Cinder - Operated by Cinder Restaurants Ltd
Registered Office: 159 High Street, Barnet, EN5 5SU, United Kingdom
Website: cinderrestaurant.co.uk
Last updated: 10 August 2026
1. ABOUT THIS PRIVACY POLICY
At Cinder, we respect your privacy and are committed to protecting your personal information.This Privacy Policy explains how Cinder Restaurants Ltd, trading as Cinder, collects, uses, stores and protects personal information relating to customers, website visitors, people making enquiries, job applicants and other individuals who interact with us.
Cinder Restaurants Ltd is the data controller for the personal information covered by this Privacy Policy.
This Privacy Policy applies when you:
We process personal data in accordance with applicable UK data-protection law, including the UK
General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR) and applicable amendments made by the Data (Use and Access) Act 2025.
2. WHO WE ARE
The organisation responsible for your personal data is:
Cinder Restaurants Ltd
159 High Street
Barnet
EN5 5SU
United Kingdom
Cinder Restaurants Ltd operates the Cinder restaurant.
For the purposes of UK data-protection law, Cinder Restaurants Ltd is generally the data controller of personal information collected through Cinder’s own operations. If you make a reservation through OpenTable, OpenTable may also process your personal information under its own privacy arrangements. OpenTable’s own privacy policy explains how it processes information through its platform.
3. INFORMATION WE COLLECT
Depending on how you interact with us, we may collect different categories of personal information.
3.1 Information you provide directly
This may include:
We will only ask for information that is reasonably necessary for the relevant purpose.
3.2 Reservation information
Reservations at Cinder are facilitated through OpenTable.
When you make a reservation, information such as your name, contact details, booking details, party size, special requests and other information necessary to manage your reservation may be processed by OpenTable and made available to Cinder.
We use this information to:
OpenTable may separately process your information under its own privacy policy and terms. OpenTable states that it shares information with restaurants to facilitate reservations and related services.
3.3 Information collected when you visit our website
When you visit our website, we may collect information such as:
Some of this information may constitute personal data where it can reasonably be associated with an identifiable individual.
3.4 Information collected when you contact us
If you contact us by telephone, email, social media, website form or another method, we may retain the information necessary to respond to your enquiry and maintain appropriate records. This may include your name, contact details, the contents of your communication and any information you choose to provide.
3.5 CCTV
CCTV may operate at or around Cinder for legitimate security and safety purposes. Where CCTV is used, it may capture images of customers, employees, contractors and members of the public.CCTV may be used for:
CCTV is not used to monitor customers for marketing purposes.
CCTV footage is retained only for as long as reasonably necessary for its stated purposes, subject to any requirement to preserve particular footage because of an incident, investigation, complaint, legal claim or law-enforcement request.
CCTV use will be subject to appropriate signage and controls.
The Information Commissioner’s Office expects organisations using CCTV to consider necessity, proportionality, transparency, security and retention, and small businesses using CCTV may have an obligation to register and pay the relevant data-protection fee.
4. HOW WE USE YOUR PERSONAL INFORMATION
We may use personal information for the following purposes:
Reservations and customer service
To:
Restaurant operations
To:
Marketing
Where permitted by law and, where required, with your consent, we may use your personal information to send:
You can unsubscribe from marketing communications at any time.
Website management
To:
Recruitment
Where you apply for employment or another position with Cinder Restaurants Ltd, we may process information provided as part of your application. This may include:
Recruitment information will be processed for recruitment and employment-related purposes and in accordance with applicable employment and data-protection legislation.
5. OUR LAWFUL BASES FOR PROCESSING YOUR INFORMATION
Under UK data-protection law, we must have a lawful basis for processing personal information.
Depending on the circumstances, we may rely on one or more of the following:
Contract
We may process information where it is necessary to take steps at your request before entering into an arrangement with you or to perform an arrangement with you. For example, this may apply to managing a reservation or providing services you have requested.
Legal obligation
We may process personal information where necessary to comply with a legal obligation.
This may include obligations relating to:
Legitimate interests
We may process personal information where this is necessary for our legitimate interests, provided those interests are not overridden by your rights and interests.
Our legitimate interests may include:
Where we rely on legitimate interests, we consider whether the processing is necessary and proportionate and whether your rights and interests are appropriately protected.
Consent
Where required by law, we will ask for your consent before processing your personal information for a particular purpose.
For example, this may apply to certain electronic marketing or non-essential cookies.
