Privacy Policy

Who we are

Strati is the trading name of Joseph Peacock and Emily Lombardo, an ordinary partnership established in England and Wales. Our service address is Molly Mackerels, Attleford Lane, Shackleford, GU8 6BL. We are the controller of the personal information described in this notice.

For privacy questions or requests, contact [email protected].

We ask you to read this notice, not to agree to it. Most processing is necessary to arrange and deliver a booking or meet our legal obligations. Where we rely on consent or optional permission, we ask separately.

Information we collect

When you enquire or book, we collect the lead guest’s name, telephone number, email address, event address, guest count, chosen menu and any notes you provide. The lead guest is the person making the booking and is responsible for the accuracy of information supplied about the event.

When necessary to connect an allergy or dietary requirement to the correct guest, we may collect that guest’s first name or another simple identifier. We do not need their full legal name.

Stripe handles deposits and balance payments. We do not see or store full card details. If you contact us through WhatsApp, the conversation is held in Joseph’s WhatsApp account.

Our website and hosting providers receive standard technical request information, such as IP address, browser information, the requested page and timestamps, to deliver and protect the website. Google Fonts receives your IP address and the technical browser request when your browser downloads our font files.

We may also use reviewer names, review dates and excerpts that reviewers have made public on Google or Trustpilot.

Information may be supplied by an event planner, lead guest or another person arranging the event. When we receive information about you from another person, we ask them to show you this Privacy Notice. Strati remains responsible for explaining how your information is used. If we communicate with you directly, we will provide access to this notice no later than our first communication.

Allergy and dietary information

To help us look after guests safely, we ask for a first name or other simple identifier, what the guest needs to avoid, whether it is an allergy, intolerance, coeliac disease or dietary preference, and any concerns about traces or cross-contact.

Information about an allergy, coeliac disease or health-related intolerance may be special-category health information. An ordinary dietary preference may not be health information, but we handle all requirements carefully and only collect what we need.

We process named allergy or health information only after the lead guest gives the separate explicit consent shown in the booking form. Where the information concerns another adult, the lead guest confirms that person has expressly agreed to the disclosure and has seen this notice. Where it concerns a child, the lead guest confirms that the child’s parent or guardian has expressly agreed and has seen this notice.

Named allergy and health information remains in our protected booking system. It is not sent to Stripe, QuickBooks, Google Calendar, Google Maps or routine booking emails.

Children

Bookings can only be made by someone aged 18 or over. Children may attend as guests. If a child has an allergy or health-related dietary requirement, we may record only a first name or simple identifier and the information needed to plan safely, after the parent or guardian has expressly agreed and has seen this notice.

Photography and media

We may ask for optional permission to photograph or film the food and table setting for marketing. The choice is unticked by default and is not required to book. We do not include identifiable guests.

Media is stored locally on our devices without automatic cloud backup and may be published on our website, Instagram, YouTube or TikTok. You can withdraw permission by contacting us. We will stop future use and remove the material from channels we control where reasonably possible, although copies independently shared by other people may remain outside our control.

Marketing

We do not currently send promotional marketing. If this changes, we will use valid consent or another legally permitted basis and provide a clear way to opt out.

How and why we use information

• Contract or steps before a contract: answering enquiries, planning menus, arranging travel and scheduling, taking payments, managing bookings and communicating with the lead guest.
• Legal obligations: keeping accounting and tax records and responding where the law requires us to.
• Legitimate interests: maintaining basic repeat-customer history, protecting the website and booking system, preventing fraud and selecting public reviews to display. We assess these interests against your rights.
• Separate explicit consent: named allergy or health information and any future consent-based marketing.
• Separate optional permission: photography or video of food and table settings.

We do not use customer information for automated decision-making, profiling or AI-driven processing.

Who receives information

PocketBase is the database software we operate on Fly.io infrastructure. We do not sell personal information.

International transfers

Some providers operate outside the UK. Where personal information is transferred internationally, we use an appropriate UK-recognised mechanism after reviewing the relevant provider. Depending on the provider, this may include UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

This review covers providers including Stripe and the other international services listed above. You can ask [email protected] for more information about a provider’s arrangements.

How long we keep information

• Booking, contract, payment and tax records: 6 years.
• Basic repeat-customer history: 6 years after the latest booking.
• Enquiries that do not become a booking: 12 months.
• Named or identifiable allergy and health information: 90 days after the event.
• Information needed for an active complaint or legal claim: until the matter and relevant legal retention period have ended.
• Marketing opt-out records: the minimum information needed to honour the opt-out.

When a retention period ends, we delete or anonymise the information unless a legal hold requires it to be kept longer.

Security

Access to booking records is limited to Joseph and Emily through separate password-protected accounts. Booking collections are not publicly readable, connections to the website and booking API use HTTPS, administrative action links are signed and time-limited, and payment card details remain with Stripe. We apply access controls, request limits, security headers and operational checks to reduce unauthorised access or misuse.

No electronic system can be guaranteed completely secure. If a personal-data breach creates a risk to people, we will follow the applicable assessment, notification and record-keeping requirements.

Your rights

Depending on the circumstances, you may ask us for access to your information, correction, deletion, restriction or portability. Where we rely on consent, you can withdraw it at any time without affecting earlier lawful processing.

You have the right to object to processing based on legitimate interests. We will stop unless we have compelling legitimate grounds to continue or the information is needed for legal claims.

Contact [email protected] to exercise a right. You can also complain to the Information Commissioner’s Office at ico.org.uk or telephone 0303 123 1113.

Cookies and changes

See our Cookie Notice for the current website technology. We will update this notice and its date when our practices materially change.

Contact us

Email: [email protected]

Service address: Molly Mackerels, Attleford Lane, Shackleford, GU8 6BL.