Privacy notice

Good Table Co. uses your personal information to handle enquiries, booking requests and customer accounts. This notice explains how information is used through this website. Last updated: 2 November 2026.

Contact us about your information

For privacy questions or to exercise your rights, email info@goodtableco.co.uk. Please give enough information for us to identify the relevant booking or account. We may need to verify your identity before disclosing or changing personal information.

Information you provide

A booking request includes your name, email, contact details, organisation where supplied, service, preferred date and time, guest numbers, location and requirements. We also keep booking decisions, amendments and messages so that we can manage your request and communicate with you.

If you use My bookings, we keep the information needed to verify your email and manage your sign-in. If you choose a password, we store a password hash. We also keep invoices, recorded payments and the history of changes to your booking or invoice.

For workplace lunch pre-orders, we use your name, email, company, business delivery address, contact number, delivery instructions and chosen food to process and prepare your order. Payment details are handled by Square through its hosted checkout; we receive payment status and transaction information. The business receives your order details so it can prepare and deliver your lunch.

For approved orders, we also record the agreed food and quantities, preparation and delivery progress, ready-by times, assigned team members and internal kitchen or delivery instructions. Customers can see their own delivery stage and agreed food list in My bookings; internal team notes and assignments stay restricted to authorised administrators.

Administrator account protection

Administrator password recovery uses a short-lived email code with limited attempts. If an administrator enables two-factor authentication, the authenticator setup secret is held in encrypted application storage and recovery codes are stored as keyed hashes. Security changes are recorded through service notifications and revoke older administrator sessions. Password recovery does not disable two-factor authentication.

Dietary requirements

Please describe dietary requirements for the group without naming individual guests or including medical histories. If a particular requirement needs a private discussion, contact us before sharing sensitive information through a booking note. A menu image does not establish ingredients or allergen suitability; agree those requirements with the team.

Why we use this information

We use booking and contact information to respond to your request, discuss the service you want, administer an agreed booking and issue invoices. Where you are arranging a service for yourself, this is necessary to take steps at your request before a contract and to perform an agreed contract.

For business contacts arranging a service for an organisation, our legitimate interests are responding to enquiries and managing that business relationship. We also have legitimate interests in protecting accounts, preventing misuse and keeping an accurate history of changes. We use financial records where necessary to meet legal accounting and tax obligations. We do not use booking information for advertising through this website.

Information collected when you visit

Our hosting services process technical information such as your IP address and request details to deliver and protect the website. Sign-in attempts and security events may be recorded to prevent misuse. The site uses essential session cookies for sign-in and form security. It does not currently use advertising or analytics cookies. Read our cookie notice for details.

Anonymous website counts

We count successful views of a small set of public pages on our server to understand which content is useful. We store only daily page totals and broad referral categories. This measurement does not set cookies, use local storage, identify visitors or store IP addresses, user agents, full referrer URLs or query strings. Counts are retained for 400 days. Signed-in visitors and recognised bots are excluded, and we honour Do Not Track and Global Privacy Control signals.

Our hosting and security logs are separate from these anonymous counts and remain necessary to deliver and protect the service.

Who can access information

Authorised team members can access information needed to manage bookings and accounts. Our website hosting and technical support providers process information to operate and maintain the service. Microsoft 365 processes service emails, including booking receipts, sign-in codes and notifications. We may disclose information where required by law or necessary to establish or defend a legal claim.

Emails contain booking or account information needed for their purpose. Private invoices and account details are accessed through My bookings. When online payments are available, Square processes card details on its hosted checkout page. We use transaction identifiers, payment status, amounts and refund information to reconcile lunch orders and invoices. Order and contact details are shared as needed to create and manage the checkout. We do not store full card details. We do not sell your personal information.

How long information is kept

The booking area retains booking history, messages and invoices so that you and the team can refer to earlier requests. Retention depends on whether a request proceeds, the continuing customer relationship, relevant accounting obligations and any unresolved query or dispute. Protective backup copies are kept separately. Contact us to ask about the information retained for your account or to request deletion; some records may need to be retained for legal reasons.

Keeping information safe

The website uses HTTPS. Booking and account records are encrypted in application storage, and private invoice files are encrypted. Access to customer bookings and invoices requires authentication and ownership checks. Passwords are hashed rather than stored in readable form. Access is restricted to the people and services that need it.

Your rights

Depending on the circumstances, you can request access to your information, correction, deletion, restriction of use or a portable copy. You can also object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful use. Some rights have exceptions, particularly where records must be kept to meet legal obligations.

Contact info@goodtableco.co.uk to make a request or raise a concern. You can also complain to the UK Information Commissioner’s Office through ico.org.uk.

Changes to this notice

We will update this notice when website services or information handling change. The date above identifies the current version.