1. Who we are

1.1 Good Fired Pizza Ltd, trading as Gracey's Pizza (Gracey's, we, us) runs pizzerias at 339 Watford Road, St Albans AL2 3DA and at Arcade, 103 New Oxford Street, London WC1A 1AB, and operates www.graceyspizza.com. We are the controller of the personal data described here.

1.2 Company number: 12996511 (registered in England and Wales). Registered office: c/o 146 Manor Way, Borehamwood, WD6 1QX. ICO registration number: [number, if registered].

1.3 For any privacy question or request, contact us at info@graceyspizza.com, by phone on 01727 858841, or by post to the address above.

2. What we collect and why

We collect personal data when you book a table, order from us, contact us, sign up for news, or visit our Website. We get it from you directly, from booking and delivery platforms you use to reach us, and from cookies (see our Cookies Policy).

• Name, phone, email, booking date, time and party size — To manage your table booking and contact you about it. (Lawful basis: Contract)

• Order details, collection or delivery address, order notes — To prepare and hand over your order. (Lawful basis: Contract)

• Allergy or dietary information you tell us — To prepare food safely for you. (Lawful basis: Explicit consent / vital interests)

• Payment details — To take payment (handled by our payment provider; we do not store full card numbers). (Lawful basis: Contract)

• Messages, reviews and complaints — To reply and resolve issues. (Lawful basis: Legitimate interests)

• Email address and marketing preferences — To send news and offers if you opt in. (Lawful basis: Consent)

• IP address, device and browsing data — To run, secure and improve the Website. (Lawful basis: Legitimate interests / consent for non-essential cookies)

• CCTV images in our restaurants [delete if none] — Safety and crime prevention. (Lawful basis: Legitimate interests)

• Information needed for legal, tax and accounting records — To meet our legal obligations. (Lawful basis: Legal obligation)

Allergy and health information is special category data. We use it only to serve you safely, share it only with the staff preparing your food, and do not keep it longer than needed.

3. Who we share it with

We never sell your personal data. We share it only with:

• Booking and ordering platforms such as OpenTable and Deliveroo, when you use them. They are controllers of the data you give them; see their own privacy policies.

• Service providers who help us run the business, such as our website host [name], payment provider [name], email marketing tool [name] and IT support. They act on our instructions only.

• Professional advisers such as accountants and lawyers.

• Authorities, such as the police or HMRC, where the law requires it.

• A buyer or successor if our business is sold or restructured.

4. International transfers

Some providers may store data outside the UK. Where they do, we make sure it is protected, for example through UK adequacy regulations or the ICO's International Data Transfer Agreement.

5. How long we keep it

• Booking details: [12 months] after your visit

• Order records: [12 months], then anonymised

• Allergy notes on a booking or order: Until the booking or order is complete

• Financial and tax records: 6 years (legal requirement)

• Complaints and correspondence: [2 years]

• Marketing list: Until you unsubscribe

• CCTV footage: [30 days] unless needed for an incident

6. Keeping your data safe

We use appropriate technical and organisational measures to protect your data, such as secure payment processing, access controls and password-protected systems. No method is completely secure, but we will tell you and the ICO about any serious breach where the law requires it.

7. Marketing

We will only send marketing emails or texts if you have agreed to receive them. You can unsubscribe at any time using the link in any email or by contacting us.

8. Children

Our Website and services are not aimed at children under 13, and we do not knowingly collect their data. Bookings and orders should be made by an adult.

9. Your rights

Under UK data protection law you have the right to:

• ask for a copy of your personal data;

• have inaccurate data corrected;

• have your data deleted in some circumstances;

• restrict or object to how we use it, including objecting to marketing at any time;

• receive your data in a portable format in some circumstances;

• withdraw consent at any time, where we rely on it.

To use any of these rights, contact us using the details in section 1. We will respond within one month and there is usually no charge.

10. Complaints

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

11. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.