# Privacy Policy
**Last updated: 29/6/26**
JamJar Jesmond (“we”, “us”, “our”) is committed to protecting your personal information. This privacy policy explains what information we collect about you, why we collect it, how we use it, who we share it with, and what rights you have over it. It applies to everyone who visits our website (jamjarjesmond.co.uk), books a table or room with us, signs up for a membership card, uses our delivery service, or contacts us in any other way.
This policy is written in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
—
## 1. Who we are
JamJar Jesmond is operated by **[REGISTERED COMPANY NAME]** (“the company”), a company registered in England and Wales (company number [COMPANY NUMBER]).
– **Registered office:** [REGISTERED OFFICE ADDRESS]
– **Trading address:** 88 Osborne Road, Newcastle upon Tyne, NE2 2AP
– **Contact:** [CONTACT EMAIL] · 0191 281 4224
The company is the **data controller** for the personal information described in this policy. That means we decide what data is collected, why, and how it’s used.
—
## 2. What information we collect
The information we collect depends on how you interact with us. The sections below describe what we collect in each situation, why we collect it, and the lawful basis under UK GDPR.
### 2.1 Booking a table
When you reserve a table with us we collect:
– Your name
– Your contact phone number
– Your email address (if provided)
– Number of guests
– Date and time of booking
– Any special requirements (e.g. dietary needs, accessibility)
**Why:** to confirm your booking, contact you if we need to change or cancel it, and to provide a service that meets your needs on the night.
**Lawful basis:** performance of a contract with you. Dietary requirements may be processed in your “vital interests” if they relate to a serious allergy.
### 2.2 Booking a room
When you book a hotel stay through us we collect:
– Your name
– Your address
– Your contact phone number
– Your email address
– Payment card details (collected and processed by our payment processor — we do not store full card numbers, see section 2.6)
– Identification details where required by law
**Why:** to confirm and manage your booking, take payment, and comply with our legal obligations for hotel guests.
**Lawful basis:** performance of a contract with you, and legal obligation.
### 2.3 Ordering food for delivery (“Jam Jar Delivers”)
When you place a delivery order we collect:
– Your name
– Your delivery address
– Your contact phone number
– Your email address
– Your order details
– Payment card details (collected and processed by our payment processor — we do not store full card numbers)
**Why:** to deliver your order, take payment, and contact you if there’s a problem with the order.
**Lawful basis:** performance of a contract with you.
### 2.4 Catering or event enquiries
When you contact us about catering or events we collect the details you provide in your enquiry — typically your name, contact details, and event information.
**Why:** to respond to your enquiry and (if you go ahead) to deliver the event.
**Lawful basis:** taking steps at your request prior to entering into a contract; performance of a contract.
### 2.5 Membership card sign-up
When you sign up for a 25/26 JamJar Members Card on our website, we collect:
– **For all members:** First name, last name, email address, mobile/contact number.
– **For student memberships:** Date of birth, society name, and a photograph, scan or PDF of your student ID card.
– **For non-student memberships:** Your address.
We also store the IP address you signed up from. This is used only to help us identify and respond to suspected fraud or abuse.
**Why we collect it:**
– Your name, email and phone number let us recognise you when you come to collect your card, and contact you if there’s a problem with your membership.
– A student membership has a discounted price; we use date of birth, society and student ID to verify that an applicant is genuinely a student.
– An address (for non-student memberships) helps us verify identity.
**About your student ID:** photographs of identity documents are sensitive personal information. We protect student ID files in line with section 8 of this policy and we **only ever use them for the purpose of verifying student status for the membership.** We do not share these files with any third party, and we do not use them for any other purpose. We delete student ID files when:
– We have completed your membership verification, **and**
– The membership year (25/26) has ended.
If your application is unsuccessful, the file is deleted within 30 days of our decision.
**Lawful basis:** performance of a contract with you (delivering your membership). For data that relates to the verification of student status, we also rely on legitimate interests in being able to grant a student concession only to genuine students.