Where processing is based on consent, you may withdraw your consent at any time.
Withdrawing consent does not affect the lawfulness of processing that took place before you withdrew it.
The ICO confirms that organisations must identify and communicate their lawful basis for each relevant processing purpose.
6. SPECIAL CATEGORY INFORMATION
Certain information is considered “special category data” under UK data-protection law.
In a restaurant context, you may voluntarily provide information relating to allergies, dietary requirements or medical conditions.
For example, you may tell us that you have a food allergy or medical condition requiring particular precautions.
Where information you provide constitutes special category data, we will only process it where there is an appropriate lawful basis and special-category condition under applicable law.
We may use such information to:
You should only provide sensitive information where it is relevant to your request.
7. MARKETING
We may send marketing communications where permitted by applicable law.
This may include information about:
Where consent is required, we will ask for it before sending the relevant marketing communications. You can stop receiving marketing communications at any time by:
Stopping marketing communications will not affect service-related communications, such as information about an existing reservation.
8. COOKIES AND SIMILAR TECHNOLOGIES
Our website may use cookies and similar technologies.Cookies are small text files placed on your device which can help websites operate and remember information about your visit.
We may use cookies for purposes including:
Where required, we will ask for your consent before placing non-essential cookies on your device.Y ou can control or delete cookies through your browser settings. Disabling certain cookies may affect thefunctionality of parts of our website.Where third-party services place cookies or similar technologies on our website, their processing may also be governed by their own privacy policies.
9. THIRD-PARTY SERVICE PROVIDERS
We may use trusted third-party suppliers and service providers to help operate Cinder.Depending on the services we use, these may include providers of:
We only permit suppliers to process personal information where appropriate and require appropriate contractual and security arrangements where applicable.
10. OPENTABLE
Cinder uses OpenTable to facilitate restaurant reservations.
When you make or manage a reservation through OpenTable, your information may be processed by both OpenTable and Cinder as applicable to the relevant service.
OpenTable has its own privacy policy governing its processing activities. OpenTable explains that it may collect information such as contact details and dining information and may share relevant information with restaurants to facilitate bookings and related services.
You should review OpenTable’s privacy information if you wish to understand how OpenTable processes your information independently of Cinder.
11. WHO WE MAY SHARE YOUR INFORMATION WITH
We may share personal information where reasonably necessary with:
We do not sell your personal information to third parties.
We will not share personal information with third parties for their own direct marketing purposes unless this is lawful and appropriately authorised.
12. INTERNATIONAL TRANSFERS
Some of our suppliers or service providers may process personal information outside the United Kingdom.Where personal information is transferred outside the UK, we will ensure that appropriate safeguards are in place as required by applicable data-protection law.
These safeguards may include:
Where appropriate, further information about relevant safeguards can be obtained by contacting us.
13. HOW LONG WE KEEP YOUR INFORMATION
We will not keep personal information for longer than is reasonably necessary for the purpose for which it was collected, unless we are required or permitted by law to retain it for longer. Retention periods may vary depending on the type of information.
As a general guide:
Retained for as long as reasonably necessary for restaurant operations, customer service, legal and accounting purposes.
Retained for as long as reasonably necessary to deal with the enquiry and any resulting matter until you unsubscribe, withdraw consent or the information is no longer required.
Retained for as long as reasonably necessary to investigate and resolve the complaint and protect our legal interests.
Normally retained for a limited period appropriate to the security purpose, unless required for an incident, investigation or legal matter.
Retained for periods required by applicable accounting and tax legislation Retained for a reasonable period following completion of recruitment, unless longer retention is justified or required.
Where a legal claim, investigation or regulatory matter requires us to retain information, we may retain relevant information for the duration of that matter and any applicable limitation period.
Retention periods are reviewed periodically.
14. HOW WE PROTECT YOUR INFORMATION
We take reasonable and appropriate technical and organisational measures to protect personal information against:
Access to personal information is limited to people who need it for legitimate business purposes.
Where appropriate, we use measures such as:
However, no electronic transmission or storage system can be guaranteed to be completely secure.
15. YOUR DATA PROTECTION RIGHTS
Depending on the circumstances and subject to applicable legal conditions and exemptions, you may have the following rights:
Right to be informed
You have the right to receive clear information about how we use your personal information. This Privacy Policy provides that information.
Right of access
You can ask us for a copy of personal information we hold about you.
