Privacy notice

Who we are

This website belongs to Maison Sorrel, run by Maison Sorrel, 4 Orchard Mews, London E8 1ZZ. We decide how the personal details you give us are used: in data protection law we are the controller.

The website and its ordering system are provided by GrowOrder, run by [Company name], company number [Company number], [Registered address]. GrowOrder looks after your details for us and uses them only on our instructions: it is our processor.

What we collect

• When you order: your name and phone number, your email address if you give it, your delivery address for a delivery, what you ordered, when, and how you said you would pay.
• Your order note, if you write one. A note can mention an allergy or a diet, which is information about your health: we use it only to prepare and hand over your order safely.
• If you create an account: your name, email address and phone number, your password (stored scrambled, so nobody can read it), your past orders and your loyalty points. If you sign in with Google, Google tells us your name and email address and an identifier for your Google account.
• If you send us a message through our contact form: your name, email address, phone number if you give it, and what you write.
• If you ask us for a table: your name, email address and phone number, the day, time and number of people, and any notes you add.
• For our news and offers: the email address and mobile number you gave when you ordered online or signed up, the words you were shown, where and when, and (after an order) which order it came from. If you ask us to stop, we keep only a scrambled copy of the address, so that we never add it back.
• For security: the internet (IP) address you use when you sign in or reset your password.

We do not take card details on this website. We do not collect anything about you from other sources, and we do not track you across other websites.

Why we use it

• To make and hand over your order, and to contact you about it (a confirmation email, a call if something is wrong). We need your details to do what you asked: our contract with you.
• To answer your message, if you write to us: by email, or by phone if you asked us to call.
• To answer your booking request: we email you when we confirm or decline it, and may call you about it.
• To send you our news and offers by email and text. If you order online, we tell you at checkout and you can say no there with one tick; if you don't, we may send you offers about our own food (UK law calls this the “soft opt-in”). If you sign up on this website, we send them because you ticked the box (and confirmed your email address): your consent. Either way you can stop at any time, with the stop link in every email and text, by writing to us, or in your account. Nobody else is sent your details for marketing.
• To run your account, so you can sign in and see your orders and points.
• To keep the website safe: spotting break-in attempts and stopping automated fake orders (a security check may appear at checkout). This is in our legitimate interests and yours.
• To fix problems: when something goes wrong, an error report is sent to our developers with personal details removed.

Apart from our news and offers (which you can stop at any time), we only send you emails about your orders, your bookings and your account. GrowOrder never markets to you.

Who else sees it

Our staff see your order so they can make it. GrowOrder and the companies it uses to run the website handle your details for us, under contracts that require them to keep them safe:

• [Database provider]: database (where orders and accounts are stored) ([Location]).
• [Hosting provider]: the server that runs the website ([Location]).
• [Network and storage provider]: network security, bot checks, photo storage and backups ([Location]).
• [Email provider]: sending order and account emails ([Location]).
• [Text message provider]: sending the restaurant's offer texts ([Location]).
• [Error reporting provider]: error reports, with personal details removed ([Location]).

If you sign in with Google, Google knows you used it to sign in here. We never sell your details or give them to anyone for their own marketing. We would share them with the police or other authorities only where the law requires it.

We keep your details in the UK and the EU where we can. Some of these services run worldwide networks, so your connection to this website can pass through their servers in other countries. Where details leave the UK, the law requires safeguards such as approved contract terms; we are confirming these with our solicitor.

How long we keep it

• Your name, phone number, email address and delivery address on an order: removed 12 months after the order. The order itself (what was bought and for how much) stays in our records without them.
• Your order note: removed 30 days after the order.
• A message you send through our contact form: deleted 12 months after it arrives.
• A booking request: deleted 12 months after it arrives.
• Your details for news and offers: until you stop them. From an order, they are deleted if you don't order online again for 24 months. A sign-up you never confirm is deleted after 7 days. When you stop, we keep only a scrambled copy of the address, so that a later order doesn't put you back on the list.
• Your account: until you ask us to delete it. If you do not sign in or order for 24 months, we email you, and delete it 30 days later unless you sign in.
• Internet addresses kept for security: removed after 90 days.
• Our backups, kept in case of a failure, can hold deleted details for up to 30 days. If a backup is ever restored, we delete them again.

Your rights

You can ask us to:

• give you a copy of the personal details we hold about you;
• correct details that are wrong;
• delete your details, or stop using them for a while;
• send your details to you or another organisation in a common format;
• stop using your details where we rely on our legitimate interests.

To ask, email [email protected] (GrowOrder answers these requests for us) or contact us at [email protected] or 020 7946 0958. It is free, and we reply within one month. We may ask you to confirm who you are first.

If you are unhappy with how we use your details, please tell us first. You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint (opens in a new tab) or 0303 123 1113.

Cookies and your device

This website keeps a few small things on your device so it works: your basket, your sign-in and the orders you are following. It uses no advertising or tracking cookies. The full list is in our cookie policy.

Changes to this notice

When we change how we use your details, we update this page and the date at the top. If a change matters to you, we will tell you before it applies.