The short version
What we collect, and why
If you're a guest ordering food, booking a table, or booking a room
| Data | When it's collected |
|---|---|
| Name | When you make a booking, leave a review, or place a takeaway/delivery order |
| Phone number | Optionally, for takeaway pickup or delivery orders, and for table/room bookings |
| Delivery address | Only if you choose delivery on a takeaway order |
| Order details | Whatever you order - items, quantities, notes, table number |
| Payment information | If you pay online - handled entirely by our payment processor (see Section 5); we never see or store your full card details |
| Review content | If you choose to leave a review - your name, star rating, and comment |
We do not require you to create an account to order or book - most of this data is tied to a single visit or order, not a persistent guest profile.
If you're a hotel owner or staff member using the platform
| Data | When it's collected |
|---|---|
| Full name, username, and password (stored as a secure hash, never in plain text) | When a staff account is created |
| Role (admin, manager, waiter, chef, etc.) | Set when the account is created, controls what the account can access |
| Hotel/business details - name, address, phone, description | When the hotel profile is set up or edited |
Our legal basis
- To fulfil an order or booking (contract) - we can't get your food to your table or hold your room without your order and contact details.
- To process payments (contract) - passed securely to our payment processor to complete your transaction.
- To run the hotel's day-to-day operations (contract/legitimate interest) - staff accounts, kitchen/floor coordination, reporting.
- To publish a review you've chosen to submit (consent) - only after a hotel staff member approves it; you can ask us to remove it at any time.
- To keep the platform secure and working correctly (legitimate interest) - error logging, fraud prevention, rate-limiting login attempts.
How long we keep it
We keep order, booking, and payment records for as long as needed to meet standard UK business and tax record-keeping obligations. Guest contact details tied to a single order (phone number, delivery address) are kept alongside that order's record rather than in a separate ongoing profile. If you'd like data deleted sooner and we're not legally required to keep it, contact us and we'll action that request (see Section 8).
Who we share it with
We only share personal data with third parties where it's genuinely necessary to provide the service:
- Payment processors - to take an online payment, your payment details are sent directly to our payment processor. We do not store your card number or banking details ourselves.
- Our hosting provider - the infrastructure that stores this data and keeps the platform running.
- The specific hotel/restaurant you're ordering from or booking with - naturally, they need your order and contact details to serve you.
We do not sell personal data, and we do not share it with anyone for their own marketing purposes.
Cookies
This platform uses a small number of cookies. All but one are necessary for it to function:
| Cookie | Purpose | Duration |
|---|---|---|
| Session cookie | Keeps you logged in as staff, and remembers your place while browsing a menu or checkout | Until you close your browser |
hb_last_order | Lets you check back on an order you just placed, and alerts you the moment it's paid - tied to your device only, not shared with other guests at the same table | 4 hours |
hb_guest | Optional. Remembers your name, phone number and delivery address on this device so you don't retype them next time. Only set if you tick the box at checkout, never before. Stored on your device only - we don't keep a copy, and it isn't used to track you. Untick the box on a later order, or use the "forget my details" link on the menu, and it's deleted | 6 months, or until you clear it |
hb_terms | Optional. Remembers that you have already read a particular hotel's booking terms, so you are not shown them again every visit | 6 months |
cookie_consent | Records the choice you make in the cookie box, so we do not ask again on every page. Deliberately not kept after you close your browser — these pages are reached by scanning a code on a table, and one guest's answer should not stand in for the next person who sits there | This visit only |
None of these cookies are used for advertising or cross-site tracking. The session and hb_last_order
cookies are strictly necessary for the platform to work, so UK cookie law (PECR) doesn't require us to ask
your permission for them - but we wanted you to know exactly what they are and why they're there.
hb_guest is different: it's a convenience, not a necessity, so we ask first and set nothing
until you say yes.
Your rights
Under the UK GDPR you can ask us for any of these. Use the contact details at the foot of this page; we answer within one month, and it costs nothing.
How we protect your data
- Passwords are never stored in plain text - only as a one-way secure hash.
- Staff access is role-based - a waiter's account can't see reports meant for a manager, for example.
- Login attempts are rate-limited to guard against automated password-guessing.
- We do not store full payment card numbers anywhere on this platform.
Children’s data
This platform isn't directed at children, and we don't knowingly collect personal data from children. Where a menu includes a "Kids" section, it's for a parent or guardian to order on a child's behalf, not for a child to use the platform themselves.
Who we are
This platform is operated by STADIT RESERVATIONS LIMITED, a company registered in the United Kingdom ("we", "us", "our"). For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018) , we are the data controller for the personal data described in this policy - meaning we decide why and how that data is used.
Changes to this policy
We may update this policy from time to time as the platform changes. The "Last updated" date at the top of this page will always reflect the most recent version.
Contact us
For any question about this policy, or to exercise any of the rights above, contact us at:
info@stadit.co.uk
If you're unhappy with how we've handled your data, you also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO) .