Privacy policy

Last updated: 3 November 2026

Controller: TableGo Ltd ("TableGo", "we", "us") for our platform operations at tablego.uk

Independent Controllers: Participating Restaurants for diner data they receive about you

Processor role: In some cases we host/process diner data on behalf of Restaurants (e.g., reservation records) — our DPA applies in that case

1. How to read this Notice

This Notice explains how we collect and use personal data when you use tablego.uk to make reservations, pay deposits or purchase gift cards, or use the TableGo plugin in ChatGPT. It complements our Website Terms of Use and Cookie Policy and complies with UK GDPR and the Data Protection Act 2018.

When we decide the purposes/means of processing for our consumer website (account, security, analytics, marketing), we act as Controller.

When a Restaurant receives your booking/gift card details, it acts as an independent Controller for its use of your data.

When we host diner data for a Restaurant in its account, we act as Processor under our DPA.

2. Personal data we collect

Booking & profile data: name, contact (email/phone), party size, date/time, venue, notes (please avoid health info unless necessary).

Payment metadata: transaction IDs, amounts, status, refunds/chargebacks via Stripe (we do not store full card numbers or CVV).

Device/usage data: IP address, device identifiers, browser type, pages viewed, referral URLs, session duration, crash logs.

From channels: where you book via Google Reservations, Facebook/Instagram or Tripadvisor, we receive booking details from those partners.

TableGo in ChatGPT: if you use the TableGo plugin in ChatGPT, ChatGPT sends us the words you search for, the date, time and party size you ask about, anonymous identifiers that ChatGPT assigns to you and to the conversation, and, if you allow ChatGPT to share it, your approximate location (town or area). We use these only to answer your request and to prevent misuse, and we use your approximate location only to rank nearby restaurants. We do not receive your name, contact details or the content of your ChatGPT conversation, and the plugin cannot make, see or change bookings. Bookings you then make on TableGo are covered by the rest of this Notice. OpenAI's handling of your ChatGPT conversations is covered by OpenAI's privacy policy.

Special category data. We do not seek health data. If you include allergy details in a note, we process it only with explicit consent and pass it to your chosen Restaurant for safety.

3. Why we use your data (legal bases)

PurposeExamplesLegal basis
Provide booking/deposit/gift card flowsCreate bookings, send confirmations, customer supportArt. 6(1)(b) contract
Payment processing (via Stripe)Process payments, refunds; prevent fraudArt. 6(1)(b) contract / Art. 6(1)(f) legitimate interests
Safety & securityAccess controls, incident response, misuse preventionArt. 6(1)(f) legitimate interests
Analytics & improvementUsage metrics, performance; cookies only with consent under PECRArt. 6(1)(f) legitimate interests; consent where required
Service messagesBooking confirmations, reminders, receipts and changes to your bookingArt. 6(1)(b) contract
Restaurant newsletters, for restaurants (section 4)Keeping each restaurant’s newsletter list and the record of your choiceThe restaurant’s basis: Art. 6(1)(a) consent, or the restaurant’s own basis where you have not chosen (section 4)
Legal & complianceTax/audit, enforcing terms, responding to lawful requestsArt. 6(1)(c) legal obligation
TableGo plugin in ChatGPTFind restaurants, show available times, create pre-filled booking links; rate limits against misuseArt. 6(1)(f) legitimate interests

4. Restaurant newsletters

When you book a table, buy a gift voucher or buy event tickets on TableGo, you can tick a box that reads “Email me news and offers from [restaurant]. You can unsubscribe at any time.” This section explains what happens if you tick it.

Your choice. The box is never ticked for you, and your booking or purchase never depends on it. Ticking it means you agree to receive news and offers by email from that restaurant only, not from TableGo or any other restaurant. Earlier versions of the box used different words, such as “Keep me updated with offers from [restaurant]”; a choice made with an earlier version is treated in the same way.

Telling the restaurant directly. You can also tell the restaurant’s team that you would like its emails, or that you would not. The team records your request in TableGo with the team member’s name and the date; it is never shown as a box you ticked.

If you have not chosen. If you have neither ticked the box nor opted out, TableGo has no recorded preference for you. A restaurant may still send you marketing emails if it has its own lawful basis to do so, for example the rules that allow emails about similar products to people who have bought from it before (the “soft opt-in”). The restaurant is responsible for that decision. When restaurants can send newsletters through TableGo, a restaurant will have to confirm that it is entitled to email you before it includes you in a campaign sent through TableGo; that confirmation is not your consent and does not change your preference. Once you opt out, you will not be included in any campaign sent through TableGo until you opt in again, whatever the restaurant’s reason.

Who is responsible. Each restaurant decides whether to send newsletters, what they say and who receives them, and is the controller of its newsletter list. TableGo keeps the list and the record of your choice for the restaurant as its service provider (processor).

