Privacy Policy
Last updated: 7 October 2026
Buns & Bones Ltd ("Buns & Bones", "we", "us" or "our") respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store and protect your personal information when you visit our website, place an order, make a booking, contact us, or otherwise interact with Buns & Bones.
Buns & Bones Ltd is the data controller responsible for your personal information.
We operate in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.
---
1. Information We Collect
Depending on how you interact with us, we may collect the following information.
Personal Information
When you place an order, make a booking, contact us or otherwise interact with our services, we may collect:
- Your name
- Email address
- Telephone number
- Delivery address, where applicable
- Billing information, where applicable
- Order and booking details
- Special requests or other information you choose to provide
- Information contained in messages or enquiries you send to us
We only request information that is reasonably necessary for the relevant purpose.
Payment Information
If you make a payment through our website, payment transactions are processed by Square.
We do not intentionally store your full payment card details ourselves. Payment information is handled by Square in accordance with its own privacy and security policies and applicable payment-card security requirements.
Square may collect and process payment and transaction information in connection with your purchase.
For more information about how Square handles personal information, please refer to Square's privacy information.
Website and Device Information
When you visit our website, certain technical information may automatically be collected, such as:
- IP address
- Browser type and version
- Device type
- Operating system
- Pages visited
- Date and time of visits
- Information about how you interact with our website
This information may be used to operate, maintain, secure and improve our website and services.
---
2. How We Collect Your Information
We may collect personal information when you:
- Visit our website
- Place an online order
- Make a booking or reservation
- Create or use an online account, where available
- Contact us by email, telephone, social media or another communication method
- Sign up to receive marketing communications
- Visit or interact with our restaurant
- Participate in promotions, competitions or loyalty schemes
- Otherwise provide information to us voluntarily
---
3. Our Website and Popmenu
Our website and online ordering services are operated using Popmenu.
When you use our website or online ordering functionality, personal information may be processed through Popmenu on our behalf in order to provide website, ordering and related services.
The information processed may include details such as your name, contact details, order information, delivery information and other information required to provide the service.
Popmenu may also process certain technical information relating to your use of the website.
Popmenu's own privacy policy and terms may apply to information processed through its services. We recommend reviewing Popmenu's privacy information for further details.
---
4. How We Use Your Personal Information
We may use your personal information for the following purposes.
Processing Orders
We use your information to:
- Receive and process your order
- Confirm your order
- Prepare and provide your food
- Arrange collection or delivery where applicable
- Contact you about your order
- Deal with refunds, cancellations or complaints
- Maintain appropriate records of transactions
The legal basis for this processing is generally that it is necessary to perform a contract with you or to take steps at your request before entering into a contract.
Bookings and Reservations
Where you make a booking or reservation, we may use your information to:
- Record and manage the booking
- Contact you about the booking
- Accommodate reasonable requests
- Deal with cancellations or changes
The legal basis will generally be performance of a contract or taking steps at your request before entering into a contract.
Customer Service
We may use your information to respond to questions, enquiries, complaints, feedback and other communications.
The legal basis may be performance of a contract, compliance with a legal obligation, or our legitimate interests in providing and improving our services.
Business Administration
We may use personal information for legitimate business purposes, including:
- Maintaining business and transaction records
- Accounting and financial administration
- Managing refunds
- Preventing fraud and misuse
- Protecting our website, systems, staff and customers
- Resolving disputes
- Enforcing our terms and conditions
- Complying with legal and regulatory obligations
---
5. Marketing
Where permitted by law, we may use your contact information to send you information about Buns & Bones, including:
- Special offers
- New menu items
- Events
- Promotions
- Restaurant news
Where consent is required, we will ask for your consent before sending marketing communications.
You can unsubscribe from marketing communications at any time by following the unsubscribe instructions in the relevant communication or by contacting us.
---
6. Legal Bases for Processing
Under UK data protection law, we must have a lawful basis for processing personal information.
Depending on the circumstances, we may rely on one or more of the following:
Contract
Where processing is necessary to provide the products or services you have requested, such as processing an order or reservation.
Legal Obligation
Where we need to process information to comply with a legal or regulatory requirement.
Legitimate Interests
Where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and interests.
Examples may include operating and improving our business, preventing fraud, maintaining security and dealing with customer enquiries.
Consent
Where we ask you to provide consent, for example for certain marketing communications or optional cookies.
You may withdraw consent at any time.
---
7. Who We Share Your Information With
We do not sell your personal information.
We may share personal information with trusted third parties where this is necessary to provide our services or operate our business.
