Privacy Policy

1. Who We Are

Seatly Software Ltd (“Seatly”, “we”, “us”) provides a white-label restaurant booking platform used by independent restaurants across the United Kingdom.

Roles under UK GDPR:

• Seatly Software Ltd acts as a data processor — we operate and maintain the booking software on behalf of restaurants.
• The restaurant you are booking with acts as the data controller — they determine why your data is collected and how it is used.

When you make a booking through a Seatly-powered widget, you are providing your personal data to the restaurant, which Seatly processes on their behalf.

Contact: Seatly Software Ltd Email: [email protected]

For our own marketing website at seatly.uk and the enquiries we receive through it, Seatly Software Ltd acts as the data controller — see section 9.

2. What Data We Collect

The following personal data may be collected when you make a booking:

Special requirements may include information such as dietary requirements, accessibility needs, or allergy information that you choose to provide in connection with your booking. Depending on what you enter, this may include sensitive personal data (such as health or religious dietary information). This information is collected so the restaurant can prepare for and manage your booking appropriately. The restaurant you are booking with is responsible for determining the lawful basis and, where applicable, any additional condition required under Article 9 UK GDPR for collecting and using this information.

If you join a restaurant’s walk-in queue in person or by scanning its QR code, your name and phone number are collected to manage the queue and, where you provide a number, to text you when your table is ready.

We do not store payment card details. If you pay a deposit or pre-payment, payment is taken on Stripe’s secure checkout page and settled to the restaurant’s own Stripe account — your card details are held by Stripe, never by Seatly. Seatly keeps the payment status, amount, and Stripe payment reference linked to your booking.

3. How We Use Your Data

SMS reminders

Restaurants using Seatly may send you a one-off SMS reminder the day before your booking. This is a service message under the UK Privacy and Electronic Communications Regulations 2003 (“PECR”): your phone number is used only for reminders about a booking you have made, not for marketing.

We rely on the PECR soft opt-in framework (Regulation 22(3)) for reminder messages:

• Your phone number is collected in the course of a booking you made directly with the restaurant
• The message relates only to that booking (party size, restaurant name, booking time)
• You can opt out on every message by tapping the unsubscribe link included in the message

You can stop receiving SMS reminders from a specific restaurant at any time by tapping the unsubscribe link in any reminder and confirming on the page that opens. This stops reminders from that restaurant only — bookings with other restaurants on Seatly are unaffected. Opt-out records are kept per restaurant and survive any later request to erase your personal data, so you will not start receiving SMS again if you later make another booking with the same restaurant.

To stop all SMS reminders, ask the restaurant to remove your phone number from your customer profile, or use your right of erasure (see below).

If you join a restaurant’s walk-in queue and provide your phone number, the restaurant may also send you a one-off text to tell you your table is ready. This is a single service message you asked for when joining the queue — it isn’t marketing and carries no unsubscribe link. The number is used to run the queue and, if you’ve visited the restaurant before, to link your visit to your existing guest record.

Your data is NOT used for:

• Marketing or promotional communications
• Profiling or automated decision-making
• Selling or licensing to third parties
• Advertising networks or data brokers

4. Who We Share Your Data With

We never share your data with:

• Other restaurants on the Seatly platform
• Advertising networks
• Data brokers or analytics companies (the aggregate, cookieless statistics for our own marketing website — see section 9 — involve no booking data)
• Any party not listed above

A full list of our sub-processors, including addresses, data locations, and transfer mechanisms, is published on our Sub-Processor List.

5. Where Your Data Is Stored

Your booking data is stored in the United Kingdom on servers provided by Supabase Inc., hosted in the AWS London region (eu-west-2). This data does not leave the UK for storage purposes.

Emails are transmitted to Resend Inc. (United States) for delivery. This transfer is protected by a UK International Data Transfer Agreement (UK IDTA) and Standard Contractual Clauses (SCCs) under Article 46(2)(c) UK GDPR.

