Privacy Policy

Updated On 12/20/2023

Orange Brands Management – Privacy Policy

We are committed to preserving the privacy, integrity and security of the personal data and information that we hold about our customers and those who contact us. We have developed this privacy policy to explain how we manage and use this personal data and information and to ensure we comply with our legal obligations under applicable data protection laws.

It is important that you read this privacy policy carefully so that you are fully aware of how we collect and process personal data and information.

Orange Brands Management – Who We Are

This privacy policy covers the personal data and information and personal information collected and processed by Orange Brands Management ("OBM", "we" "us" and "our") and its subsidiary brands, SUSHISAMBA, Duck & Waffle and Joao’s Place. You can find out more about our business at our website www.orangebrandsmanagement.com

The controller of your data and information

The controller of, and the person responsible for, the personal data and information covered by this policy is the Data Protection Officer at privacy@orangebrandsmanagement.com. Other contact details for the controller are set out below under "How to Contact Us".

Personal Data and Information we collect and process and the purpose for which we use it

This privacy policy applies to all personal data and information collected by or on behalf of us about or provided to us by our customers, business contacts and suppliers, job applicants and individuals that contact us (including through our website, in person, by letter, phone, email or text) or enter competitions run by us or use wi-fi services offered at one of our restaurants.

Customers

The following section of this policy sets out how OBM may process personal data and information (as a controller) and information about its customers.

What personal data and information do we collect from our customers?

The personal data and information we collect may include; name, email address, home and/or business address, phone number; booking history; information relating to your use of our services, such as special requests, feedback and survey responses; and marketing preferences.

We may also collect information about any medical or health conditions (such as disabilities, dietary or allergy information) to protect your well-being. By freely providing us with such information, you explicitly consent to us processing such information.

How are our customers' data and information collected?

We may collect, use, store and transfer different kinds of personal data and information about you that you provide to us through: the online forms on our website (including about contacting us), booking a table at one of our restaurants, dining at one of our restaurants, buying a gift voucher and/or joining our marketing email list, entering a competition, promotion or survey, connecting to wi-fi at one of our restaurants, telephone or email communication, and information we receive from other sources, including from third parties that operate loyalty points, booking or delivery programs or platforms, or send marketing communications on our behalf.

Legal basis for processing our customers' data and information

The legal bases we principally rely upon to process your data and information are that:

it is necessary for the performance of a contract between us for the provision of services or to take steps at your request before entering into such a contract; and/or
it is necessary for the legitimate interests of pursuing and developing our business, where such interests are not overridden by your rights or interests.

Occasionally we may also rely upon the following legal bases for processing:

we must comply with a legal or law enforcement requirement; and/or
it is necessary to protect your vital interests or those of another individual; and/or
you have given your consent to the processing.

The basis on which we process your data and right to withdraw consent:

If we consider it necessary to obtain your consent about the use of your data and information, we will contact you to request this consent. In such circumstances, we will provide you with full details of the personal data and information that we would like and the reason we need it so that you can carefully consider whether you wish to consent. If you decide to provide your consent, you have the right to withdraw your consent at any time, although that will not affect the lawfulness of processes based on consent before its withdrawal. To withdraw your consent or to opt out of receiving any of our marketing communications, please follow the unsubscribe instructions included in each electronic communication or contact us at privacy@orangebrandsmanagement.com. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

What do we use our customers' data and information for?

We intend to use your data and information for the following purposes:

to assist you with your enquiries;
to fulfil your bookings and/or to provide services or facilities you request from us;
to collect payment from you;
to administer and manage our relationship with you, which may include asking you to complete surveys or feedback forms;
where you have made a reservation with us, to send you information before your visit to confirm the reservation and to provide you with other information relating to your reservation which we think you may find of interest;
to send you marketing and promotional material where we think this may be of interest to you and to assess the success and/or effectiveness of any marketing campaigns;
where required by law;
where necessary to protect your health or well-being or that of another individual;
to scan and monitor electronic communications sent to us (including attachments) for viruses or malicious software, to process and encrypt personal data and information
to protect and manage email traffic, and to store personal data and information on our systems to pursue our legitimate interests including for document retention purposes; and such other actions as are necessary to manage our activities, and to enforce or defend our rights and/or interests.

Business contacts/suppliers

The following section of this policy sets out how we may process personal data and information (as a controller) and information about our business contacts and (current, previous and/or potential) service providers (and employees of service providers).

What personal data and information do we collect from our contacts?

The personal data and information we collect may include name, email address, home and/or business address, date of birth, phone number; place of work; job title; and marketing preferences.

How are our contacts' data and information collected?

We will collect this data from you when you or your employer provides it to us by phone, email, post, through our website or in person.

Legal Basis for Processing our contacts' data and information

The legal bases we principally rely upon to process your data and information are that:

it is necessary for the performance of a contract between us for the provision of services or to take steps at your request before entering into such a contract; and/or
it is necessary for our legitimate interests of pursuing and developing our business, where such interests are not overridden by your rights or interests.

