Privacy policy

Last updated: 5 August 2026

Florence & Amelia's Limited respects your privacy. This notice explains how we use personal information when you visit our website, place an order through Shopify or Lightspeed Order Anywhere, book a table through simpleERB, buy an event ticket, join our mailing list, contact us or visit our premises.

Who we are

Florence & Amelia's Limited is the controller responsible for the personal information described in this notice.

Company number: 12502288
Address: 17 Corporation Street, Stalybridge, SK15 2JL, United Kingdom
Email: info@florenceandamelias.co.uk
Telephone: 0161 637 1830

Information we collect

Depending on how you deal with us, we may collect:

your name, email address, telephone number, billing or delivery address and account details;
order, payment-status, delivery, collection, booking and event-attendance details;
communications, complaints, refund requests and customer-service records;
marketing preferences and information about your interaction with our emails;
device, browser, IP address, cookie identifiers, pages viewed, referring source and website interactions;
dietary requirements, allergy information, accessibility needs or other information you choose to provide;
information about another attendee, including a child, where a responsible adult makes a booking on their behalf; and
CCTV images recorded at our premises for security and incident investigation.

We do not receive or store your complete payment-card details. Payments are handled by the payment provider used at checkout.

How and why we use information

Orders, bookings and events: to take payment, prepare and fulfil orders, administer reservations and tickets, provide service messages and deal with cancellations or refunds. We do this because it is necessary to perform our contract with you or take steps at your request before entering into a contract.
Food safety, dietary and accessibility needs: to understand and, where reasonably possible, accommodate information you choose to provide. Contract is our usual lawful basis. Where the information reveals health data, we also rely on your explicit consent. You may withdraw that consent, but we may then be unable to safely accommodate the request.
Customer service and business protection: to answer enquiries, resolve disputes, prevent fraud, enforce our terms and establish or defend legal claims. We rely on contract, legal obligation and our legitimate interests in operating and protecting the business.
Legal and accounting records: to meet tax, licensing, food-safety, consumer-protection and other legal obligations.
Marketing: to send marketing by email only where you have consented or where the law permits us to contact an existing customer about similar services and we offered an opt-out. You can unsubscribe at any time.
Website operation and measurement: to keep the website secure, remember essential choices, measure performance and understand how the site is used. Essential processing is based on contract or legitimate interests. We use consent for non-essential analytics and advertising cookies or pixels.
CCTV: to deter and investigate theft, damage, violence and other security incidents. We rely on our legitimate interests in protecting customers, staff and property and, where relevant, establishing or defending legal claims.

Dietary and allergy information

Allergy information can reveal health data and receives additional protection. Please provide only information needed for the order or booking. If you provide such information about another person, you confirm that you are authorised to do so and have explained how it will be used.

Submitting health-related dietary or accessibility information means that you explicitly consent to us using it to assess and accommodate the request, sharing it only with staff and service providers who need it for that purpose, and retaining it as described below. Consent can be withdrawn by contacting us, without affecting processing already carried out.

Who receives information

We share only what is reasonably necessary with:

Shopify, which hosts our online store and supports checkout, payments, fraud prevention, accounts and analytics;
Lightspeed, which provides our point-of-sale system, Order Anywhere ordering and online payment services;
simpleERB, which provides table-booking and reservation-management services;
PosterMyWall, which we use to manage marketing emails;
payment processors, banks and fraud-prevention providers;
Meta, Shopify analytics and, where enabled and consented to, Google analytics or similar measurement providers;
our staff, professional advisers, insurers, technology support and public authorities where required by law; and
a buyer or successor if our business or assets are reorganised or sold, subject to appropriate safeguards.

Lightspeed may also process information as an independent controller when a customer interacts directly with Order Anywhere or its payment services. Its own privacy information is available through the Lightspeed service. Shopify may act as our processor and, for some optional consumer or enhanced services, as an independent controller under its own privacy notice.

Google, Tripadvisor and other review sites are independent services. Information you publish there, such as your display name, rating and review, may be visible to us and to the public. We may read and respond to reviews on the basis of our legitimate interests in customer service and managing our reputation, but the platform controls its own collection and use of your information and its privacy notice also applies.

Cookies, analytics and advertising

Our website uses essential cookies needed for functions such as security, privacy choices, the basket and checkout. With your consent, it may also use analytics and marketing technologies, including Shopify analytics and the Meta/Facebook pixel, to measure visits and advertising performance and, where enabled, support relevant advertising.

You can accept, reject or change non-essential cookie choices using the privacy or cookie controls on the website. You can also use browser controls, although blocking essential cookies may stop parts of the site from working. Withdrawing consent does not make earlier processing unlawful.

International transfers

Some providers may process information outside the United Kingdom. Where UK data-protection law requires it, we use providers that rely on an adequacy regulation or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum to approved standard contractual clauses. You can contact us for more information about relevant safeguards.

How long we keep information

We keep personal information only for as long as needed for the purpose collected, including:

order, payment, refund and accounting records: generally 6 years from the end of the financial year to which they relate;
table-booking records: generally 12 months after the booking;
event attendance and operational dietary information: generally 30 days after the event or fulfilment, where it can be separated from the transaction record;
health-related details that remain within a transaction record: restricted and retained no longer than the related record requires;
customer-service and complaint records: generally 2 years after resolution, or longer where a legal claim reasonably requires it;
marketing contacts: until you unsubscribe or after 24 months without engagement; we may retain a minimal suppression record so that we honour an opt-out;
CCTV: generally up to 30 days, unless footage is required to investigate an incident or establish or defend a legal claim; and
cookie and analytics identifiers: for the period described in the relevant cookie control or provider information.

We may keep information longer where law requires it, a dispute is ongoing, or it is needed to establish, exercise or defend legal claims. We securely delete or anonymise information when it is no longer required.

Your rights

Depending on the circumstances, you may have the right to ask us for access to your personal information, correction, deletion, restriction, portability, or to object to processing based on legitimate interests. You may withdraw consent at any time. You also have an absolute right to object to direct marketing.

To exercise a right, email info@florenceandamelias.co.uk. We may ask for information needed to verify your identity. There is normally no fee, and we normally respond within one month.

Complaints

Please contact us first so we can try to resolve your concern. You may also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or telephone 0303 123 1113.

Changes to this notice

We may update this notice when our services, providers or legal obligations change. We will publish the current version here and update the date above. If a change materially affects how we use existing information, we will provide an additional notice where appropriate.