These may include:
- Popmenu, which provides our website and online ordering platform
- Square, which processes payments
- Delivery or fulfilment providers, where applicable
- IT, hosting and technical service providers
- Email or communications providers
- Professional advisers, such as accountants, lawyers or insurers
- Government, regulatory or law-enforcement authorities where legally required
Third-party service providers are only permitted to process personal information as necessary for the services they provide and, where applicable, under appropriate contractual and data protection arrangements.
---
8. Payment Processing
Online payments are processed by Square.
When you pay by card or another payment method supported by Square, relevant payment information is transmitted to Square for processing.
We do not intentionally store your full payment card number or security code on our own systems.
Square may process payment information, transaction information and other information necessary to provide payment services, prevent fraud and comply with legal obligations.
Square's own privacy policy applies to information it processes as part of its payment services.
---
9. Cookies and Similar Technologies
Our website may use cookies and similar technologies.
Cookies may be used for purposes including:
- Making the website function correctly
- Remembering preferences
- Processing online orders
- Understanding how visitors use our website
- Improving website performance
- Measuring the effectiveness of marketing
- Providing relevant functionality
Some cookies may be placed by third-party service providers, including services used by our website or ordering platform.
Where required by law, we will ask for your consent before placing non-essential cookies or similar technologies on your device.
You can manage or disable cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the website.
---
10. Analytics
We may use analytics and similar technologies to understand how visitors use our website and to improve our services.
Where analytics services process personal information or use technologies that require consent, we will obtain consent where required.
Analytics information may include technical information such as IP address, browser type, device information, pages visited and interactions with the website.
---
11. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes for which it was collected.
The length of time we retain information depends on the type of information and why we need it.
For example, transaction and financial records may need to be retained for longer periods where required by tax, accounting or other legal obligations.
Information relating to customer enquiries, orders, bookings and communications will generally be retained for as long as reasonably necessary to provide our services, maintain appropriate records, resolve disputes and meet legal obligations.
Where information is no longer required, we will securely delete it or anonymise it where appropriate.
---
12. Data Security
We take reasonable technical and organisational measures to protect personal information against accidental loss, misuse, unauthorised access, alteration or disclosure.
However, no method of transmitting or storing information electronically can be guaranteed to be completely secure.
Where payment information is processed through Square, payment processing is handled through Square's payment infrastructure rather than being stored directly by Buns & Bones.
---
13. International Data Transfers
Some of the third-party service providers we use may process personal information outside the United Kingdom.
Where personal information is transferred outside the UK, we will take appropriate steps to ensure that the transfer is lawful and that appropriate safeguards are in place in accordance with applicable data protection legislation.
---
14. Your Data Protection Rights
Under UK data protection law, you may have rights in relation to your personal information, including:
- The right to access your personal information
- The right to rectification of inaccurate or incomplete information
- The right to erasure of your personal information in certain circumstances
- The right to restriction of processing in certain circumstances
- The right to object to certain processing, including processing based on legitimate interests and certain direct marketing
- The right to data portability in certain circumstances
- The right to withdraw consent where we rely on consent as our legal basis
These rights are subject to certain exceptions and conditions under UK data protection law.
To exercise your rights, please contact us using the contact details provided below.
We may need to verify your identity before responding to certain requests.
---
15. Direct Marketing
If you have agreed to receive marketing communications from us, you can change your mind at any time.
You can unsubscribe using the unsubscribe link included in marketing emails or by contacting us.
Where we send electronic marketing communications, we will comply with applicable privacy and electronic marketing laws.
---
16. Children's Privacy
Our website and services are intended for general use.
We do not knowingly collect personal information from children for purposes that require parental consent.
If you believe that a child has provided us with personal information inappropriately, please contact us so that we can review and, where appropriate, delete the information.
---
17. Third-Party Websites
Our website may contain links to third-party websites, including social media platforms or other services.
We are not responsible for the privacy practices, security or content of third-party websites.
We recommend reviewing the privacy policy of any third-party website you visit.
---
18. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our business, services, technology or legal requirements.
When we make changes, we will update the "Last updated" date at the top of this policy.
We recommend checking this page periodically for the latest version.
---
19. Contact Us
If you have any questions about this Privacy Policy, would like to exercise your data protection rights, or have a concern about how we use your personal information, please contact:
Buns & Bones Ltd
Aldershot, Hampshire
United Kingdom
Email: [INSERT PRIVACY/CONTACT EMAIL]
We will endeavour to respond to valid data protection requests within the applicable legal timeframe.
---
20. Complaints
We hope that we can resolve any concerns you may have about how we use your personal information.
You also have the right to complain to the UK's data protection regulator:
Information Commissioner's Office (ICO)
If you are unhappy with our handling of your personal information, you can contact the ICO through its website.
The ICO provides information about data protection rights and how to make a complaint.