The Cottage at Royal Terrace privacy policy

5 October 2026

This policy explains how we collect and use personal information when you visit our website, make a reservation, dine with us, contact us or subscribe to our news. It covers our guests and website visitors. Staff and recruitment information is covered separately.

Who we are

The Cottage at Royal Terrace is operated by Grilo LTD, trading as The Cottage at Royal Terrace. This operator is the controller responsible for the personal information described in this policy.

Contact us about privacy or your information:
Email: hello@thecottageedinburgh.com
Post: The Cottage at Royal Terrace, 1 Royal Terrace Gardens, Edinburgh, EH7 5DX

Information we collect and where it comes from

We collect information you give us through reservations, enquiries, newsletter sign-ups, purchases, emails, telephone calls, social media messages and conversations with our team. We may also receive booking details from OpenTable or someone making a reservation on your behalf.

Depending on your interaction with us, this can include your name, email address, telephone number, booking date and time, party size, dining preferences, special requests, visit history, correspondence and feedback. For payments or purchases, we may receive billing details, transaction amounts, payment status and transaction references from our payment providers.

If you choose to tell us, we may collect allergy, dietary or accessibility information needed for your visit. Please provide only what we need. If booking for someone else, share this policy with them and ask them to contact us directly about sensitive information where possible.

Our website and service providers may collect technical information such as IP address, browser and device information, pages visited and cookie preferences. The cookies section explains the choices available.

How and why we use your information

Reservations and purchases — we use contact, booking and transaction details to arrange your visit, administer purchases, take payments and send service messages. Our lawful basis is taking steps at your request before entering a contract or performing our contract with you. Where another person makes the booking, we may rely on our legitimate interest in organising the group’s visit.

Enquiries and service — we use correspondence and relevant visit information to answer questions, resolve complaints and improve our service. We rely on our legitimate interests in running the restaurant, looking after guests and resolving issues, taking account of your rights and reasonable expectations.

Accounts and legal requirements — we use relevant transaction and business records to meet tax, accounting and other legal obligations. Where necessary, we also use records for our legitimate interests in preventing fraud and establishing, exercising or defending legal claims.

Newsletters and offers — we use your name, email address and marketing preferences with your consent to send news, menus, events and offers. Our draft policy is to send these emails only to people who have opted in. You can unsubscribe using the link in any marketing email or contact us. Withdrawing consent does not affect processing that was lawful before withdrawal.

Website operation — we use necessary technical information for our legitimate interests in maintaining and securing our website. We ask for consent before using optional analytics or advertising cookies and associated personal information under the approach described below.

You do not have to subscribe to marketing to book or dine with us. We still send essential booking and purchase messages. If you do not provide information needed to arrange a booking or purchase, we may be unable to complete it.

Allergies and other sensitive information

Allergy and accessibility information may reveal health information. Some dietary requests may reveal religious beliefs. These types of information receive additional protection under data protection law.

Where we need to record or share this information to prepare for your visit, we ask for your explicit consent. We rely on consent as our lawful basis and explicit consent as our special category condition. We limit access to the team members and service providers who need it to manage your requirements.

You can withdraw your consent by contacting us. This may limit our ability to accommodate a particular request, which we will discuss with you. Simply reading this policy does not give us consent. If information is necessary for a legal claim or another legally permitted purpose, we will retain or use it only where the relevant legal conditions are met.

Who we share information with

We share relevant information with suppliers who help us provide our services. Our proposed supplier list is OpenTable for reservations, Squarespace for our website and forms, and MailerLite for newsletters and SKChase for sale of gift vouchers. We also use email and IT providers, accountants, professional advisers and insurers where needed.

Suppliers acting on our behalf receive instructions and appropriate contractual requirements to protect information. Some providers, including booking and payment platforms, may also act as separate controllers for their own services. Their privacy notices explain those uses. We may disclose information to authorities where required by law, or where necessary and lawful to protect rights and deal with claims. We do not sell your personal information.

How long we keep information

We keep information only for as long as needed for the purpose collected, including applicable legal requirements. We then delete it or make it anonymous. Different records have different retention periods:

Booking records and routine enquiries: 12 months after the visit or final contact.

Allergy and accessibility notes: 12 months after visit

Marketing records: until you unsubscribe or our inactivity review identifies that they should be removed. We keep a minimal suppression record for as long as needed to honour an opt-out, and proportionate evidence of consent.

Complaints and disputes: until resolved and for any further period reasonably necessary for applicable legal claims. 3 months

Website and cookie records: for the periods disclosed in our cookie information.

A specific legal obligation or active dispute may require us to keep relevant records longer. Access is restricted and we do not retain unrelated information for that reason.

Your rights and choices

Depending on the circumstances, you can ask to access your information, correct inaccurate information, erase information, restrict how it is used, or receive certain information in a portable format. You can object to processing based on legitimate interests. You have an absolute right to object to use of your information for direct marketing and can withdraw consent at any time.

Contact hello@thecottageedinburgh.com to exercise your rights. We may ask for proportionate information to verify your identity. We normally respond within one month, subject to any legally permitted extension or pause. These rights have exceptions, which we will explain if relevant.

Questions and complaints

If you have a concern, please contact us using the details above so we can investigate and respond. You also have the right to complain to the Information Commissioner’s Office, the UK data protection regulator, at ico.org.uk/make-a-complaint/ or by calling 0303 123 1113.

Changes to this policy

We review this policy when our practices or legal requirements change. The current version will be available on our website with its last updated date. Where required, we will bring significant changes to your attention.

Guidance used

ICO guidance checked on 5 October 2026. Relevant guidance includes privacy notice content, special category information, electronic mail marketing, cookies and international transfers.

Privacy notices: https://ico.org.uk/for-organisations/advice-for-small-organisations/privacy-notices-and-cookies/create-your-own-privacy-notice/

Special category information: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/

Marketing and cookies: https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/

International transfers: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/