### 2.6 Card payments
We use **Square** as our payment processor for in-restaurant and online card payments. When you pay by card:
– Your card details are entered directly into a secure payment form hosted by Square.
– **JamJar does not see, store or process your card number, expiry date or security code.** Square handles all of this on its own systems.
– Square gives us back a record of the transaction (the amount, the date, a Square reference, and the last 4 digits of the card for receipts).
Square is a PCI DSS Level 1 certified payment processor. Square’s own privacy notice governs how it uses your card data. See [squareup.com/gb/en/legal/general/privacy](https://squareup.com/gb/en/legal/general/privacy).
**Lawful basis:** performance of a contract with you; legal obligation (to keep accurate financial records).
### 2.7 Visiting our website
When you visit jamjarjesmond.co.uk our web hosting provider and analytics tools may automatically log:
– Your IP address
– Your browser and device type
– The pages you visit, when, and for how long
– The website you came from (referrer)
We use cookies and similar technologies to make the site work and to understand how visitors use it. See section 11.
**Lawful basis:** legitimate interests (in operating, securing and improving our website). For non-essential cookies, your consent.
### 2.8 Contacting us
If you email us, use a contact form, or message us on social media, we keep a record of your message and our response. This contains whatever personal information you choose to include.
**Lawful basis:** legitimate interests (in responding to and managing correspondence).
### 2.9 Marketing (only if you opt in)
If you subscribe to our newsletter or otherwise opt in to marketing, we collect your name and email address.
**Lawful basis:** your consent. You can withdraw consent at any time using the unsubscribe link in any email or by contacting us.
—
## 3. How we use your information
We only use your information for the purposes set out above. In summary, we use it to:
– Provide and manage the products and services you ask us for (tables, rooms, deliveries, memberships, events).
– Take payment, issue receipts and keep accurate financial records.
– Recognise members and verify eligibility for the student concession.
– Respond to enquiries and complaints.
– Operate, secure and improve our website.
– Send marketing communications, where you have asked us to.
– Comply with our legal obligations (e.g. tax, hotel guest records, anti-fraud).
We will not use your information for any other purpose without first telling you and, where required, getting your consent.
—
## 4. Who we share your information with
We share personal information only where necessary. The main recipients are:
– **Square** — our payment processor (see section 2.6).
– **WooCommerce / Automattic** — the e-commerce software our membership shop runs on. WooCommerce stores your order details on our website’s database; it is not a separate third party that receives your data.
– **WordPress.com (Automattic)** — if we use Jetpack or similar tools for site analytics, security or anti-spam.
– **Our website host** — SiteGround Spain S.L., which physically stores our website’s database on EU servers.
– **Royal Mail and other couriers** — for posting items if applicable.
– **Our IT and developer support** — only when they need to access systems to fix a problem, and under appropriate confidentiality terms.
– **HMRC and other regulators** — where required by law.
– **The police and other public bodies** — only where we are legally required to disclose information or where it is necessary for the prevention or detection of crime.
We do not sell, rent, or trade your personal information.
—
## 5. Where we store your information
The majority of your personal information is stored on:
– Our WordPress website database (hosted in the European Economic Area by SiteGround).
– Square’s systems (transactional and card data, governed by Square’s privacy policy).
If any of our service providers are outside the UK or EEA, we make sure there are appropriate safeguards in place (such as the UK International Data Transfer Agreement or Standard Contractual Clauses) so your data is protected to the same standard as it would be here.
—
## 6. How long we keep your information
We keep personal information only as long as we need it for the purposes set out in this policy, or for as long as the law requires. As a general guide:
| What | How long |
|—|—|
| Table bookings | 12 months from the date of booking |
| Delivery orders | 12 months from the date of order |
| Hotel guest records | 7 years (legal requirement) |
| Membership registrations (name, contact, type) | Duration of the membership year + 2 years for audit |
| Student ID files | Until verification complete; deleted by the end of the membership year at the latest |
| Financial / transaction records | 7 years (tax law) |
| Marketing subscriber details | Until you unsubscribe, or 3 years from your last interaction (whichever is sooner) |
| Website log files | 90 days |
| Customer service correspondence | 3 years |
After these periods we either securely delete the information or anonymise it so it can no longer be linked to you.
