Privacy Policy

1. Who We Are

Seatly Software Ltd (“Seatly”, “we”, “us”) provides a white-label restaurant booking platform for independent restaurants in the United Kingdom.

Roles under UK GDPR:

• Seatly Software Ltd acts as a data processor — we operate and maintain the booking software on behalf of restaurants.
• The restaurant you are booking with acts as the data controller — they determine why your data is collected and how it is used.

When you make a booking through a Seatly-powered widget, you are providing your personal data to the restaurant, which Seatly processes on their behalf.

Contact: Seatly Software Ltd Email: privacy@seatly.uk

For our own marketing website at seatly.uk and the enquiries we receive through it, Seatly Software Ltd acts as the data controller — see section 9. Seatly is also the data controller for the personal data of the people at the restaurants we bill for the platform — see section 10.

2. What Data We Collect

The following personal data may be collected when you make a booking:

Special requirements may include information such as dietary requirements, accessibility needs, or allergy information that you choose to provide in connection with your booking. Depending on what you enter, this may include sensitive personal data (such as health or religious dietary information). This information is collected so the restaurant can prepare for and manage your booking appropriately. The restaurant you are booking with is responsible for determining the lawful basis and, where applicable, any additional condition required under Article 9 UK GDPR for collecting and using this information.

If you join a restaurant’s walk-in queue in person or by scanning its QR code, your name and phone number are collected to manage the queue and, where you provide a number, to text you when your table is ready.

We do not store payment card details. If you pay a deposit or pre-payment, payment is taken on Stripe’s secure checkout page and settled to the restaurant’s own Stripe account — your card details are held by Stripe, never by Seatly. Seatly keeps the payment status, amount, and Stripe payment reference linked to your booking.

3. How We Use Your Data

SMS reminders

Restaurants using Seatly may send you a one-off SMS reminder the day before your booking. This is a service message under the UK Privacy and Electronic Communications Regulations 2003 (“PECR”): your phone number is used only for reminders about a booking you have made, not for marketing.

Because a booking reminder is a service message rather than marketing, the consent rules in Regulation 22 of PECR — which govern unsolicited direct marketing — do not apply to it. We hold reminder messages to the following limits regardless:

• Your phone number is collected in the course of a booking you made directly with the restaurant
• The message relates only to that booking (party size, restaurant name, booking time)
• You can opt out on every message by tapping the unsubscribe link included in the message

If a restaurant wanted to send you genuine marketing by text, that would require its own lawful basis under Regulation 22. The Seatly platform does not send marketing texts.

You can stop receiving SMS reminders from a specific restaurant at any time by tapping the unsubscribe link in any reminder and confirming on the page that opens. This stops reminders from that restaurant only — bookings with other restaurants on Seatly are unaffected. Opt-out records are kept per restaurant and survive any later request to erase your personal data, so you will not start receiving SMS again if you later make another booking with the same restaurant.

To stop all SMS reminders, ask the restaurant to remove your phone number from your customer profile, or use your right of erasure (see below).

If you join a restaurant’s walk-in queue and provide your phone number, the restaurant may also send you a one-off text to tell you your table is ready. This is a single service message you asked for when joining the queue — it isn’t marketing and carries no unsubscribe link. The number is used to run the queue and, if you’ve visited the restaurant before, to link your visit to your existing guest record.

Your data is NOT used for:

• Marketing or promotional communications
• Profiling or automated decision-making
• Selling or licensing to third parties
• Advertising networks or data brokers

4. Who We Share Your Data With

We never share your data with:

• Other restaurants on the Seatly platform
• Advertising networks
• Data brokers or analytics companies (the aggregate, cookieless statistics for our own marketing website — see section 9 — involve no booking data)
• Any party not listed above

A full list of our sub-processors, including addresses, data locations, and transfer mechanisms, is published on our Sub-Processor List.

5. Where Your Data Is Stored

Where this policy says SCCs, it means the EU Standard Contractual Clauses used with the ICO’s International Data Transfer Addendum to the EU SCCs (the UK Addendum); both the UK Addendum and the UK International Data Transfer Agreement (UK IDTA) are clauses issued by the Information Commissioner under section 119A of the Data Protection Act 2018, and so are safeguards under Article 46(2)(d) UK GDPR.

Your booking record is held in our main database in the United Kingdom, on servers provided by Supabase Inc. in the AWS London region (eu-west-2). Some of your data is also processed outside the UK by the services below, which run the booking functions, deliver emails, text messages, payments and the restaurant’s calendar feed, and protect the booking form from spam, under the safeguards set out for each.

