Privacy Policy

1. Introduction

Qibo Skybar ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal data when you interact with us, whether through our website, by making a reservation, visiting our venue, or communicating with us by any means.

This policy is provided in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

Please read this policy carefully to understand our practices regarding your personal data and how we will treat it. By using our website or services, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

The data controller responsible for your personal data is:

If you have any questions about this Privacy Policy or our data practices, please contact us using the details above.

3. What Data We Collect

We may collect and process the following categories of personal data:

3.1 Information You Provide Directly

• Reservation data: your name, email address, telephone number, date and time preferences, party size, and any special requests or dietary requirements you share with us.
• Enquiry and correspondence data: any information you provide when you contact us via email, telephone, social media, or our website contact forms.
• Event and private hire data: details you provide when enquiring about or booking private events, including company name, billing address, and event requirements.
• Marketing preferences: your name and email address when you opt in to receive newsletters, promotional offers, or event updates.

3.2 Information Collected Automatically

• Technical data: IP address, browser type and version, operating system, device type, screen resolution, and time zone settings.
• Usage data: information about how you use our website, including pages visited, time spent on pages, navigation paths, and referring URLs.
• Cookie data: information collected through cookies and similar tracking technologies. For full details, please see our Cookie Policy.

3.3 Information from Third Parties

• Booking platforms: if you make a reservation through a third-party booking platform (such as OpenTable, Resy, or similar services), we may receive your name, contact details, and booking preferences from that platform.
• Social media: if you interact with us on social media platforms, we may receive limited profile information in accordance with the privacy settings of your social media account.

4. Legal Basis for Processing

We only process your personal data where we have a lawful basis to do so. The legal bases upon which we rely include:

• Contractual necessity (Article 6(1)(b) UK GDPR): processing that is necessary to fulfil a contract with you or to take steps at your request prior to entering into a contract. This includes processing your reservation details and managing your booking.
• Consent (Article 6(1)(a) UK GDPR): where you have given clear, affirmative consent for us to process your personal data for a specific purpose, such as subscribing to our marketing communications or accepting non-essential cookies.
• Legitimate interests (Article 6(1)(f) UK GDPR): processing that is necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. This includes improving our services, understanding customer preferences, ensuring venue security, and preventing fraud.
• Legal obligation (Article 6(1)(c) UK GDPR): processing that is necessary for compliance with a legal obligation to which we are subject, such as maintaining financial records or responding to lawful requests from regulatory authorities.

5. How We Use Your Data

We use your personal data for the following purposes:

5.1 Reservations and Service Delivery

• To process, confirm, and manage your table reservations.
• To communicate with you about your booking, including confirmations, reminders, and any changes.
• To accommodate special requests or dietary requirements.
• To manage private event bookings and enquiries.

5.2 Marketing Communications

• To send you newsletters, event invitations, promotional offers, and updates about Qibo Skybar, but only where you have given your explicit, freely given consent to receive such communications.
• You may withdraw your consent at any time by clicking the "unsubscribe" link in any marketing email or by contacting us directly.

5.3 Website Analytics and Improvement

• To analyse how visitors use our website so that we can improve its content, functionality, and user experience.
• To monitor website performance and diagnose technical issues.

5.4 Legal and Regulatory Compliance

• To comply with applicable laws, regulations, and legal processes.
• To protect our rights, property, or safety, and that of our customers and staff.

6. Data Sharing

We may share your personal data with the following categories of recipients, only to the extent necessary for the purposes set out in this policy:

• Payment processors: to securely process card payments. Payment data is handled directly by our PCI DSS-compliant payment service provider, and we do not store your full card details.
• Booking and reservation platforms: third-party reservation systems that facilitate table bookings on our behalf.
• Email and marketing platforms: service providers we use to send marketing communications to those who have opted in.
• Analytics providers: third-party analytics tools that help us understand website usage (data is typically aggregated and anonymised).
• Professional advisors: our accountants, lawyers, and other professional advisors where necessary.
• Regulatory authorities: where we are required to do so by law, or in response to lawful requests by public authorities.

We do not sell, rent, or trade your personal data to any third party for their own marketing purposes.

Where we share data with third-party service providers, we ensure that appropriate data processing agreements are in place in accordance with Article 28 of the UK GDPR. Any international transfers of personal data will only take place where adequate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO) or the UK International Data Transfer Agreement (IDTA).

7. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our standard retention periods are as follows:

• Reservation data: retained for up to 24 months after your most recent booking, to enable us to manage your preferences and provide a better service for returning guests.
• Marketing data: retained for as long as you remain subscribed to our communications. Upon unsubscribing, your data will be suppressed (rather than deleted) to ensure we do not contact you again, unless you request full erasure.
• Website analytics data: retained in anonymised or aggregated form for up to 26 months, in line with standard analytics retention settings.
• Financial and transaction records: retained for a minimum of 6 years as required by HMRC and applicable UK tax and accounting legislation.
• Enquiry and correspondence data: retained for up to 12 months after the resolution of your enquiry, unless a longer retention period is required for legal or regulatory purposes.

When your data is no longer required, it will be securely deleted or anonymised so that it can no longer be associated with you.

8. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the following rights in relation to your personal data:

• Right of access (Article 15): you have the right to request a copy of the personal data we hold about you, together with information about how and why we process it.
• Right to rectification (Article 16): you have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
• Right to erasure (Article 17): you have the right to request that we delete your personal data where there is no compelling reason for its continued processing. This is also known as the "right to be forgotten".
• Right to restriction of processing (Article 18): you have the right to request that we restrict the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data or object to our processing of it.
• Right to data portability (Article 20): you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to request that we transmit that data to another controller where technically feasible.
• Right to object (Article 21): you have the right to object to the processing of your personal data where we are relying on legitimate interests as our legal basis, or where we are processing your data for direct marketing purposes.
• Rights related to automated decision-making (Article 22): you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. We do not currently engage in automated decision-making.
• Right to withdraw consent: where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

9. How to Exercise Your Rights

To exercise any of the rights set out above, or if you have any questions or concerns about how we handle your personal data, please contact us:

We will respond to your request without undue delay and in any event within one month of receipt. In certain circumstances (for example, where requests are complex or numerous), we may extend this period by a further two months, in which case we will inform you of the extension and the reasons for it.

We may need to verify your identity before processing your request. There is no fee for exercising your rights, except where requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse the request.

Complaints

If you are dissatisfied with how we have handled your personal data or any request you have made to us, you have the right to lodge a complaint with the UK's supervisory authority:

We would, however, appreciate the opportunity to address your concerns before you approach the ICO, so please contact us in the first instance.

10. Cookies

Our website uses cookies and similar tracking technologies to distinguish you from other users, enhance your browsing experience, and help us improve our website.

Cookies are small text files that are placed on your device when you visit our website. They allow us to recognise your browser and capture certain information. We use both essential cookies (which are necessary for the website to function) and non-essential cookies (such as analytics and marketing cookies), which are only placed with your consent.

For detailed information about the cookies we use, their purposes, and how to manage your cookie preferences, please refer to our Cookie Policy.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational, legal, or regulatory reasons. Any changes will be posted on this page with an updated "Last updated" date.

Where changes are significant, we will take reasonable steps to notify you, such as by displaying a prominent notice on our website or, where appropriate, by sending you an email notification.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your data.

12. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please do not hesitate to contact us: