The Green Bollington
Privacy notice
How we look after personal information when you visit, book by phone or get in touch.
Reviewed 25 October 2026
Who we are
The Green Bollington is operated by The Green Bollington Ltd, company number 09986322. We are the data controller for the café activities described in this notice: we decide why and how we use this information.
Our business contact address is 15 High Street, Bollington, SK10 5PH. For privacy questions or requests, email hello@thegreenbolly.com, call 01625 576 691 or speak to us in the café.
The business is registered for the ICO data protection fee.
Information we use
Enquiries and email correspondence
Our contact form asks for your name, email address, an optional telephone number and a message. You enter your email twice to check it matches. The form also asks you to confirm that your enquiry is not an everyday table booking, and uses a hidden spam-check field and the time the form was opened.
We use your contact details and correspondence to answer questions and discuss arrangements you ask us to make. General correspondence is handled on the basis of our legitimate interest in responding to people who contact the café. Where you ask us to arrange private hire or another agreement, we use information to take steps at your request before a contract, or to carry out that contract. Relevant financial records are kept to meet legal accounting obligations.
The website does not have an enquiry database. Submitted contact details and messages are sent to our email inbox through Lovable managed email. A separate acknowledgement may be sent to your email address after our notification is accepted by the sending service. The repeated email, policy confirmation and spam-check fields are not included in the café notification.
We do not use website enquiries to add people to a newsletter or marketing list. We do not routinely collect or retain allergy or dietary information. Please avoid including sensitive personal information in the form. If it arrives unexpectedly, we will assess what is necessary and the appropriate legal conditions rather than treating an ordinary enquiry as consent to retain health information.
Table bookings and our booking diary
Everyday table bookings are handled by telephone or in person. The website enquiry form cannot accept or confirm them. Customer contact details, including telephone numbers, are kept in our operational booking diary to manage visits and contact customers about their booking. The diary is separate from the website form.
We use necessary booking details to take steps at your request and carry out the booking arrangement. Our legitimate interest in organising service and following up booking issues may also apply where needed.
CCTV
We use CCTV images for security, crime prevention and the protection of staff, customers and property. Our lawful basis is our legitimate interest in keeping the café and people safe. Relevant footage may be shared with the police, insurers or advisers where necessary and lawful to deal with an incident or legal claim.
Hosting, security and spam prevention
Our hosting and security services process technical information such as network addresses, browser information, page requests and diagnostic information to deliver the website and protect it from misuse. We rely on our legitimate interest in running a working, secure website.
The form uses a network-address-derived key and submission times in the running server's memory to limit repeated submissions. This is not a durable enquiry archive. Old attempts stop counting after an hour, but inactive entries are not automatically cleared on an hourly schedule and their lifetime depends on the running server instance.
Website fonts are served through our own site's asset service. Your browser no longer needs to contact Google Fonts to display them.
Services and sharing
We use Lovable for our website and managed enquiry-email sending, Google Workspace for the café mailbox, Cloudflare for hosted network security, and Google Analytics only after consent. They and their relevant service providers process information needed for those functions. We do not sell your personal information.
Information may be processed outside the UK. Lovable's published data-processing agreement describes UK contractual safeguards using the UK Addendum to EU standard contractual clauses. Google Workspace's Cloud Data Processing Addendum and Google's Analytics processing terms describe international-transfer frameworks. Cloudflare also publishes data-processing terms. This does not mean information is stored only in the UK.
The applicable account agreements, processing locations and service-specific transfer arrangements are still being checked. We do not claim that a particular UK adequacy or Data Privacy Framework route applies to every transfer. You can ask us for information about safeguards and copies of the relevant information using the contact details above.
Keeping and deleting information
Our planned retention schedule is below. Email is currently held in Google Workspace without automatic deletion rules. Applying the schedule requires regular manual reviews; adding this notice does not automatically delete existing emails or other records.
- General enquiries
- 12 months after the last correspondence.
- Unsuccessful private-hire enquiries
- 12 months after the last correspondence.
- Confirmed private-hire financial records
- 6 years from the end of the company financial year they relate to, subject to accountant confirmation and any requirement to keep them longer. This does not apply to every email about an event.
- Spam and unwanted enquiries
- Delete when resolved, within 3 months.
- Privacy request records
- 2 years after closure, keeping only what is needed to show how the request was handled.
- Booking diary
- Recommended: delete or securely dispose of personal booking details 3 months after the visit or cancellation, unless needed for an unresolved issue. This recommendation has not yet been confirmed as our current practice.
- CCTV
- Approximately 10 days, subject to system capacity and overwriting. Automatic overwriting has not yet been independently verified. Necessary incident footage may be preserved longer and reviewed until the incident, claim or investigation is resolved.
- Google Analytics
- Recommended: 14 months for user-level and event-level data. The current account setting has not been verified or changed. This control does not apply in the same way to standard aggregated reports.
Records needed for a legal obligation, unresolved complaint, incident or claim may be kept longer where necessary. We will limit this to the relevant information and review the reason. Provider logs, suppression records, backups and deleted-item recovery have separate arrangements; their full retention periods have not all been independently verified. Deleting from our working records does not promise immediate removal from every provider backup.
Your rights
Depending on the circumstances, you can ask for access to your personal information, correction, deletion, restriction, or portability of information processed by automated means on consent or contract grounds. You can object to processing based on legitimate interests, and withdraw analytics consent at any time. Rights have legal conditions and exemptions; we will explain if we cannot meet a request in full.
You do not need a special form. Email hello@thegreenbolly.com, call 01625 576 691, write to our business address or speak to us. We may need proportionate information to confirm identity and locate records. For CCTV, tell us the approximate date, time and location as soon as possible because routine footage is short-lived. Other people's images may need to be obscured before disclosure.
We respond without undue delay, normally within one calendar month. Where the law permits an extension or pause, we will explain it. Requests are normally free; a lawful fee or refusal may apply to manifestly unfounded or excessive requests. We do not make automated decisions with legal or similarly significant effects about customers.
Complaints
Please contact us if you have concerns. You can also complain directly to the Information Commissioner's Office, the UK data-protection regulator, or call 0303 123 1113. You do not have to contact us first to exercise that right.