⚠️ Almost every business processing personal data must pay the ICO's annual data protection fee (currently £52/year for most small businesses); non-payment can lead to a fine. CCTV is a near-automatic trigger for this obligation.
This is a boilerplate template, not legal advice. Employment, consumer-protection, food safety, and health & safety law in the United Kingdom differs between England, Wales, Scotland, and Northern Ireland, and is changing significantly through 2026–2027 under the Employment Rights Act 2025 — have this document reviewed and adapted by a solicitor (and, for disciplinary/grievance matters, checked against the current Acas Code of Practice at acas.org.uk) before use.
Documents that are usually drawn up in the same process.
Refund/returns policy for goods sold in-store and at a distance, plus the model cancellation form required for distance/online sales under the Consumer Contracts Regulations 2013 — failing to provide…
Menu-wide allergen information matrix covering the 14 legally recognised allergens — required under the Food Information Regulations 2014 / retained EU Food Information for Consumers Regulation 1169/…
General workplace risk assessment covering hazards, persons at risk, existing and further control measures — a written record is required at 5 or more employees under the Management of Health and Saf…
2 of 10 fields are taken from the company, employee or counterparty record, the questionnaire can be dictated to the AI, and the finished document comes with a number, a PDF and an acknowledgement record.