Supabase’s Edge Functions, which handle your booking as it is made and changed, run in the Supabase region nearest the request, which may be outside the UK. That processing is protected by SCCs with the UK Addendum, in Supabase’s data processing agreement.

Emails are transmitted to Resend (United States) for delivery. This transfer is protected by SCCs with the UK Addendum, in Resend’s data processing agreement, and by the UK Extension to the EU-U.S. Data Privacy Framework.

Cloudflare processes IP addresses and anti-spam tokens, and delivers restaurants’ private calendar feeds of their bookings, at its global edge network. This processing is protected by a UK IDTA or SCCs.

Text messages are delivered by Celerity Messaging UK Ltd (BulkSMS.com), whose client data is hosted in the Republic of Ireland — a transfer within the EEA covered by the UK’s adequacy regulations. Limited support access from its group office in South Africa is covered by its DPA incorporating Standard Contractual Clauses.

If you pay a deposit or pre-payment, Stripe processes your payment data in the European Union, the United States and other countries, including India. These transfers are protected by a UK IDTA or SCCs.

6. How Long We Keep Your Data

After the retention period expires, personal data is anonymised — identifying fields are removed or replaced with non-identifying values. Anonymised records may be retained for aggregate reporting purposes (e.g. total covers per month).

If the restaurant you booked with has configured a different retention period, that period applies instead of the 24-month default. The restaurant is responsible for ensuring any retention period it selects is reflected in its own privacy information and is appropriate for its purposes.

7. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

Because the restaurant you booked with is the data controller for your booking data, you should normally contact that restaurant first to exercise your rights.

If you contact Seatly instead (at privacy@seatly.uk), we may forward your request to the relevant restaurant and assist them in fulfilling it where our involvement is required. We do not decide whether a request relating to restaurant booking data should be granted; that decision rests with the restaurant as controller.

The restaurant is responsible for responding within the applicable UK GDPR timeframe (normally one calendar month from receipt of request, per Article 12(3)).

Information Commissioner’s Office (ICO): Website: ico.org.uk Helpline: 0303 123 1113

8. Cookies

The Seatly booking widget uses one cookie-equivalent mechanism: Cloudflare Turnstile, an anti-spam challenge that sets a short-lived token to verify that a booking is submitted by a human.

This mechanism is strictly necessary for the security of the booking form. It does not track you across websites and does not require your consent under the UK Privacy and Electronic Communications Regulations (PECR).

No advertising, analytics, or tracking cookies are set by Seatly. Our marketing website uses cookieless analytics that set no cookies and store nothing on your device, and — only if you agree to it — session recording, which does store a session identifier in your browser. Both are covered in section 9.

For full details, see our Cookie Policy.

9. Marketing Site Visitors

This section applies to visitors to our own marketing website at seatly.uk — not to the booking or admin widgets embedded on restaurants’ websites. For this processing, Seatly Software Ltd is the data controller.

Website analytics. We use two cookieless analytics tools — PostHog (EU Cloud, processed in Frankfurt) and Cloudflare Web Analytics — to understand in aggregate how visitors use the site: pages viewed, referrer, scroll depth, sections seen, and interactions such as clicks. Cloudflare Web Analytics runs on Cloudflare’s global edge network, which may be outside the UK; that processing is protected by a UK IDTA or SCCs. Neither tool sets cookies, stores anything on your device, or builds an individual profile. PostHog counts visitors with a daily-rotated hash of technical connection data that is discarded within 24 hours and cannot identify you. We rely on our legitimate interest in understanding and improving our website; because nothing is stored on your device and the output is aggregate statistics, no consent is required under PECR (including under the statistical-purposes exception in the Data (Use and Access) Act 2025). You can opt out at any time using the control on our Cookie Policy page.

Session recording. If you agree to it, we record how you move through our marketing pages — scrolling, pointer movement, clicks, and the page as it appeared to you — so we can find the places where the site confuses people. It is off unless you say yes, and we ask with a refusal that is no harder to choose than agreement. Everything you type is masked, so your name, email address, phone number and restaurant name are never captured as text. We do not record the contents of network requests, browser console output, or animated graphics, and addresses containing a private link are stripped. Recording never runs on the pages that handle a booking, a queue place, an event ticket or a text-message unsubscribe, and never on the widgets a restaurant embeds on its own website. Our processor is PostHog Inc. (EU Cloud, Frankfurt). Recordings are kept for 30 days and then deleted. Our lawful basis is your consent under Article 6(1)(a), and you can withdraw it at any time using the control on our Cookie Policy page — which stops recording immediately, not on your next visit. To have a recording of your own visit erased, email privacy@seatly.uk.

