Privacy Policy

1. Who we are

The data controller is SOBHA BAR AND GRILL LTD, a limited company registered in England and Wales (company number 17073202). We trade as SoBha from 179 Archway Road, London, England, N6 5BN.

For privacy questions, email hello@sobharestaurant.co.uk or write to us at the registered office. You can also call 020 3468 9777.

We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Personal data we collect

We only collect what we need to run the restaurant and this website.

Information you give us

• Table bookings: first name, last name, email address, phone number, date, time, party size, occasion, seating preference and any special requests (including allergen or accessibility notes).
• Messages: if you email, call or WhatsApp us, we keep the contact details and the content of that conversation so we can reply.
• Account holders: restaurant staff who sign in to the booking desk have a name, email address and password. Guest diners do not create accounts on this website.

Information collected automatically

• A session cookie and a security token so the website can hold a booking form and protect it from abuse.
• The date, time and status of your booking, plus a booking reference we generate.
• Technical logs that our hosting provider may keep (such as IP address and browser type) to keep the site secure.

We do not sell your data. We do not run advertising networks or marketing pixels on this website.

3. How we use your data

UK law requires a legal basis for each use of personal data. We rely on the following.

• Contract (UK GDPR Article 6(1)(b)): to take, confirm, change or cancel a table booking and to email you about that booking.
• Legitimate interests (Article 6(1)(f)): to run the restaurant, prevent no-shows and abuse of the booking form, keep the website secure, and defend legal claims. We have balanced those interests against your privacy rights.
• Legal obligation (Article 6(1)(c)): to keep records we must keep (for example food-safety notes you give us about allergens, and accounting records where they apply).

Booking emails are transactional. We do not add you to a marketing list. If we ever wanted to send promotional emails, we would ask for consent first and give you a way to opt out.

4. Who we share data with

We share personal data only where it is necessary:

• Restaurant managers who operate the booking desk, so they can confirm your table.
• Our email provider, so confirmation and desk-alert messages can be sent.
• Our website hosting provider, who stores the booking records on our behalf.
• Professional advisers or authorities if the law requires it, or to protect guests, staff or the business.

If you order food through Just Eat, Uber Eats or Deliveroo, those companies are separate controllers. Their privacy notices apply to those orders. If you open WhatsApp, Facebook, Instagram or Google Maps from our site, those services process data under their own terms.

5. Cookies

This website uses a small number of cookies. Under the Privacy and Electronic Communications Regulations (PECR), cookies that are strictly necessary to provide a service you request do not need consent.

• Session cookie: keeps you logged in to the staff desk and remembers a booking you have just submitted.
• CSRF / XSRF token: stops a third-party site from submitting forms in your name.

Our Contact and Home pages include an embedded Google Map so you can find 179 Archway Road. Google may set its own cookies when that map loads. Those cookies are not strictly necessary. You can avoid them by using the address link to open Google Maps yourself instead of loading the embed.

We do not use Google Analytics, advertising cookies or social-media tracking pixels on this site.

6. How long we keep data

• Booking records: normally 24 months after the reservation date, then deleted or anonymised, unless we must keep them longer (for example a complaint, incident or legal claim).
• Emails and WhatsApp messages: for as long as needed to finish the conversation and for a reasonable period afterwards (usually up to 24 months).
• Staff accounts: for as long as the person works with us, then removed.
• Security logs: for a short period set by our host, typically no more than 12 months.

7. International transfers

We aim to keep personal data in the United Kingdom. Some suppliers (email, hosting or maps) may process data in the European Economic Area or another country. Where that happens, we rely on an adequacy regulation or on standard contractual clauses approved for UK transfers.

8. Your rights

Under UK GDPR you can ask us to:

• access the personal data we hold about you;
• correct inaccurate data;
• erase data in certain cases;
• restrict or object to processing that relies on legitimate interests;
• receive a copy of data you provided, in a portable format; and
• withdraw consent, if we ever rely on consent (this does not affect processing already carried out).

To use these rights, email hello@sobharestaurant.co.uk. We may need to confirm your identity. We will respond within one month, or explain if the law allows more time.

There is no automated decision-making or profiling on this website that produces legal or similarly significant effects.

9. Children

Our kids’ menu is for children dining with adults. This website and the booking form are intended for people aged 18 or over. We do not knowingly collect personal data from children through the website. If you believe we have, please contact us and we will delete it.

10. Complaints and contact

Please contact us first so we can try to put things right: hello@sobharestaurant.co.uk, 179 Archway Road, London, England, N6 5BN.

You also have the right to complain to the UK Information Commissioner’s Office (ICO), the supervisory authority for data protection: ico.org.uk/make-a-complaint, or by telephone on 0303 123 1113.

11. Changes to this notice

We will update this page if our practices or the law change. The date at the top is the latest version. Continued use of the website after a change means you should read the updated notice.

Related: Terms of Service.