Privacy policy

This privacy notice applies when you visit or interact with the website for The Butcher’s Hook at thebutchershookthornbury.co.uk. It explains what personal information we use, why we use it, who we share it with, how long we keep it and the choices available to you.

It covers this website, website analytics, online communications and any information passed to us through a linked booking service. A different or additional notice may apply to activity at a pub, such as CCTV, guest Wi-Fi, employment or an in-person event. A third party's own notice applies when you leave this website for its service.

Scarlett Pub Company Ltd, trading as Scarlett Pub Co, is the controller of the personal information described in this notice. This means it decides how and why that information is used.

This website does not ask you to provide health or other special-category information directly. A linked booking provider may separately ask about accessibility or dietary requirements under its own privacy information. If it passes special-category information to Scarlett Pub Company Ltd, we will use it only after identifying and documenting an applicable condition under Article 9 of the UK GDPR, and will provide any further information the law requires.

Information marked as required by a booking provider is needed to process the booking or request; without it, the service may not be able to complete the booking or respond. Other information is voluntary unless we explain otherwise.

We use personal information only where we have a lawful basis:

• To provide a service or take requested steps: to respond to booking enquiries, administer a booking or otherwise provide something you have asked for. This is usually necessary for a contract or steps before a contract.
• To operate and secure the website: to deliver pages, diagnose faults, prevent abuse, maintain access controls and investigate incidents. We rely on our legitimate interests in providing a reliable and secure service, and on legal obligations where applicable.
• To answer general enquiries: to manage correspondence and keep an appropriate record. We rely on our legitimate interests in communicating with visitors and operating our venues.
• To understand use of the website: to where Google Analytics is configured for this host, measure visits and improve content. We do this only with your consent.
• To remember and evidence your choices: to apply a preference you request and record your cookie decision. We do this to provide the requested functionality, meet legal obligations and support our legitimate interest in demonstrating compliance.
• To administer staff access: to create, protect and audit authorised administrative accounts. We rely on legitimate interests, relevant contractual or employment arrangements, and legal obligations.
• To meet legal and regulatory duties: to keep required records, respond to lawful requests, establish or defend legal claims, and cooperate with regulators or law enforcement where required.

Our legitimate interests include operating and protecting our websites and venues, responding to people, improving our services, managing staff access and protecting legal rights. We consider the impact on you before relying on those interests. You may object as explained under your data protection rights.

When you follow one of our marketing QR links, we count the visit towards daily totals for that code and campaign. These counters do not store your IP address or a visitor identifier and do not use tracking cookies. Repeat visits may be counted more than once. Campaign labels in the destination URL also help us understand subsequent website activity in Google Analytics when you consent to it.

We use essential technologies to run the site and remember choices you request. Where Google Analytics is configured for this host, it is optional: its tag is not loaded by this website unless you affirmatively consent to analytics. You can reject analytics and still use the website, and you can change your choice later through the Manage consent link in the footer.

Any analytics enabled for this host is used to understand website use and is not used by us for advertising or remarketing. The first-party cookies registered for this host, their purposes and their lifetimes are listed in the The Butcher’s Hook cookie policy.

Venue pages contain an embedded Google Map which loads automatically as part of the page. Your browser contacts Google and may send information such as your IP address, browser details and the page you visited. Google may also use storage on your device. This embedded map is separate from our Google Analytics consent control. Google handles information under its own privacy policy.

Booking buttons and social-media links may take you to services such as Dojo, Direct-book, Facebook, Instagram or X. Those providers are responsible for their own websites and tracking. Review their privacy information before providing data. If a booking provider sends reservation details to Scarlett Pub Company Ltd, we use them to manage your booking and related service.

We disclose personal information only where it is necessary:

• Mozztec IT, which manages the website and provides privacy and technical support on our behalf;
• hosting, infrastructure, security, email and other IT providers that process information for us;
• Google, when you consent to Analytics or when a Google Map loads;
• booking providers and authorised Scarlett Pub Co venue or administrative staff who need the information to manage your request;
• professional advisers, insurers, auditors, regulators, courts or law-enforcement bodies where there is a proper legal reason; and
• a buyer, investor or successor if our organisation or an operation is reorganised, subject to appropriate confidentiality and data-protection safeguards.

We do not sell your personal information.

Some service providers, including Google, may process information outside the United Kingdom. Where UK personal information is transferred to a country without UK adequacy regulations, we require an appropriate safeguard where the law requires one. Depending on the transfer, this may include the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism, together with supplementary protections where appropriate.

You can ask us for more information about the safeguards relevant to your information. Google describes its global transfer arrangements in its data-transfer frameworks.

We keep personal information only for as long as it is needed for the purpose collected, taking account of security, legal, accounting and dispute-resolution requirements:

• Where Google Analytics is enabled, user-level and event-level data is kept for up to 14 months. Standard aggregate reports may remain available for longer.
• Cookie and preference lifetimes are shown in the cookie policy and may end sooner if you clear or reset them.
• Ordinary enquiries are normally deleted or anonymised within 12 months after the matter is resolved, unless they form part of a booking, complaint, financial record or legal claim.
• Booking, contractual, complaint and legal-claim records may be kept for up to 6 years after the relevant transaction or relationship, or longer where law or an active dispute requires it.
• Technical and security logs are rotated or deleted when no longer reasonably needed for service reliability, diagnosis and security. Relevant extracts may be kept longer to investigate an incident or support a legal claim.
• Administrative account access is removed when no longer needed. Limited audit and security records may be kept afterward for accountability and incident response.

We use proportionate technical and organisational measures designed to protect personal information. These include encrypted connections, access controls, authentication, least-privilege permissions, software maintenance, logging, backups and arrangements with service providers. Access is limited to people who need information for an authorised purpose.

No internet service can be guaranteed completely secure. If we identify a personal-data breach, we assess it, take steps to contain it and notify affected people and the Information Commissioner's Office where the law requires us to do so.

Depending on the circumstances, UK data protection law gives you the right to ask us to:

• provide a copy of your personal information;
• correct inaccurate or incomplete information;
• delete information;
• restrict how information is used;
• provide information you gave us in a portable, machine-readable form where the right applies; and
• stop processing based on consent by withdrawing it.

Withdrawing consent does not make earlier lawful processing unlawful. We do not use website information to make decisions about you based solely on automated processing that have legal or similarly significant effects.

To exercise a right, email support@mozztecit.com. We may need enough information to verify your identity and locate the relevant records. Rights are not absolute, but we will explain if an exemption applies. We usually respond within one month and do not charge a fee unless a request is manifestly unfounded, excessive or repetitive.

For a privacy question or complaint, email support@mozztecit.com with “Data protection complaint” in the subject. Tell us what happened, when it happened, the information or right involved and the outcome you are seeking. Please avoid sending unnecessary sensitive information.

We will acknowledge a data-protection complaint within 30 days, investigate it appropriately, keep you informed of progress and provide an outcome without undue delay. If you remain dissatisfied, or prefer to contact the regulator directly, you may complain to the Information Commissioner's Office (ICO).

We review this notice when our website, providers or legal obligations change. The date at the top shows when it was last updated. If a change materially affects a consent you have given, we will ask for consent again where required.