Privacy Policy

Who we are and how to contact us

ThaiSeat operates the restaurant reservation service at thaiseat.co.uk, including booking pages, embedded booking forms and staff workspaces. Our privacy contact is admin@thaiseat.co.uk.

The restaurant you book with decides how to manage its reservations and your visit. ThaiSeat processes booking information to provide the service for that restaurant. ThaiSeat is also responsible for its own platform administration, security and support activities. We help route privacy requests to the restaurant where it is responsible for the information.

Information we keep

• Contact details: your first name, surname, email address and telephone number.
• Reservation details: restaurant, booking reference, date, arrival time, guest count, estimated dining duration, booking status and any general special requests.
• Booking records: creation and change times, the booking source (website, embedded form, telephone, walk-in or staff entry), status history and operational staff notes.
• Preferences: your separate marketing choice and, for online bookings, when you acknowledged the policy and which version you saw.
• Messages: booking emails and delivery records, and correspondence when you ask for help.
• Restaurant trial sign-ups: contact name, restaurant name, email, phone, address and postcode, plus verification and privacy acknowledgement records. We use these to verify the email address and set up the restaurant trial. Unverified requests expire after 48 hours and are removed by scheduled maintenance. Verification email records are removed by maintenance after seven days. Activated account and restaurant details are retained for ongoing service and account administration.
• Staff accounts: names, work email addresses, restaurant roles, password hashes, invitations, sign-in records and administrative activity. Guests do not need an account.
• Technical records: security information used to prevent abuse, including hashed network-address identifiers for rate limiting. Hosting logs may contain IP addresses, browser information, requested pages and access times.

This booking service does not request card details, payments, identity documents or dates of birth. If someone books for you, we receive the details they or the restaurant provide.

How we use your information and our lawful bases

Booking information is used to check availability, create and manage reservations, prepare for your visit, send booking updates and answer your questions. The legitimate interests behind these operational uses are handling your requested reservation, preparing for your visit and keeping you informed. The restaurant determines and documents the lawful basis for its reservation processing; ThaiSeat handles booking information on its instructions.

For ThaiSeat’s own activities, we rely on legitimate interests in maintaining a secure, reliable service: managing staff access, preventing spam and misuse, investigating faults and providing support. Legal obligations apply where information must be provided or retained by law; legitimate interests may also apply to resolving disputes or legal claims.

Restaurant marketing requires your separate opt-in consent. You can decline marketing and still book. We do not sell booking information, share it with other restaurants for marketing or build advertising profiles from your reservations.

Your name, email, telephone number, booking date, time and guest count are needed to complete an online reservation. If you prefer another way to book, contact the restaurant.

Allergies, health information and general requests

The Special requests box is optional and is for general requests such as seating preferences or a celebration. Please do not enter medical information, allergy details or other sensitive personal information in this form. Contact the restaurant directly about allergies, health-related access needs or other sensitive requirements, so it can explain how it will handle them and confirm what it can accommodate.

When booking for others, share only the information needed and make them aware of this policy. If sensitive information is entered accidentally, contact the restaurant or our privacy contact so it can be reviewed and removed where appropriate.

Who can access your information

Your reservation goes to the restaurant you select. Authorised staff have access according to their roles: Admins manage reservations and settings; Viewers have limited read-only access. Other restaurants cannot access your booking through their workspaces. Authorised ThaiSeat administrators may access records to support and administer the platform.

Hosting and email providers, including IONOS, process information needed to run the service and deliver messages. Booking details and general requests can appear in emails to you and the restaurant, and in email delivery records. Internal staff notes are not included in customer booking emails. Restaurant Admins can export their restaurant’s records; the restaurant is responsible for its own exported copies.

Information may be shared with professional advisers or public authorities where necessary for a legitimate legal purpose or required by law.

Where information is processed

The service uses IONOS for hosting and email. We are confirming the processing locations for the selected hosting and mailbox account. Contact admin@thaiseat.co.uk for current provider and location information.

Transfers outside the UK must meet applicable data protection requirements, through a recognised adequacy arrangement or another appropriate safeguard where required. You can ask us which safeguards apply to your information.

How long we keep information

Each restaurant sets its guest booking retention period. The restaurant-specific policy linked from its booking form shows the configured number of days after the booked visit.

After that period, once a reservation is closed, the retention process removes or de-identifies guest contact details and free-text requests and notes, and removes older email records in the application. Unresolved reservations may remain until the restaurant has dealt with them. Basic reservation records and counts may remain after identifying guest details have been removed.

Staff accounts and administrative security records are managed separately according to ongoing access needs, investigations and legal requirements. Temporary anti-abuse records expire after their security window and are removed by maintenance. Copies in restaurant exports, email inboxes or backups have separate retention arrangements; removal from the booking application does not instantly remove every copy from those systems.

Information needed for a specific legal obligation or active dispute may be kept for that purpose. Contact us to ask about the retention or deletion of a particular record.

Cookies, security and availability decisions

The application uses essential session cookies for staff sign-in and security. Its booking form does not include advertising trackers or third-party analytics scripts. Fonts are served by the application. A restaurant website that embeds the form may use its own cookies and has its own privacy policy.

Security measures include password hashing, staff permissions, checks that separate restaurant data, protected application configuration and security logs. Production connections are intended to use HTTPS and encrypted email transport. No online service can guarantee that information will never be lost or accessed improperly.

Available times and instant confirmation depend on the restaurant’s hours, seat capacity and reservation rules. These checks do not involve advertising profiling. Contact the restaurant if a time is unavailable or your request needs review.

Your choices and rights

Depending on the circumstances, you can ask to access or correct your information, request deletion, restrict its use or receive certain information in a portable format. You can object to processing based on legitimate interests and object to direct marketing at any time. Rights may be subject to legal conditions or exceptions.

You can withdraw marketing consent without cancelling a booking. Use an unsubscribe option in a marketing message, contact the restaurant or email admin@thaiseat.co.uk. Withdrawal does not affect earlier lawful processing. Essential booking updates are separate from marketing.

For privacy requests, email admin@thaiseat.co.uk with the restaurant name, your booking reference if available and what you would like us to do. We may request proportionate information to verify your identity. We respond within the applicable legal time limit, usually one calendar month, and explain if an extension or exception applies.

Questions, complaints and changes

Contact admin@thaiseat.co.uk with questions or concerns. You can also complain to the UK Information Commissioner’s Office: ico.org.uk/make-a-complaint.

We may update this policy as the service or its data handling changes. Its version and update date appear above. Restaurant-specific information below supplements this policy.