Privacy Policy
Last updated: November 2026
This policy explains what personal information Ostuni Restaurant collects when you book a table, write to us or visit our website, why we use it, who helps us handle it, how long we keep it and what your rights are. We collect only what we need to look after you, we never sell it, and we send no marketing emails.
Ostuni Restaurant Limited (company number 16687135, registered in England; registered office 277 Upper Richmond Road, London SW15 6SP) is the controller of your personal information under UK data protection law (the UK GDPR and the Data Protection Act 2018). Questions about this policy, or requests about your information, go to info@ostunirestaurant.com.
What we collect and why
Table reservations
- What
- Your name, email address, phone number, the date, time and size of your booking, and anything you add in Special Requests. The same applies when you book by phone and our team enters the booking for you. When you book online we also keep a scrambled, one-way code (a hash) made from your IP address, email address and phone number; the code never reveals the details it was made from.
- Why
- To hold your table, send your confirmation, a reminder the day before and any changes, and contact you about your booking. We keep your bookings with us together, including any that went unused, so our team can welcome you back and plan each evening's tables with care. The scrambled codes protect the booking form from automated and repeated fake bookings.
- Lawful basis
- Performing our agreement with you (your booking). If you tell us about an allergy or other health-related dietary need, we use it, with your consent, only to prepare your meal safely; you may ask us to remove it at any time. For keeping your bookings together, our legitimate interest in looking after returning guests and our tables. For the scrambled codes, our legitimate interest in keeping the booking form safe.
- Shared with
- Supabase (our booking database, hosted in London) and Resend (sends booking emails, USA). If you book through OpenTable, OpenTable shares your booking with us and its own privacy policy also applies.
- Kept for
- Up to 2 years after your booking date, then deleted. The scrambled codes are deleted after 30 days.
Contact and private event enquiries
- What
- Your name, email address, phone number if you give it, and your message. For events, also the date, number of guests and type of event.
- Why
- To reply to you and, for events, to plan your event with you.
- Lawful basis
- Our legitimate interest in answering your message; for events, taking the steps you ask for before an event booking.
- Shared with
- Web3Forms (passes the form to our inbox) and Hostinger (hosts our email).
- Kept for
- Up to 2 years after our last exchange, then deleted.
Website analytics, only with your consent
- What
- The pages you visit, how you arrived, your device and browser type, and your approximate location derived from your IP address.
- Why
- To understand how guests use our website, so we can improve it.
- Lawful basis
- Your consent. Google Analytics stays off until you choose Accept, and you can change your mind at any time in Cookie Settings.
- Shared with
- Google (Google Analytics), which may process data in the USA.
- Kept for
- Up to 14 months in Google Analytics.
Running the website: maps, reviews and fonts
- What
- Your IP address and browser details, which your browser sends whenever it loads something from another service.
- Why
- To show our location on a map (Contact and Reservations pages), our latest Google reviews (home page) and our typefaces (every page), and to keep the site secure.
- Lawful basis
- Our legitimate interest in running a working, secure website.
- Shared with
- Hostinger (hosts the website and keeps server logs); Google (Google Maps, Google reviews and Google Fonts); jsDelivr (only if our booking software fails to load from our own server).
- Kept for
- Server logs are kept for a short period by Hostinger; Google processes these requests under its own privacy policy.
We may also keep or share information where the law requires it, for example to answer a valid request from a public authority.
Transfers outside the UK
Resend and Google may process information in the USA. Where they do, the transfer is protected by the UK–US data bridge or by the UK's standard data transfer clauses, as UK law requires.
Your rights
You have the right to:
- ask for a copy of the information we hold about you;
- have it corrected if it is wrong, or deleted;
- ask us to restrict how we use it, or object to our use of it;
- receive it in a portable format;
- withdraw your consent at any time, for example in Cookie Settings, without affecting anything done before.
Write to info@ostunirestaurant.com and we will reply within one month.
If you are unhappy with how we handle your information, you may complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. We would welcome the chance to put things right first.
Children
Bookings and enquiries should be made by an adult. We do not knowingly collect information from children under 13 through this website.
Changes to this policy
When we change this policy we will update it here and change the "Last updated" date above.
Contact us
Ostuni Restaurant Limited
Email:
info@ostunirestaurant.com
Phone:
020 8788 7733
Address:
277 Upper Richmond Rd
London SW15 6SP
United Kingdom