Enquiries. If you submit the “Talk to us” form, we collect the details you enter, together with the page you submitted it from and, where available, the referring site and campaign parameters, so we know where enquiries come from. Your enquiry is stored in our main database in the United Kingdom, provided by Supabase Inc. The function that receives it runs in the Supabase region nearest the request, which may be outside the UK; that processing is protected by SCCs with the UK Addendum, in Supabase’s data processing agreement. Cloudflare Turnstile protects the form from spam, processing your IP address at Cloudflare’s global edge network under a UK IDTA or SCCs. We are told about each enquiry by an email delivered through Resend (United States), a transfer protected by SCCs with the UK Addendum, in Resend’s data processing agreement, and by the UK Extension to the EU-U.S. Data Privacy Framework. We keep enquiry details for 12 months, then delete them — or earlier on request to privacy@seatly.uk.

10. Restaurant Clients

This section applies to the people at restaurants that use Seatly — owners, managers and billing contacts — and covers the personal data we use to run their subscription. For this processing, Seatly Software Ltd is the data controller.

What we hold. The restaurant’s business name and the contact details on its account (contact email address, contact phone number and trading address), the billing name and email address, and the restaurant’s subscription, invoices and payment records. Payment card and bank account details are held by Stripe; Seatly never holds full card or account numbers. If the restaurant cancels, we also hold the reasons it gives, any comments it adds, whether it asked to speak to us first, and who gave them.

Why we use it. To bill for the subscription and keep records of it, and to contact the restaurant about its account and the service, including the notices our Terms of Service require, such as price changes. We use the reasons a restaurant gives for cancelling to understand why restaurants leave.

Lawful basis. Where a restaurant contracts with us as an individual, such as a sole trader, we rely on performance of that contract (Article 6(1)(b) UK GDPR). Where it contracts through a company, we rely on our legitimate interests in running and administering that contract (Article 6(1)(f) UK GDPR). Keeping invoices and payment records for as long as HMRC requires is a legal obligation (Article 6(1)(c) UK GDPR). Understanding why restaurants cancel is in our legitimate interests (Article 6(1)(f) UK GDPR).

Who we share it with. Stripe Payments Europe, Limited takes subscription payments and holds the card or bank details used for them. Stripe acts on our behalf for this, and also uses some of the data for its own purposes, such as preventing fraud and meeting its legal obligations, as described in Stripe’s own privacy policy. Stripe processes this data in the European Union, the United States and other countries, including India; these transfers are protected by a UK IDTA or SCCs. Account details are stored in the United Kingdom by our database host, Supabase Inc. Resend (United States) delivers the emails we send to the restaurant’s contacts; that transfer is protected by SCCs with the UK Addendum, in Resend’s data processing agreement, and by the UK Extension to the EU-U.S. Data Privacy Framework.

How long we keep it. Invoices and payment records are kept for 6 years from the invoice date, as HMRC requires. The business contact details on the account are kept for as long as we need them to maintain our business records, and in any event for at least that 6-year period. Cancellation comments, and the record of who gave them, are removed about 60 days after the subscription ends, or sooner on request. The reasons are kept, with the restaurant they came from, so we can count why restaurants leave. Our audit log separately records who cancelled, for 36 months.

Staff accounts. Logins for a restaurant’s staff, and any staff email addresses it adds to receive notifications, are processed on the restaurant’s behalf under our Data Processing Agreement, not under this section.

Your rights. The rights in section 7 apply, but for the data in this section you exercise them with us, at privacy@seatly.uk, rather than with a restaurant. Invoices and payment records cannot be deleted before the HMRC period ends.

11. Children’s Data

The Seatly booking platform is intended for general consumer use and is not designed for children to use independently. We do not knowingly seek to collect personal data directly from children. If you believe a child’s personal data has been submitted inappropriately, please contact us at privacy@seatly.uk.

12. Changes to This Policy

We may update this policy from time to time. Changes will be reflected in the version number and “Last Updated” date at the top of this document. Material changes will be communicated to restaurant clients (data controllers) via their registered account email address.

Previous versions of this policy are available on request by emailing privacy@seatly.uk.

13. Contact Us

For any questions about this policy, or to exercise your data rights, please contact:

Seatly Software Ltd Email: privacy@seatly.uk

If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office Website: ico.org.uk Helpline: 0303 123 1113

Change Log