Who we are
Mills Hill Developments Limited (company number: 08811180) of 52 King Street, Manchester M2 4LY, is a hospitality company running a number of venues, including:
El Gato Negro Tapas (King Street, Manchester; Exchange Flags, Liverpool; Park Row, Leeds)
Canto (Henry Street, Manchester)
Habas (Brown Street, Manchester)
Your personal information will be collected by Mills Hill Developments Limited (unless stated otherwise in this policy), as a parent company of all listed trading operations above. You will only receive communications from the venue whose mailing list you have signed up to, not from all companies under the Mills Hill Developments Limited umbrella, unless you specifically opted in to communications from MHDL.
Mills Hill Developments Limited is registered at the address above, with direct contact available at our Head Office, details being as follows:
El Gato Negro, 52 King Street, Manchester M2 4LY
0161 694 8585
For clarity, Mills Hill Developments Limited, will from here onwards be referred to as MHDL.
MHDL takes your privacy very seriously and is committed to protecting your personal information.
Please note that the website and other digital platforms MHDL provides may contain links to third party websites / digital platforms which are provided for your convenience. We are only responsible for the privacy practices and security of our website and our own digital platforms. MHDL recommends that you check the privacy and security policies and procedures of each and every other website / digital platform that you visit.
How to contact us
If you have any questions about the information we hold on you, our designated compliance team can be contacted via email at firstname.lastname@example.org, via post at:
El Gato Negro, 52 King Street, Manchester M2 4LY
0161 694 8585
Information we collect about you, how we use your information and our lawful basis for doing so
The table below sets out details of when you may provide personal information to MHDL, what personal information you will provide, how MHDL will use such personal information and our lawful basis for such use. Please also see CCTV and Cookies below:
|Method||What data||How we use data||Our basis for use|
|Submitting an enquiry to the website, via phone or email||Name, Email Address, Phone Number, D.O.B and any other personal information you may share with MHDL||To respond and deal with your query. All personal data will be stored via a secure server and accessed only by authorised personnel.||Our basis for use of your personal data in this way is to have the means of contact to fulfil your specified query.|
|Booking a table at the venue using the website, by phone or email or in person||Name, Email Address, Phone Number and any other personal information you may provide with MHDL as part of your booking||To process and confirm your booking, and as a form of contact relating to said booking. All personal data will be stored via a secure server and accessed only by authorised personnel. Data will only be used in conjunction with your booking, and not as a form of marketing, unless specifically opted-in to accept such marketing information.||Our basis for use of this data in this way is to be able to process and confirm your booking as you requested.|
|Signing up to the venue’s mailing list||Name, Email Address, Phone Number and any other personal information you may provide with MHDL as part of your opt-in to the mailing list||To send you the latest news, offers and events, relating to the venue and any other venues in the group you registered an interest with.||We will only send you marketing communications, if you opt-in consent.|
|Offering card details in order to confirm a booking, when required||Name, credit/debit card details||To hold in a secure server, and only to use in the event of a no-show or cancellation with less than 24 hours notice (as per booking T’s&C’s) Data is never accessed or viewed by internal venue staff. All data held and controlled by Stripe Inc. (see Disclosure below), who are issued to charge in the events listed above.||To be able to secure bookings when requested, as per our bookings terms and conditions, and as per our bookings policy.|
|Sending your CV in relation to a job application||All personal information held on your CV (Including but not limited to Name, Address, phone number, email address)||To assess your suitability for an advertised job role, and to contact you where relevant in order to discuss said job application.||To be able to assess your suitability for an advertised job role, and contact you for more information where necessary.|
Monitoring and CCTV
Please note that for your safety and security, CCTV is in operation in all of our premises which are open to the public (both inside and at the entrance(s) to and in any outdoor areas of the venue).
Such CCTV footage is retained for up to 30 days following initial collection, and may be shared with the police or other relevant crime-fighting agencies following a substantiated request.
There may be photographers present at our venues from time to time and we may display images captured by said photographer on our website or other digital marketing channels. If you are included in any photograph and object to this being on our website or other digital marketing channels (or MHDL retaining this) please contact us using the details set out in the policy and MHDL will arrange for the relevant photograph to be removed.
Job Applications: CV’s
MHDL offers a direct contact form via each specific venue website, to be able to apply for advertised employment roles. These forms include the opportunity to include/attach a copy of your personal CV for reference. All CV’s MHDL receives (including those accepted via third party sites such as indeed.com), are subject to the terms of retention set out as follows:
- All electronic CV’s are collected and stored via a secure email server, with designated access, as listed in internal company documentation.
