Privacy Policy

1. Who we are

Bombay to Goa Limited, trading as Bombay 2 Goa (“we”, “us”, “our”), is the data controller responsible for your personal data. We are a private limited company registered in England and Wales under company number 14925901, and our registered office and restaurant is:

Email: info@bombay2goa.co.uk
Telephone: 0113 513 5972

We are a small business and are not required to appoint a Data Protection Officer. Data protection questions go to the email address above and are handled by the restaurant’s management.

2. What data we collect and why

We do not collect any special category data (such as health information) unless you voluntarily provide it in a special request field, for example to notify us of a food allergy.

3. How long we keep your data

We retain personal data only for as long as necessary:

• Reservation, contact and catering enquiry data:retained for up to 24 months, then deleted.
• Gift voucher purchase data:retained for 7 years to comply with HMRC accounting requirements.
• Newsletter email addresses:retained until you unsubscribe or ask us to remove you.
• Analytics data:retained in aggregated, anonymised form for up to 26 months in line with Google Analytics defaults.
• Rate-limiting records:IP addresses used to throttle form submissions expire automatically within minutes.
• Error reports:retained by Sentry for up to 90 days, then deleted.
• CCTV footage:normally overwritten automatically within 31 days - see section 8.

4. Who we share your data with

We use the following third-party processors who may handle your personal data on our behalf:

• Resend (transactional email delivery for booking & enquiry confirmations, newsletter list):Privacy Policy
• Supabase (secure storage of booking and enquiry records):Privacy Policy
• Giftup.io (gift voucher platform):Privacy Policy
• Google LLC (Google Analytics, Google Maps embed):Privacy Policy
• Vercel, Inc. (website hosting, the Upstash/KV store used to rate-limit our forms, and Vercel Web Analytics - see below):Privacy Policy
• Functional Software, Inc. (Sentry) (website error monitoring):Privacy Policy

If you order food through Uber Eats, Just Eat or Deliveroo, that order is placed on their platform and they are the controller of the data you give them - their own privacy policies apply, not this one.

We do not sell your personal data to any third party and we do not use it for marketing purposes without your explicit consent. We may disclose data where the law requires it, for example to HMRC, environmental health or the police.

5. Sending data outside the UK

Several of the providers above are based in, or store data in, the United States. When your personal data is transferred outside the UK we rely on one of the safeguards permitted by Chapter V of the UK GDPR:

• UK adequacy regulations:for transfers to US organisations certified under the UK Extension to the EU-US Data Privacy Framework (this covers Google and Vercel).
• The International Data Transfer Addendum to the EU Standard Contractual Clauses, included in our data processing agreements with providers not covered by adequacy.

You can ask us for a copy of the safeguards in place by emailing info@bombay2goa.co.uk.

6. How we keep your data safe

We take appropriate technical and organisational measures to protect your data, including:

• Encryption in transit (HTTPS) across the whole website, and encryption at rest by our hosting and database providers.
• Access to booking, enquiry and newsletter records restricted to restaurant management, protected by individual accounts.
• Rate limiting and spam protection on every form to prevent bulk abuse.
• A Content Security Policy and security headers to reduce the risk of malicious scripts.

No system is completely secure. If a personal data breach is likely to risk your rights and freedoms, we will report it to the ICO within 72 hours and tell you where the law requires it.

7. Children’s data

Our website is aimed at adults. We do not knowingly collect personal data from children under 13, and we do not accept newsletter or marketing sign-ups from them. If you believe a child has given us their details, email info@bombay2goa.co.uk and we will delete the data. Bookings for family meals should be made by an adult.

8. CCTV in the restaurant

We operate CCTV inside and around the restaurant. Signs are displayed so you know when you are in a recorded area.

• Why:to prevent and detect crime, to protect our guests, our staff and our property, and to help resolve incidents or disputes.
• Legal basis:our legitimate interests in the safety and security of the premises. We have balanced this against your privacy: cameras cover public areas of the restaurant only - never toilets or changing areas - and we do not use them to monitor individual staff performance.
• How long we keep it:footage is normally overwritten automatically within 31 days. We keep an image for longer only where it has been exported for a specific incident, insurance claim or police request.
• Who sees it:restaurant management only. We share footage with the police, our insurers or our legal advisers where there is a lawful reason to do so, and we do not put it online or on social media.
• Your rights:you can ask for a copy of footage of yourself. Email info@bombay2goa.co.uk with the date, approximate time and where you were sitting so we can find it, and we will respond within one month. Where other people appear in the same footage we may need to blur them before releasing it.

9. Cookies and similar technologies

No analytics or marketing cookies are set until you choose “Accept All” on our cookie banner. Until then Google Analytics is held in a denied state through Google Consent Mode. We do not run any advertising or ad-personalisation tags at all.

Our map embeds do not load until you press “Load map”, so Google receives no data from them unless you ask for it.

We also use Vercel Web Analytics to count page views and to see how many visitors reach the end of our booking form. It appears here rather than in the table above because it sets no cookie and stores nothing on your device - so it does not need your consent and is not affected by your choice on the banner.

For each page view it records the page address (including any query parameters, which on our site only ever carry a booking date, time or party size), the site you arrived from, your approximate location from your country down to city level, your browser, operating system and whether you are on a phone, tablet or desktop. It does not store your IP address. Visitors are counted using a temporary identifier derived from the incoming request, which is automatically discarded after 24 hours, so it cannot recognise you on a later visit and cannot follow you to any other website. We rely on our legitimate interest in understanding, in aggregate, whether our site is working - for example whether a quiet week means fewer visitors or a booking form that has stopped working.

You can change or withdraw your choice at any time using the Manage Cookies link in the footer of every page. You can also block or delete cookies and local storage in your browser settings, though strictly necessary items are needed for the site to work.

10. Your rights under UK GDPR

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the following rights:

• Right of access:to request a copy of the personal data we hold about you.
• Right to rectification:to ask us to correct inaccurate or incomplete data.
• Right to erasure:to ask us to delete your personal data where there is no lawful reason for us to continue processing it.
• Right to restrict processing:to ask us to pause processing your data in certain circumstances.
• Right to data portability:to receive your data in a structured, commonly used format.
• Right to object:to object to processing carried out on the basis of legitimate interests.
• Rights related to automated decision-making:we do not carry out any automated decision-making or profiling.

To exercise any of these rights, please contact us at info@bombay2goa.co.uk. We will respond within one calendar month.

11. How to make a complaint

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection:

• Website: ico.org.uk
• Helpline: 0303 123 1113

We would, however, appreciate the opportunity to address your concern directly before you contact the ICO.

12. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised “Last updated” date. We encourage you to review this page periodically.