Privacy Policy
Last updated: 17 October 2026
Who we are
- Business
- VA Cube EateryVza
1Introduction
This policy explains what personal data VA Cube EateryVza (“we”, “us”, “our”) collects through this website and at the venue, why, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2Data controller
VA Cube EateryVza is the data controller responsible for your personal data. Please speak to a member of our team at the venue.
3What data we collect
3.1 Data you provide directly
- Order information: Name, email address, phone number, delivery address, order notes, and dietary/allergy requirements.
- Account information: Name, email, phone number when you create an account or choose to save your details when you order.
- Payment data: Payment card details are processed securely by Stripe and are never stored on our servers.
- Communications: Any messages or feedback you send to us.
- Saved addresses: Delivery addresses you save in My Account.
- Table and game bookings: Your name, contact details, the date, time and party size, and any notes you add.
- Private hire: Your contact details, event details and the electronic signature you give when you accept the hire terms.
- Gift cards: The buyer's name and email, and the recipient's name, email and any message you add.
- Loyalty: The points you earn and your rewards tier.
- Competition entries: Your name, contact details and the competition you enter.
- AI waiter chats: The messages you send to the AI waiter on our menu, if you choose to use it.
3.2 Data collected automatically
- Device and usage data: IP address, browser type, operating system, pages visited, and interaction data.
- Cookies and similar technologies: See our Cookie Policy for details.
- Marketing attribution: UTM parameters and referral source to understand how you found us.
4How we use your data
We use your personal data for the following purposes:
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Processing and fulfilling your orders | Performance of a contract (Art. 6(1)(b)) |
| Sending order confirmations and updates | Performance of a contract (Art. 6(1)(b)) |
| Managing your account | Performance of a contract (Art. 6(1)(b)) |
| Improving this website and user experience | Legitimate interest (Art. 6(1)(f)) |
| Analytics and understanding usage patterns | Consent, given by accepting analytics cookies (Art. 6(1)(a)) |
| Sending marketing communications (with consent) | Consent (Art. 6(1)(a)) |
| Complying with legal obligations (for example food safety and tax) | Legal obligation (Art. 6(1)(c)) |
| Allergy and dietary needs you tell us about, so we can prepare your food safely | Your explicit consent, which you give when you tell us (Art. 9(2)(a)). You can withdraw it at any time, but we may then be unable to cater for your needs. |
5Who we share your data with
We use these service providers. They process your data only on our behalf and only for the purpose given:
- Salstead Ltd: supplies and hosts the VenueOS ordering platform this website runs on.
- Stripe: processes card payments. Stripe Privacy Policy.
- Supabase: stores our database.
- Vercel: hosts this website.
- Resend: sends our emails, such as order and booking confirmations.
- Twilio: sends text messages to your phone, such as sign-in codes and order updates.
- Sentry: records technical errors so we can fix them.
- Anthropic: powers the AI waiter, only if you use it.
- Google Maps: shows the map on our pages.
- Google Analytics: only if you accept analytics cookies. It records pages visited and device details against a random ID.
- Meta: only for staff social posting. No customer data is shared.
We also share your data with:
- Delivery drivers: If you place a delivery order, your name, address, and phone number are shared with the delivery driver.
- Legal and regulatory authorities: Where required by law.
We do not sell your personal data to third parties.
6Data retention
- Order and financial records: Kept for six years for tax and accounting purposes.
- Account data: Kept until you delete your account or ask us to delete it.
- Analytics data: Kept for no longer than 14 months.
- Marketing consent: Kept until you withdraw consent.
- Everything else (such as bookings, private hire records, gift cards and AI waiter chats): kept for as long as needed to provide the service, then deleted or anonymised.
7International transfers
Some of our service providers may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place, including Standard Contractual Clauses or adequacy decisions, in accordance with UK GDPR requirements.
8Your rights
Under UK GDPR, you have the following rights:
Right to access
Request a copy of the personal data we hold about you.
Right to rectification
Request correction of inaccurate data.
Right to erasure
Request deletion of your data (subject to legal retention requirements).
Right to restrict processing
Request that we limit how we use your data.
Right to data portability
Request your data in a machine-readable format.
Right to object
Object to processing based on legitimate interests or direct marketing.
Right to withdraw consent
Where processing is based on consent, you may withdraw it at any time.
To exercise any of these rights: Please speak to a member of our team at the venue. You can also delete your account yourself in My Account. We will reply within one month.
When an account is deleted, your order records are anonymised rather than deleted, so they stay in our accounts.
9Data security
We implement appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS/TLS), secure authentication and role-based access controls.
10Children's privacy
This website is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child, please contact us and we will delete it promptly.
11Changes to this policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date.
12Complaints
If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office
Website: ico.org.uk|Helpline: 0303 123 1113
13Contact us
For any privacy-related questions or to exercise your rights: Please speak to a member of our team at the venue.