Privacy Policy

Effective: 23 April 2026

Guestwork Limited provides restaurant booking software that helps venues manage reservations, tables, floorplans, guest records, staff views, and everyday service operations. This policy explains what data we collect, how we use it, who we share it with, how long we keep it, and the choices available to you.

1. Roles: controller vs processor

For website visitors, demo enquiries, and direct communications with Guestwork, Guestwork Limited acts as the data controller.

For venue data entered into Guestwork by a restaurant, cafe, bar, or private dining venue, the venue is normally the controller and Guestwork Limited acts as a processor. This includes booking, guest, staff, table, floorplan, and operational data processed under the venue's instructions.

2. Data we collect

From website visitors and demo enquiries

Contact details, such as name, email address, phone number, venue name, and role.
Demo request details, such as current booking system, preferred demo time, and message content.
Basic request data, such as IP address, user-agent, URLs visited, and short-lived server logs.

From venue customers and staff users

Account data, such as name, work email address, role, venue, preferences, and access permissions.
Venue data, such as room areas, floorplans, tables, capacities, opening times, service periods, and venue settings.
Usage and diagnostic data, such as log lines, error reports, audit events, status changes, and activity records.

From guests, processed on behalf of a venue

Booking data, such as name, contact details, date, time, party size, table assignment, booking status, and special requests.
Guest records, such as preferences, notes, visit history, allergies, birthdays, and hospitality information entered by the venue.
Communication and operational data, such as cancellation notes, no-show records, audit events, and staff updates.

3. How we use data

To respond to enquiries and arrange demos.
To authenticate users and protect accounts.
To deliver the core product, including reservations, table allocation, floorplans, staff views, guest records, and booking management.
To provide customer support, service updates, product testing, and operational communications.
To monitor the service for abuse, fraud, security issues, outages, and errors.
To improve the product in aggregate, for example by understanding feature usage and performance.
To comply with legal obligations and enforce our terms.

4. Legal bases

Our legal bases may include performance of a contract, legitimate interests in operating and improving Guestwork, compliance with legal obligations, and consent where specifically requested. Where a venue controls guest or staff data, the venue is responsible for identifying its lawful basis.

5. AI processing and automation

Guestwork may introduce AI-assisted or automation features in future, such as drafting service notes, summarising booking records, or assisting with staff workflows. If we use third-party AI providers for personal data, we will limit the data sent to what is needed, update this policy where appropriate, and apply contractual and technical safeguards.

Guestwork does not sell personal data and does not use venue guest records for third-party advertising.

6. Sub-processors and third parties

We may use service providers for hosting, database services, backups, email, security, analytics, monitoring, customer support, payment processing, and related operations. We only share data as needed to provide and protect the service.

We will update our documentation when material sub-processor arrangements change. We do not sell personal data or share it with third parties for their own advertising purposes.

7. Data retention

Demo enquiries are kept for as long as needed to respond, follow up, and manage the relationship.
Venue account data is retained while the account is active and for a reasonable period afterwards for legal, security, and business records.
Booking and guest data is retained according to the venue's settings, instructions, agreement, and applicable legal obligations.
Server logs are kept for a limited period for security and diagnostics unless needed for investigation.
Backups may retain deleted records until they expire through normal backup rotation.

8. Your rights

Depending on your location and the circumstances, you may have rights to access, correct, delete, restrict, object to processing, request portability, withdraw consent, or complain to a supervisory authority.

If you are a guest of a restaurant using Guestwork, we may need to refer your request to the restaurant because the restaurant is normally the controller of your booking and guest record data. If your request relates to a demo enquiry or direct communication with Guestwork, email hello@guestwork.co.uk.

9. International transfers

Some service providers may process data outside the UK or European Economic Area. Where required, we use appropriate safeguards such as adequacy regulations, standard contractual clauses, or the UK international data transfer addendum.

10. Cookies and local storage

Guestwork uses minimal cookies and local storage where needed for website operation, security, session management, preferences, and diagnostics. More information is available in our Cookie Policy.

11. Security practices

We use reasonable technical and organisational measures to protect personal data, including access controls, secure hosting practices, HTTPS where services are exposed online, monitoring, and backup practices. More information is available on our Security page.

12. Children

Guestwork is not directed at children under 16, and we do not knowingly collect personal data from children through our website or demo forms.

13. Changes to this policy

We may update this policy from time to time. When we do, we will update the effective date. Material changes may be announced by email, in-product notice, or website notice where appropriate.

14. Contacting us

For privacy questions, data subject requests, or security reports, email hello@guestwork.co.uk.