How your choice works. Your choice is recorded for that restaurant and for the email address you gave. It stays in place until you withdraw it, including if the booking is later cancelled or a voucher or ticket payment is not completed. Leaving the box unticked on a later booking or purchase does not cancel it. If you start using a different email address with the restaurant, tick the box again with that address.

What we record. To show that you chose to hear from the restaurant, we record the email address you gave, the restaurant, the date and time, whether you were booking or buying a voucher or tickets, the booking, order or checkout it was part of, and the version of the wording you saw. For voucher and ticket purchases, your choice is also included in the order details sent to Stripe, our payment provider. When the restaurant’s team records your request, we record who recorded it, their role, when, and any note they add. We also record when and how you withdraw. A choice made with one restaurant never applies to another.

How newsletters are sent. At present, a restaurant can download its newsletter list from TableGo and send newsletters with its own email service, for which it is responsible. We are preparing a feature that will let restaurants send their newsletters through TableGo. When it becomes available, we will send them on the restaurant’s behalf; we plan to deliver them through Amazon Simple Email Service, provided by Amazon Web Services. Every newsletter we send will include a link to unsubscribe, and we will not send a restaurant’s newsletters to an address that has opted out, unsubscribed, reported a newsletter as spam or cannot receive email. We will confirm the provider and update this section before that feature starts.

Stopping newsletters. You can withdraw your consent, and object to a restaurant’s marketing, at any time and free of charge: use the unsubscribe option in the restaurant’s emails, ask the restaurant, or email support@tablego.uk saying which restaurant. Once your withdrawal is recorded, the restaurant’s list in TableGo shows you as unsubscribed. If the restaurant has already copied its list into its own email service, it is responsible for respecting your withdrawal there too. If you later tick the box again, or ask the restaurant, you will be subscribed again.

Legal basis. Where you ticked the box or asked the restaurant, it relies on your consent (UK GDPR Article 6(1)(a) and regulation 22 of the Privacy and Electronic Communications Regulations 2003). Where you have not chosen, a restaurant that emails you relies on its own lawful basis and is responsible for it. The record of your choice and of any withdrawal is kept so that the restaurant can show what you chose and that your choice is respected.

How long we keep it. We keep the record of your choice, and of any withdrawal, for as long as it may be needed to show that you consented and that your choice was respected. A withdrawal stays recorded so that the restaurant’s list in TableGo keeps showing you as unsubscribed unless you tick the box again or ask the restaurant to add you.

Your rights and complaints. You have the rights described in section 8, including the right to object to direct marketing at any time. Requests about a restaurant’s newsletter are for that restaurant, but you can send them to us and we will pass them on and help the restaurant respond. If you are unhappy with how your data has been handled, contact us at support@tablego.uk. You can also complain to the UK data protection regulator at ico.org.uk.

5. Sharing your data

We share personal data with:

  • Restaurants you interact with.
  • Stripe/Stripe Connect (payments, fraud/risk).
  • Channel partners (Google Reservations, Facebook/Instagram, Tripadvisor) where your booking flows through their systems.
  • OpenAI, when you use the TableGo plugin in ChatGPT: we return public restaurant information, available times and booking links in reply to your request.
  • Hosting/CDN, security, communications and analytics providers acting as our processors (non‑essential cookies/SDKs only with consent).
  • Advisers/authorities where required by law.

6. International transfers

Some providers may process data outside the UK. We rely on UK adequacy decisions (e.g., UK‑US Data Bridge) or SCCs/IDTA with supplementary measures as appropriate.

7. Retention

  • Bookings/gift card records (Controller): generally up to 24 months for platform integrity and support.
  • Transactions (Controller): 6 years for accounting.
  • Data we process as Processor: retained according to the Restaurant's instructions; deleted/returned per the DPA.
  • Cookie consent records: typically 6–12 months.
  • Restaurant newsletter records: see section 4.
  • TableGo in ChatGPT: your approximate location is not stored. The ChatGPT identifier and your IP address are kept only as short-lived, one-way hashed counters, which are routinely deleted once they are more than a day old. Our plugin logs record only the tool used, the outcome, the response time and the restaurant.

8. Your rights

Under UK GDPR you may access, rectify, erase, restrict, object, and request data portability. You may withdraw consent at any time where processing is based on consent.

Request: support@tablego.uk (we respond within one month; extendable for complex cases).

If your request concerns data controlled by a Restaurant, we will notify/redirect it to the Restaurant.

You may complain to the ICO (ico.org.uk).

9. Children

tablego.uk is not intended for children under 16. If you believe a child provided data, contact us to remove it.

10. Security

We implement appropriate technical and organisational measures to protect personal data (encryption in transit, access controls, logging, staff training). No method is 100% secure.

11. Changes & contact

We may update this Notice; we will post the new version with a revised date and, where appropriate, notify you.