Cloudflare processes IP addresses and anti-spam tokens at its global edge network. This processing is protected by a UK IDTA and SCCs.

Text messages are delivered by Celerity Messaging UK Ltd (BulkSMS.com), whose client data is hosted in the Republic of Ireland — a transfer within the EEA covered by the UK’s adequacy regulations. Limited support access from its group office in South Africa is covered by its DPA incorporating Standard Contractual Clauses.

If you pay a deposit or pre-payment, Stripe processes your payment data in the United States and European Union. This transfer is protected by a UK IDTA and SCCs.

6. How Long We Keep Your Data

After the retention period expires, personal data is anonymised — identifying fields are removed or replaced with non-identifying values. Anonymised records may be retained for aggregate reporting purposes (e.g. total covers per month).

If the restaurant you booked with has configured a different retention period, that period applies instead of the 24-month default. The restaurant is responsible for ensuring any retention period it selects is reflected in its own privacy information and is appropriate for its purposes.

7. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

Because the restaurant you booked with is the data controller for your booking data, you should normally contact that restaurant first to exercise your rights.

If you contact Seatly instead (at [email protected]), we may forward your request to the relevant restaurant and assist them in fulfilling it where our involvement is required. We do not decide whether a request relating to restaurant booking data should be granted; that decision rests with the restaurant as controller.

The restaurant is responsible for responding within the applicable UK GDPR timeframe (normally one calendar month from receipt of request, per Article 12(3)).

Information Commissioner’s Office (ICO): Website: ico.org.uk Helpline: 0303 123 1113

8. Cookies

The Seatly booking widget uses one cookie-equivalent mechanism: Cloudflare Turnstile, an anti-spam challenge that sets a short-lived token to verify that a booking is submitted by a human.

This mechanism is strictly necessary for the security of the booking form. It does not track you across websites and does not require your consent under the UK Privacy and Electronic Communications Regulations (PECR).

No advertising, analytics, or tracking cookies are set by Seatly. Our marketing website uses cookieless analytics that set no cookies and store nothing on your device — see section 9.

For full details, see our Cookie Policy.

9. Marketing Site Visitors

This section applies to visitors to our own marketing website at seatly.uk — not to the booking or admin widgets embedded on restaurants’ websites. For this processing, Seatly Software Ltd is the data controller.

Website analytics. We use two cookieless analytics tools — PostHog (EU Cloud, processed in Frankfurt) and Cloudflare Web Analytics — to understand in aggregate how visitors use the site: pages viewed, referrer, scroll depth, sections seen, and interactions such as clicks. Neither tool sets cookies, stores anything on your device, or builds an individual profile. PostHog counts visitors with a daily-rotated hash of technical connection data that is discarded within 24 hours and cannot identify you. We rely on our legitimate interest in understanding and improving our website; because nothing is stored on your device and the output is aggregate statistics, no consent is required under PECR (including under the statistical-purposes exception in the Data (Use and Access) Act 2025). You can opt out at any time using the control on our Cookie Policy page.

Enquiries. If you submit the “Talk to us” form, we collect the details you enter, together with the page you submitted it from and, where available, the referring site and campaign parameters, so we know where enquiries come from. We keep enquiry details for 12 months, then delete them — or earlier on request to [email protected].

10. Children’s Data

The Seatly booking platform is intended for general consumer use and is not designed for children to use independently. We do not knowingly seek to collect personal data directly from children. If you believe a child’s personal data has been submitted inappropriately, please contact us at [email protected].

11. Changes to This Policy

We may update this policy from time to time. Changes will be reflected in the version number and “Last Updated” date at the top of this document. Material changes will be communicated to restaurant clients (data controllers) via their registered account email address.

Previous versions of this policy are available on request by emailing [email protected].

12. Contact Us

For any questions about this policy, or to exercise your data rights, please contact:

Seatly Software Ltd Email: [email protected]

If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office Website: ico.org.uk Helpline: 0303 123 1113

Change Log