—
## 7. Your rights under UK GDPR
You have the following rights over your personal information:
– **Right to be informed** — what we collect and why (this policy).
– **Right of access** — to ask for a copy of the personal information we hold about you.
– **Right to rectification** — to correct anything that is inaccurate or incomplete.
– **Right to erasure (“right to be forgotten”)** — to ask us to delete your information, where we no longer need it for the purpose we collected it for. Note: we cannot delete information that we are legally required to keep (for example, hotel guest records or transaction records).
– **Right to restrict processing** — to ask us to pause processing your information in certain circumstances.
– **Right to data portability** — to receive a copy of the information you have given us in a portable format.
– **Right to object** — to certain processing, including direct marketing.
– **Rights related to automated decision-making and profiling** — we do not make decisions about you using purely automated means.
To exercise any of these rights, please contact us at **[CONTACT EMAIL]**. We aim to respond within 30 days. There is no charge unless your request is manifestly unfounded or excessive.
You also have the right to complain to the Information Commissioner’s Office (ICO) — see section 12.
—
## 8. How we protect your information
We take the security of your personal information seriously. The technical and organisational measures we have in place include:
– All connections to our website use HTTPS (TLS encryption).
– Access to our admin systems is restricted to authorised personnel, protected by strong passwords and two-factor authentication.
– Card data is processed only by Square; it never reaches our own systems.
– Uploaded student ID files are stored in a **non-public, protected directory** on our web server, with random filenames so the files cannot be guessed or enumerated. They are served only through an authenticated admin endpoint that checks the user’s permission before each download.
– Our website software, plug-ins and security tools are kept up to date.
– We use a reputable web host with their own physical and network security controls.
No system is ever 100% secure, but if we ever became aware of a personal-data breach that posed a risk to your rights and freedoms, we would notify the Information Commissioner’s Office within 72 hours and you without undue delay where required.
—
## 9. Children
Our online membership form and delivery service are not directed at children under 16. If you are under 16, please ask a parent or guardian to make any booking or sign-up on your behalf. If we discover that we have inadvertently collected personal information from a child without proper consent, we will delete it.
—
## 10. Marketing
If you have opted in to receive marketing from us, you can unsubscribe at any time using the unsubscribe link in any email we send, or by emailing **[CONTACT EMAIL]**.
We will not send you marketing about other businesses’ products or services, and we will not share your email address with any third-party advertisers.
—
## 11. Cookies and similar technologies
Our website uses cookies — small text files stored in your browser — to make the site work and to understand how visitors use it.
The main types of cookie we use:
– **Strictly necessary cookies** — needed for things like the cookie banner choice itself, the WooCommerce cart, and security. These do not need your consent.
– **Functional cookies** — remember your preferences (e.g. that you’ve dismissed the membership card prompt).
– **Analytics cookies** — help us understand which pages are popular and how visitors get to us. Set only with your consent.
You can change your cookie preferences at any time by clearing your browser cookies for jamjarjesmond.co.uk or using the cookie banner on the site.
Most browsers also allow you to refuse or delete cookies in your browser settings. If you do this some parts of the site may not work as expected.
—
## 12. Complaints
If you are unhappy with how we have handled your personal information, please tell us first so we have the chance to put things right — email **[CONTACT EMAIL]**.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
– Website: [ico.org.uk](https://ico.org.uk)
– Helpline: 0303 123 1113
– Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
—
## 13. Changes to this policy
We may update this policy from time to time. Where we make material changes we will publish the updated version on this page and update the “Last updated” date at the top. For significant changes that affect how we use your information we will notify you directly where reasonably possible.
—
## 14. Contact us
If you have any questions about this policy or how we handle your information, contact us at:
– **Email:** [CONTACT EMAIL]
– **Phone:** 0191 281 4224
– **Post:** JamJar Jesmond, 88 Osborne Road, Newcastle upon Tyne, NE2 2AP