Legal

Privacy Policy

Last updated: May 2026

Introduction

Humbeys Limited ("we", "us", "our") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store and protect personal information about you when you visit our website at humbeys.com, interact with us online, or visit us at our restaurant.

We are the data controller in respect of any personal data we hold about you. Please read this policy carefully to understand our practices regarding your personal data and how we will treat it.

This policy is written in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

Humbeys Limited is a burger restaurant based in Bradford, West Yorkshire.

Registered address:
158 Grattan Road
Bradford
BD1 2HS

Email: eat@humbeys.com
Website: humbeys.com

What personal data we collect

We may collect and process the following categories of personal data about you:

Information you provide directly to us

Email address — if you sign up via our website to receive opening updates or marketing communications.
Name and contact details — if you make a table reservation, place an order, or contact us directly by email, telephone or social media.
Enquiry details — if you contact us with a question, complaint or feedback.
Job application information — if you apply for a position with us, including your CV, covering letter, employment history and contact details.

Information collected automatically

Technical data — your IP address, browser type and version, operating system, and device information when you visit our website.
Usage data — information about how you use and interact with our website, including pages visited, time spent on pages and links clicked.
Cookie data — please see our Cookie Policy for full details of the cookies we use.

Information collected in our restaurant

CCTV footage — our restaurant premises are monitored by closed-circuit television (CCTV) for the security and safety of our customers and staff.
Payment information — when you pay by card, your payment is processed securely by our payment provider. We do not store your full card details.

Legal basis for processing your personal data

We will only process your personal data where we have a lawful basis to do so. The legal bases we rely on are:

Consent — where you have freely given your consent, for example when you sign up to receive marketing emails from us. You may withdraw your consent at any time.
Contract performance — where processing is necessary to perform a contract with you, for example to process your order or table reservation.
Legitimate interests — where processing is necessary for our legitimate business interests, such as security monitoring via CCTV, improving our website or processing job applications, provided those interests are not overridden by your rights and freedoms.
Legal obligation — where processing is required to comply with a legal obligation we are subject to, for example retaining financial records for HMRC.

How we use your personal data

We use the personal data we collect for the following purposes:

To provide you with updates about the Humbeys restaurant, including opening dates, first looks and launch announcements.
To process and manage table reservations and food orders.
To respond to your enquiries, comments and complaints.
To maintain the security and safety of our premises and our website.
To improve and develop our website, products and services.
To comply with our legal and regulatory obligations.
To consider your application if you have applied for a job with us.
To send you marketing communications where you have opted in to receive these.

Marketing communications

We will only send you marketing emails or other marketing messages where you have expressly opted in to receive them. You can withdraw your consent and opt out of receiving marketing communications from us at any time by:

Clicking the "unsubscribe" link included in any marketing email we send you.
Contacting us directly at eat@humbeys.com.

Once you opt out, we will stop sending you marketing communications. Please allow up to 14 days for opt-out requests to take full effect.

How we share your personal data

We do not sell, rent or trade your personal data to third parties for their own marketing purposes. We may share your personal data with the following categories of third parties:

Service providers and data processors — third parties who provide services on our behalf, such as website hosting (Netlify), email marketing platforms, payment processors and reservation management systems. These parties are only permitted to process your data on our instructions and are contractually required to keep it secure.
Professional advisers — solicitors, accountants and other professional advisers where reasonably necessary for our business operations.
Regulatory and law enforcement bodies — where we are required or permitted to do so by law, or where necessary to protect the rights, property or safety of our staff, customers or the general public.

Where we engage third-party processors, we ensure appropriate data processing agreements are in place to safeguard your personal data.

Data storage and security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction or alteration.

Email sign-up form submissions from our website are currently handled via Netlify Forms. Data is stored securely by Netlify in accordance with their own privacy and security policies. We will update this section as additional platforms are adopted.

Although we implement robust security measures, no method of transmission over the internet or electronic storage is completely secure. We therefore cannot guarantee the absolute security of your personal data.

International data transfers

Some of our third-party service providers may be based outside the United Kingdom. Where we transfer your personal data outside the UK, we ensure that appropriate safeguards are in place in accordance with UK GDPR requirements, such as relying on the UK's adequacy regulations or using standard contractual clauses approved by the UK Information Commissioner's Office.

How long we keep your data

We will only retain your personal data for as long as is necessary for the purposes for which it was collected. Our general retention periods are:

Marketing email addresses — retained until you unsubscribe or request deletion, after which we will delete your data within a reasonable period.
Customer enquiry and correspondence records — retained for up to 3 years from the date of last contact.
CCTV footage — typically retained for up to 31 days, unless footage is required in connection with a specific incident or legal matter.
Financial and transaction records — retained for 7 years as required by HMRC regulations.
Unsuccessful job applications — retained for up to 6 months following the conclusion of the relevant recruitment process, unless you consent to longer retention.

When personal data is no longer required, it is securely deleted or anonymised.

Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

Right of access — you have the right to request a copy of the personal data we hold about you (commonly known as a Subject Access Request).
Right to rectification — you have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
Right to erasure — you have the right to request that we delete your personal data in certain circumstances (the "right to be forgotten").
Right to restriction of processing — you have the right to request that we restrict how we process your personal data in certain circumstances.
Right to data portability — you have the right to receive your personal data in a structured, commonly used and machine-readable format, and to request that we transfer it to another data controller, in certain circumstances.
Right to object — you have the right to object to our processing of your personal data where we rely on legitimate interests, and to object to direct marketing at any time.
Rights relating to automated decision-making — you have the right not to be subject to decisions made solely on the basis of automated processing that significantly affect you. We do not currently carry out such processing.

To exercise any of these rights, please contact us at eat@humbeys.com. We will respond to all valid requests within one calendar month. There is no charge for making a request, but we may charge a reasonable fee or refuse a request if it is manifestly unfounded or excessive.

Your right to complain

If you have any concerns about how we handle your personal data, please contact us in the first instance at eat@humbeys.com so that we can try to resolve the matter promptly.

You also have the right to lodge a complaint with the UK's supervisory authority for data protection:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline: 0303 123 1113
Website: ico.org.uk

Cookies

Our website uses cookies and similar technologies. For full details of the cookies we use and how to manage your preferences, please see our Cookie Policy.

Links to third-party websites

Our website may contain links to third-party websites, social media platforms and other external services. This Privacy Policy does not apply to those websites. We are not responsible for the privacy practices of third parties and we encourage you to read the privacy policies of any external sites you visit.

Children's privacy

Our website and online services are not directed at children under the age of 13. We do not knowingly collect personal data from children under the age of 13. If you believe we have inadvertently collected such information, please contact us immediately at eat@humbeys.com and we will take prompt steps to delete it.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services or legal obligations. We will post the updated policy on this page with a revised "Last updated" date. Where changes are material, we will take reasonable steps to notify you. We encourage you to review this policy periodically.

Contact us

If you have any questions, concerns or requests relating to this Privacy Policy or the way we handle your personal data, please contact us:

Humbeys Limited
158 Grattan Road
Bradford
BD1 2HS

Email: eat@humbeys.com