Who we are
Common Table is a hospitality advisory platform for UK independent operators. For the purposes of UK data protection law, the data controller is Common Table Ltd, a company registered in England and Wales under company number 14275702, with its registered office at 2-8 Kingsgate Place, London NW6 4TA.
We are registered with the Information Commissioner's Office (ICO) under registration number 00014390227. Questions about this policy or your data can be sent to our privacy contact at info@commontable.uk.
The data we collect
We only collect data that we need to provide and improve the service. Depending on how you use Common Table, this may include:
| Category | Examples |
|---|---|
| Account data | Name, email address, password (stored only as a secure hash), access status. |
| Business data | Business name, business type, and the operational context you choose to share when asking a question. |
| Enquiry & advisory content | The messages, questions and documents you submit through our forms or 1:1 advisory. |
| Billing data | Purchase status and invoices. Card details are handled by our payment processor - we do not store full card numbers. |
| Usage data | Pages viewed, resources downloaded, approximate device and browser information, and IP address. |
| Communications | Records of correspondence with our team, and your marketing preferences. |
We do not intentionally collect special category data (such as health or political views). Please do not include such information in advisory enquiries unless it is strictly necessary.
How and why we use your data
We use your personal data to:
- Create and administer your account and membership.
- Provide the tools, templates, guides and 1:1 advisory you request.
- Take payment and manage your purchase and access.
- Respond to your enquiries and provide customer support.
- Send service messages about your account, security and changes to the service.
- Send you marketing about Common Table where you have agreed to receive it.
- Understand how the service is used so we can improve it and keep it secure.
- Meet our legal, accounting and regulatory obligations.
Our lawful bases for processing
Under the UK GDPR we must have a lawful basis for each use of your data. We rely on the following:
- Performance of a contract - to deliver the membership and services you sign up for.
- Legitimate interests - to run, secure, analyse and improve our service, and to send relevant business-to-business communications, provided your rights do not override these interests.
- Consent - for optional marketing and non-essential cookies. You can withdraw consent at any time.
- Legal obligation - to keep financial records and comply with applicable law.
Where we rely on legitimate interests, you can ask us for details of the balancing assessment we have carried out.
International transfers
We aim to keep your data within the UK or European Economic Area. Where a provider processes data outside the UK/EEA, we ensure appropriate safeguards are in place - such as an adequacy decision, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum. You can request a copy of the relevant safeguard by contacting us.
How long we keep it
We keep personal data only for as long as necessary for the purposes set out above. As a general guide:
- Account & business data - for the life of your membership and up to [e.g. 24 months] after it ends.
- Billing records - for at least 6 years, to meet UK tax and accounting requirements.
- Enquiry & advisory content - for [retention period], then deleted or anonymised.
- Marketing data - until you unsubscribe or withdraw consent.
When data is no longer needed we securely delete or anonymise it.
How we protect your data
We use appropriate technical and organisational measures to keep your data safe, including encryption in transit, access controls, hashed passwords and regular review of our security practices. No system is completely secure, but we work to protect your information and will notify you and the ICO of any breach where we are legally required to do so.
Your rights
Under the UK GDPR you have the right to:
- Be informed about how your data is used - that is the purpose of this policy.
- Access a copy of the personal data we hold about you.
- Rectification of inaccurate or incomplete data.
- Erasure of your data in certain circumstances ("right to be forgotten").
- Restrict our processing of your data in certain circumstances.
- Data portability - to receive your data in a structured, commonly used format.
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent at any time where we rely on it.
To exercise any of these rights, email info@commontable.uk. We will respond within one month and will not charge a fee in most cases. We may need to verify your identity first.
Children
Common Table is a business service intended for users aged 18 and over. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
Changes to this policy
We may update this policy from time to time to reflect changes in our service or the law. When we make material changes we will update the "last updated" date above and, where appropriate, notify you by email. Please review it periodically.
Contact and complaints
For any privacy question or request, contact our privacy team at info@commontable.uk or write to us at 2-8 Kingsgate Place, London NW6 4TA.
If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) - the UK supervisory authority - at ico.org.uk, by calling 0303 123 1113, or by writing to Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would, however, appreciate the chance to address your concerns first.