Privacy Policy
Spitfire Barbecue operates restaurants in Bristol and Cardiff, and this website. This policy explains what personal data we collect when you use the site, buy something from our shop (including gift vouchers), make an enquiry, or book a table, and what we do with it.
Who we are: Spitfire Barbecue [company name / company number / registered office to confirm]. You can contact us at hello@spitfirebarbecue.com (Bristol) or shwmae@spitfirebarbecue.com (Cardiff), or by post at 1 Hannover Quay, Bristol BS1 5JE.
The personal data we collect
- Enquiries: if you use our contact form, we collect your name, email address, the branch you selected, and your message.
- Orders & gift vouchers: if you buy something from our shop, we collect your name, billing address, email address, phone number (if given), and details of what you ordered.
- Payments: card payments are handled by our payment provider, Square. Your card details go directly to Square — we never see or store your full card number. We keep a reference to the payment (card brand, last 4 digits, and Square’s transaction ID) for our order records.
- Bookings: table bookings are made through our booking partner, SevenRooms, on a page we link to but don’t control. Anything you enter there is collected directly by SevenRooms under its own privacy policy; we only receive it if you also contact us directly.
- Cookies & analytics: see our Cookie Policy for details.
Why we use it
- To fulfil your order and deliver your gift voucher.
- To respond to your enquiry.
- To keep accounting and tax records, as required by law.
- To understand how the site is used — only if you consent to analytics cookies.
Who we share it with
- Square, Inc. (and its UK/EU affiliates) — to process payments.
- SevenRooms — only with data you give it directly when booking.
- Our website host and email delivery provider — to run the site and send order/voucher emails.
- Google (Google Analytics) — only if you accept analytics cookies.
We do not sell your personal data.
International transfers
Some of the providers above may process data outside the UK. Where that happens, it is covered by recognised safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.
How long we keep it
- Order and voucher records: for as long as required by UK tax law (currently 6 years after the end of the relevant tax year).
- Enquiries: for as long as needed to deal with them, then deleted within a reasonable period.
- Unredeemed gift vouchers: for the life of the voucher, plus our accounting retention period above.
Your rights
Under UK GDPR you have the right to ask for a copy of the data we hold about you, ask us to correct or delete it (subject to our legal obligations, e.g. tax records), object to or restrict certain processing, ask for your data in a portable format, and withdraw analytics cookie consent at any time (see our Cookie Policy). To exercise any of these, email hello@spitfirebarbecue.com. You can also complain to the Information Commissioner’s Office if you’re unhappy with how we’ve handled your data.
Children
This site is not aimed at children and we do not knowingly collect data from them.
Security
We take reasonable technical and organisational steps to protect your data, including using a reputable, PCI-DSS-compliant payment provider for card payments.
Changes to this policy
We may update this policy from time to time; the latest version will always be on this page.
Last updated: 12 September 2026