Privacy policy

Who we are

This policy applies to Blend (“we”, “us”, “our”), an independent group of cafés trading as Blend on the Hill, with sites in Bournemouth, Broadstone and Southbourne. We are the “data controller” for the personal data described in this policy.

For any privacy-related question, or to exercise your rights, please contact us at hello@blendonthehill.co.uk.

What we collect

• Bookings & events: name, email, phone number, party size, date, time, and any access, dietary or allergy information you choose to share.
• Newsletter: the email address you provide and your consent record.
• Contact form & enquiries: the details and message you send us, including any information you choose to include.
• Careers: CVs, cover letters and any details you submit when applying for a role.
• Payments: handled by our payment providers; we do not store full card details.
• Site usage: anonymised analytics such as pages viewed, device and browser type, referring site and approximate (city-level) location.
• CCTV: some cafés use CCTV for the safety of guests and staff and the prevention of crime. Signage is displayed on entry.

Why we use your information & our lawful basis

Under UK GDPR we must have a lawful basis for processing personal data. We rely on:

• Contract: to manage table bookings, events and orders you ask us to provide.
• Consent: to send marketing emails, set non-essential cookies, and use your image where you’ve given permission.
• Legitimate interests: to respond to enquiries, improve our website and services, secure our premises (including CCTV) and prevent fraud — balanced against your rights and freedoms.
• Legal obligation: to meet accounting, tax, employment, food safety and other regulatory requirements.

Marketing

We will only send marketing emails where you have opted in. You can unsubscribe at any time using the link at the bottom of any marketing email, or by emailing us. Withdrawing consent does not affect the lawfulness of processing carried out beforehand.

Sharing your information

We never sell your personal data. We share it only with trusted providers (“processors”) who help us run the business under written contracts and appropriate safeguards. These include:

• Our bookings and table-management platform.
• Email and newsletter delivery services.
• Payment processors and card terminal providers.
• Website hosting, analytics and security providers.
• Professional advisers (e.g. accountants, lawyers) where necessary.
• Public authorities and law enforcement where required by law.

International transfers

Some of our providers are based outside the UK. Where personal data is transferred internationally, we rely on UK adequacy regulations or appropriate safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

How long we keep it

We keep personal data only for as long as needed for the purpose it was collected, then delete or anonymise it. Typical retention periods:

• Booking records: up to 24 months after your visit.
• Newsletter subscriptions: until you unsubscribe.
• Enquiries and correspondence: up to 24 months.
• Job applications: up to 12 months for unsuccessful applicants.
• Financial records: 6 years, as required by HMRC.
• CCTV footage: typically 30 days unless required for an investigation.

Keeping it safe

We use appropriate technical and organisational measures — including access controls, encryption in transit and staff training — to protect your personal data against unauthorised access, loss or misuse.

Children

Our website is intended for adults. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

Your rights

Under UK GDPR and the Data Protection Act 2018 you have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate or incomplete data.
• Ask us to delete your data (the “right to be forgotten”).
• Restrict or object to certain processing, including direct marketing.
• Receive a copy of your data in a portable format.
• Withdraw consent at any time, where consent is our lawful basis.

To make a request, email hello@blendonthehill.co.uk. We aim to respond within one month.

Complaints

We hope to resolve any concern directly, but you also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113.

Updates

We may update this policy from time to time. The date at the top of the page will always reflect the latest version. Material changes will be highlighted on this page.