- All physical CV’s are stored internally according to the same policy and documentation, and are accessible only to those designated.
- If an application is successful, both electronic and physical CV’s will be held for a period as such determined by the interview process. If an interview process is successful, and an applicant is hired, CV’s may then be kept for record, and will fall under internal Employee data policies.
- If an application is unsuccessful, or if an applicant is not considered for a role, CV’s will be kept for a maximum period of 6 months, upon which electronic data and physical data will be destroyed.
- CV’s and application data will never be shared with third parties, and will only be used for the purpose of which it was intended. Personal data gathered via applications will never be used for marketing purposes.
Retention: how long we store your personal information
MHDL stores the different types of personal information we hold for different periods depending on why and how MHDL is holding and using such data. Our retention periods are as follows:
- where we are holding your personal information on our mailing database or as part of our loyalty schemes, for so long as you wish to continue to be part of our mailing list or loyalty scheme (as applicable) or if you have not engaged with us (made an enquiry, reservation, opened an email, clicked-through from an email, used your loyalty card etc.) for 24 months. Even if we no longer send mailings to you or remove you from our loyalty scheme, we may keep your name and email address on a separate repression list for a number of years following this for the purpose of ensuring that our mailings are not inadvertently shared with you.
- where we are holding your personal data to enable us to carry out a reservation for 6 months following the date such reservation has been completed (i.e. the date on which your table is booked with us), unless you have chosen to join our mailing list (in which case the personal data will be held for so long as you wish to be part of our mailing list).
- where we are holding your personal data for payment processing reasons (such as to confirm a booking where necessary), such personal data will be retained strictly in accordance with Payment Card Industry Data Security standards*, and will be held securely on an external server (never in an individual venue)
- where we are holding your personal data for customer service reasons or to deal with an enquiry you have submitted, for such period as is necessary to ensure that your query has been dealt with fully and properly in accordance with our usual standards (this will normally be around thirty days following the date of collection).
For more information on PCI standards, visit https://www.pcisecuritystandards.org/
Disclosure of your information
In order to provide our products and services to you or to otherwise fulfil contractual arrangements that we have with you, we may need to appoint other organisations to carry out some of data processing activities on our behalf.
We may share your personal information with the following third parties who shall process such information on our behalf:
- TalkBox (Impact Data) who store our mailing database and send communications on our behalf.
- PaymentSense, our payment processor in respect of in-venue purchases.
- Stripe Inc., our online payment processor for booking confirmation payments/charges.
- ResDiary, who manage our online reservations system.
- Google Analytics, who assist us in improving our website.
- Cloudflare, who assist us in ensuring our website content is available.
- Facebook, to help us deliver and analyse the effectiveness of our advertising campaigns and promotions
We may also share your data with third parties (a) if we are under a legal or regulatory duty to do so, (b) to lawfully assist the police or security services with the prevention and detection of crime or terrorist activity, (c) where such disclosure is necessary to protect the safety or security of any persons, and/or (d) otherwise as permitted under applicable law.
In all instances where we disclose your information to third parties, we will ensure that your information is appropriately protected.
Stripe Inc.(referenced above) is located in the United States. Stripe participates in and have certified their compliance with the E.U. – U.S. Privacy Shield Framework and is committed to protecting your personal information.
Access & Disclosure of your information
To unsubscribe from our mailing list or change the information we hold about you follow the link at the bottom of each communication we send to you, or contact us at email@example.com
More about your information – your rights
You have various rights in respect of the personal information which MHDL holds about you. You may correct, update or request permanent deletion of your personal information at any time by emailing us at firstname.lastname@example.org or in writing to the address listed at the beginning of this document. Please include your name, address, date of birth and email address when you contact us as this helps us to ensure that we accept amendments only from the correct person.
We encourage you to promptly update your personal information if it changes.
You have the right to receive a copy of the personal information that we hold about you. Please write to us at the address listed at the beginning of this document if you wish to exercise this right.
You also have the right to object to our use of your personal information for direct marketing (including any profiling we carry out for this purpose) or where this is likely to cause or is causing you damage or distress. Please contact us at email@example.com or in writing.
Our protection of your information
Your personal information will be collected, stored and used securely by MHDL. We have implemented appropriate physical, electronic and managerial procedures to safeguard and secure the personal information we hold and adhere to the latest security best practices and methodologies.
Changes to this policy / Complaints
Any updates to our policy will be published on the website.
If you wish to make a complaint please contact firstname.lastname@example.org
You also have a right to complain in respect of MHDL’s use of your personal data to the Information Commissioners Office but please contact us before you escalate your complaint.