Data Processing Agreement

Version 2026-10-05 · last updated 5 October 2026 · part of the Terms for restaurants

When you use BookaTab, we hold personal information about your guests and staff on your behalf. Under UK data protection law (the UK GDPR and the Data Protection Act 2018) that makes you the controller of that information and BookaTab, your processor. This agreement sets out what we do with it.

1. What we process, and why

Whose data: your guests (people who book or are booked with you, join your waitlist or your mailing list) and your staff who have a login.
What: names, email addresses, phone numbers, booking details (date, time, party size, table), notes and requests you or the guest add, visit history, birthdays where given, marketing choices, and feedback. Notes may include information a guest chooses to share about allergies, diet or access needs.
Cards: card numbers are never held by us. Where you ask guests for a card, it is saved by the payment provider in your own account with them.
Why: only to provide BookaTab to you — taking and managing bookings, sending booking emails and texts, your guest list, and the marketing you choose to send.
For how long: for as long as your account is open, and as set out under “When the agreement ends” below.

2. Our promises as your processor

We process this data only on your instructions — that is, to provide BookaTab as described in the Terms and as you set it up — unless the law requires otherwise, in which case we will tell you if we are allowed to.
We never sell it, and never use it to help another restaurant or for our own marketing.
Everyone who can access it on our side is bound to keep it confidential.
We keep it secure: encrypted in transit, access limited to those who need it, each restaurant’s data kept separate from every other’s, and regular backups.
We help you answer requests from individuals (to see, correct, delete or move their data) and give you the tools to do most of this yourself.
We help you meet your own duties on security, breach notification and impact assessments, given what we know.

3. Others who help us (sub-processors)

You agree that we use carefully chosen providers to run BookaTab, each bound by a written agreement that protects the data to the same standard as this one. They fall into these categories: hosting and database; email delivery; text message delivery (only if you switch texts on); payment processing; artificial intelligence services used to draft and summarise; and mapping and location data. We remain responsible for what they do.

If we add or replace a provider that handles your guests’ data, we will tell you by email at least 14 days beforehand. If you object on reasonable data-protection grounds and we cannot resolve it, you may cancel.

4. Where the data is kept

We keep your data in the United Kingdom or the European Economic Area where we can. Where a provider processes it elsewhere, we make sure a safeguard recognised by UK law is in place, such as the UK’s approved contract clauses.

5. If something goes wrong

If we become aware of a breach of security affecting your guests’ or staff’s personal data, we will tell you without undue delay, and in any case within 48 hours, with what we know: what happened, whose data, the likely effect and what we are doing about it. You remain responsible for deciding whether to tell the regulator or the people affected; we will help.

6. Checking on us

On reasonable request, and not more than once a year unless there has been a breach, we will give you the information you need to satisfy yourself that we are keeping to this agreement.

7. When the agreement ends

When your account closes you can download your bookings and guest list for 30 days; we email you the dates. On the 31st day we delete your guests’ and staff’s personal data from our live systems, and it drops out of our backups as they expire, unless the law requires us to keep something for longer (for example invoices).

8. Your side

As the controller you are responsible for having a lawful reason to collect and use your guests’ data, for telling them how you use it, for the marketing permissions you rely on, and for the accuracy of what you enter.

Questions: hello@bookatab.com