Privacy policy

Last updated: 26 October 2026

This privacy policy explains how The Suya Factory Limited ("The Suya Factory", "we", "us", "our") collects, uses and protects your personal data when you visit our restaurant, use our website www.thesuyafactory.com, book a table, order food or products, enquire about catering, or contact us. We handle your data in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

1. Who we are

The Suya Factory Limited is the data controller responsible for your personal data.

  • Company number: 11503318 (registered in England and Wales)
  • Registered office: 8 Starboard Crescent, Chatham, Kent, ME4 4FZ
  • Restaurant and trading address: Unit 2C, Pier 5, The Quays, Dock Head Road, St Mary's Island, Chatham, Kent, ME4 4ZJ
  • Email: info@thesuyafactory.com
  • Telephone: 020 3488 9204

If you have any questions about this policy or how we use your data, please contact us using the details above.

2. The personal data we collect

  • Identity and contact details: name, email address, telephone number, delivery and billing address.
  • Booking information: date, time, party size, table preferences, special requests and any deposit paid.
  • Order and transaction details: items ordered, prices, order history, collection or delivery details. Card payments are processed securely by our payment providers; we do not see or store your full card number.
  • Catering and event enquiries: event date, venue, guest numbers, menu choices, quotes and invoices.
  • Dietary and allergy information: if you choose to tell us about an allergy or dietary requirement, we use it only to prepare your food safely. Where this relates to your health, we process it with your explicit consent, which you give by providing it.
  • Communications: messages, emails, reviews, social media messages, feedback and complaints.
  • Marketing preferences: whether you have agreed to receive marketing from us.
  • Technical and usage data: IP address, browser and device type, pages visited, referring website and similar information collected through cookies and similar technologies (see section 8).
  • CCTV images: we operate CCTV in and around our restaurant for the safety and security of customers and staff, crime prevention and food safety. Signs are displayed on site.

We do not knowingly collect personal data from children under 13. Bookings and orders for children should be made by a parent or guardian.

3. How we use your data and our lawful bases

  • To take and manage bookings, orders, deliveries, catering and events, including taking deposits and payments and sending confirmations and reminders. Lawful basis: performance of a contract with you.
  • To handle allergy and dietary requests. Lawful basis: your explicit consent.
  • To respond to enquiries, feedback and complaints. Lawful basis: our legitimate interests in providing good customer service, or performance of a contract.
  • To send you news, offers and promotions by email or text. Lawful basis: your consent. You can unsubscribe at any time using the link in our messages or by contacting us.
  • To run, secure and improve our website, and to measure and show relevant advertising on platforms such as Facebook, Instagram, Google, TikTok and Pinterest. Lawful basis: your consent for non-essential cookies, and our legitimate interests for essential site operation and security.
  • To operate CCTV. Lawful basis: our legitimate interests in keeping people and property safe, preventing crime and meeting food safety standards.
  • To keep accounts and records and meet our legal obligations, for example tax, licensing, food safety and responding to lawful requests from authorities. Lawful basis: legal obligation.
  • To check age when selling alcohol (we operate Challenge 25). Lawful basis: legal obligation.

4. Who we share your data with

We never sell your personal data. We share it only with trusted service providers who help us run our business and act on our instructions, including:

  • Shopify (website hosting and online shop) and our payment providers, including Shopify Payments, PayPal, Klarna, Apple Pay and Google Pay;
  • our table booking, till and ordering systems (including SimpleERB, Epos Now and Deliverect);
  • delivery partners such as Uber Direct and Uber Eats, and Royal Mail or other couriers for shop orders;
  • email, form and IT providers (including Microsoft 365 and website form tools);
  • advertising and analytics platforms (Meta, Google, TikTok and Pinterest), only where you have accepted the relevant cookies;
  • our accountants and professional advisers, insurers, and the police, local authority or other regulators where we are legally required or permitted to share information.

5. International transfers

Some of our providers are based outside the UK, for example in the United States or the European Economic Area. Where your data is transferred outside the UK, we make sure it is protected by an adequacy decision (such as the UK-US Data Bridge), the UK International Data Transfer Agreement or Addendum, or other safeguards approved under UK law.

6. How long we keep your data

  • Orders, payments and invoices: 6 years, to meet tax and accounting rules.
  • Table bookings: up to 2 years after your booking.
  • Catering and event records: 6 years after the event.
  • Enquiries and complaints: up to 2 years after we last hear from you.
  • Allergy information given with a booking or order: no longer than needed for that booking or order.
  • Marketing data: until you unsubscribe or ask us to stop.
  • CCTV footage: normally up to 30 days, unless needed to investigate an incident or claim.

7. Your rights

Under UK data protection law you have the right to:

  • ask for a copy of the personal data we hold about you;
  • ask us to correct inaccurate or incomplete data;
  • ask us to delete your data;
  • ask us to restrict how we use your data;
  • object to us using your data, including for direct marketing;
  • ask for your data to be transferred to you or another organisation (data portability);
  • withdraw your consent at any time, where we rely on consent.

To make a request, email info@thesuyafactory.com. We will respond within one month. There is normally no charge.

If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.

8. Cookies and similar technologies

Cookies are small files placed on your device when you visit a website. We use:

  • Strictly necessary cookies that make the website work, such as keeping items in your basket, completing checkout and remembering your cookie choices. These cannot be switched off.
  • Analytics cookies that help us understand how visitors use our website so we can improve it.
  • Marketing cookies and pixels from Meta (Facebook and Instagram), Google, TikTok and Pinterest that help us measure our adverts and show you relevant ads on those platforms.

We only use analytics and marketing cookies if you agree to them through our cookie banner. You can change your choice at any time through the cookie banner or by clearing cookies in your browser. Our full Cookie Policy gives more detail.

9. Security

We use appropriate technical and organisational measures to protect your personal data, including secure payment processing, restricted access to systems and staff training. No method of sending data over the internet is completely secure, but we work hard to protect your data.

10. Links to other websites

Our website may link to other sites, such as social media or delivery platforms. Those sites have their own privacy policies and we are not responsible for them.

11. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the date it was last updated.