Right to rectification
You can ask us to correct inaccurate or incomplete information.
Right to erasure
In certain circumstances, you can ask us to delete your personal information. This is sometimes referred to as the “right to be forgotten”.
Right to restrict processing
In certain circumstances, you can ask us to restrict how we use your personal information.
Right to data portability
In certain circumstances, you may have the right to receive personal information you have provided to us in a structured, commonly used and machine-readable format and to request that it be transferred to another organisation.
Right to object
You may have the right to object to certain processing, including processing based on legitimate interests. You have an absolute right to object to the use of your personal information for direct marketing.
Rights relating to automated decision-making
Where applicable, you may have rights relating to decisions made solely by automated processing that produce legal or similarly significant effects. We do not currently intend to make significant decisions about our customers solely through automated decision-making.
The precise availability of these rights depends on the circumstances and the lawful basis on which we process your information. The ICO’s current guidance confirms these individual rights and the circumstances in which they apply.
16. HOW TO EXERCISE YOUR RIGHTS
If you wish to exercise any of your data-protection rights, please contact us.
Please provide enough information to allow us to identify you and understand your request.
We may need to request additional information to verify your identity before releasing or changing personal information.We will respond to valid requests within the time period required by applicable data-protection law.We will not normally charge a fee for exercising your data-protection rights. However, applicable law permits organisations to charge a reasonable fee or refuse to act in certain circumstances, including where requests are manifestly unfounded or excessive.
17. CONTACTING US ABOUT PRIVACY
For questions about this Privacy Policy, your personal information or your data-protection rights, please contact:
Cinder Restaurants Ltd
159 High Street
Barnet
EN5 5SU
United Kingdom
Website: cinderrestaurant.co.ukY
ou may contact Cinder through the contact details published on our website.If Cinder Restaurants Ltd appoints a dedicated Data Protection Officer or privacy contact in the future,the relevant contact details will be added to this Privacy Policy.
18. COMPLAINTS
We hope that we can resolve any privacy concerns you have directly. If you are unhappy with how we have handled your personal information, you can contact us using the details above.You also have the right to complain to the UK’s data-protection regulator: Information Commissioner’s Office (ICO)
The ICO is the independent supervisory authority responsible for data-protection matters in the UK.
Further information about making a complaint is available through the ICO’s website.
We would encourage you to contact us first so that we have an opportunity to investigate and resolve your concern.
19. CHILDREN
Our website and services are not specifically directed at children. Where a child visits Cinder with a parent, guardian or other responsible adult, we may process information necessary to provide our services, including information relating to dietary requirements or allergies where this is voluntarily provided.
We do not knowingly collect children’s personal information for marketing purposes.
20. SOCIAL MEDIA
Cinder may operate or maintain social-media profiles. If you interact with us through a social-media platform, the relevant platform may process your personal information independently of us. Your use of those platforms is subject to their own privacy policies and terms. We may receive information that you choose to provide to us through social media, such as comments, messages or other communications. We may use this information to respond to you, manage our social-media presence and deal with customer enquiries or complaints.
21. THIRD-PARTY WEBSITES
Our website may contain links to websites operated by third parties.These websites operate independently from Cinder Restaurants Ltd and may have their own privacy policies.
We are not responsible for the privacy practices, content or security of third-party websites.
You should review the privacy policy of any third-party website before providing personal information.
22. DATA BREACHES
We maintain procedures designed to identify, assess and respond to personal-data breaches. If a personal-data breach occurs, we will assess the incident and take appropriate steps in accordance with applicable law. Where legally required, we will notify the Information Commissioner’s Office and/or affected individuals.
23. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect:
The latest version will be published on our website.
Where required by law, we will provide additional notice of significant changes before they take effect.
24. GOVERNING LAW
This Privacy Policy is governed by the laws of England and Wales. Any disputes relating to this Privacy Policy will be subject to the jurisdiction of the courts of England and Wales, except where applicable law provides otherwise.
25. SUMMARY
At Cinder, we aim to collect only information that we reasonably need, use it for clear and legitimate purposes, keep it secure and retain it only for as long as necessary. If you have any questions about how we handle your personal information, please contact Cinder Restaurants Ltd using the details provided in this Privacy Policy.
Cinder Restaurants Ltd
Cinder - 159 High Street, Barnet, EN5 5SU, United Kingdom
Website: cinderrestaurant.co.uk
Privacy Policy version: 1.0
Effective date: 10 August 2026