Occasionally we may also rely upon the following legal bases for processing:

we must comply with a legal or law enforcement requirement; and/or
it is necessary to protect your vital interests or those of another individual; and/or
you have given your consent to the processing.

The basis on which we process your data and right to withdraw consent:

If we consider it necessary to obtain your consent about the use of your data and information, we will contact you to request this consent. In such circumstances, we will provide you with full details of the personal data and information that we would like and the reason we need it so that you can carefully consider whether you wish to consent. If you decide to provide your consent, you have the right to withdraw your consent at any time, although that will not affect the lawfulness of processes based on consent before its withdrawal. To withdraw your consent or to opt out of receiving any of our marketing communications, please contact us at privacy@orangebrandsmanagement.com or follow the unsubscribe instructions included in each electronic communication. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

What do we use our contacts' data and information for?

We intend to use your data and information for the following purposes:

to fulfil your requests for information;
to send you marketing and promotional material where we think this may be of interest to you (unless you have objected to receiving this by contacting us using the contact details set out under "How to contact us" below or by emailing privacy@orangebrandsmanagement.com.
where it is required by law;
where necessary to protect your health or well-being or that of another individual;
such other actions as are necessary to manage the activities of the Company by processing instructions and enforcing or defending the rights and/or interests of the Company, to comply with our legal obligations and/or to pursue our legitimate interests;
to scan and monitor electronic communications sent to us (including attachments) for viruses or malicious software, to process and encrypt personal data and information to protect and manage email traffic, and to store personal data and information on our systems to pursue our legitimate interests including for document retention purposes; and
such other actions as are necessary to manage our activities, and to enforce or defend our rights and/or interests.

Job Applicants

The following section of this policy sets out how OBM may process personal data and information (as a controller) and information about applicants of jobs or placements and potential workers and contractors.

What personal data and information do we collect from job applicants?

In connection with your application for work with us, we may collect the following personal data and information:

name, title, address, telephone number, personal email address, date of birth; and gender;
employment history, qualifications;
information provided to us during telephone calls, interviews and/or meetings with you;
information contained in your CV and cover letter or email;
information obtained from social media, including LinkedIn; and
Information obtained from references.

Special Category Data

We may also collect, store and use the following "special categories" of sensitive personal data: [Information about your race or ethnicity, religious beliefs, sexual orientation and political opinions, information about your health, including any medical condition, health and sickness records and/or information about criminal convictions and offences.]

We may use your sensitive personal data in the following ways:

information about your disability status to consider whether we need to provide appropriate adjustments during the recruitment process, for example, whether adjustments need to be made during the interview; and
information about your race or national or ethnic origin, religious, philosophical or moral beliefs, or your sexual life or sexual orientation, to ensure equal opportunity monitoring and reporting.
We will collect information about your criminal convictions history if we would like to offer you the work or a position (conditional on checks and any other conditions, such as references, being satisfactory). We are entitled to carry out a criminal record check to satisfy ourselves that there is nothing in your criminal convictions history which makes you unsuitable for the role.

How are the job applicants' data and information collected?

We may collect personal data and information about candidates from the following sources:

you, the candidate directly;
recruitment agencies;
job boards;
your named referees; and
data from third parties which is from a publicly accessible source including Companies House records and social media (such as LinkedIn).

Legal basis for processing our job applicants' data and information

The legal bases we principally rely upon to process your data and information are that:

it is necessary for our legitimate interests (to decide whether to appoint you to work for us), where such interests are not overridden by your rights or interests); and/or
we must comply with a legal obligation on us; and/or
you have given your consent to the processing.

The basis on which we process your data and right to withdraw consent

If we consider it necessary to obtain your consent about the use of your data and information, we will contact you to request this consent. In such circumstances, we will provide you with full details of the personal data and information that we would like and the reason we need it so that you can carefully consider whether you wish to consent. If you decide to provide your consent, you have the right to withdraw your consent at any time, although that will not affect the lawfulness of processes based on consent before its withdrawal. To withdraw your consent or to opt out of receiving any of our marketing communications, please contact us at privacy@orangebrandsmanagement.com or follow the unsubscribe instructions included in each electronic communication. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

What do we use our job applicants' data and information for?

Your data and information may be processed by OBM for the following purposes:

to assess your skills and qualifications, to consider your suitability for the position and to decide whether to enter into a contract with you;
to carry out reference checks, where applicable;
to communicate with you about and in connection with the recruitment process;
to keep records related to our hiring processes;
to comply with legal or regulatory requirements;
to scan and monitor emails sent to us (including attachments) for viruses or malicious software, to process and encrypt personal data and information to protect and manage email traffic, and to store personal data and information on our systems to pursue our legitimate interests including for document retention purposes; and such other actions as are necessary to manage the activities of OBM, including processing instructions, [monitoring and recording electronic communications (including telephone calls and emails) for quality control, analysis and training purposes] and enforcing or defending the rights and interests of OBM, to comply with its legal obligations and/or to pursue its legitimate interests.

Once we receive your CV and cover letter or your application form we may process that information to decide whether OBM has any suitable vacancies and if you meet the basic requirements to be shortlisted for that role. If you do, we will decide whether your application is strong enough to invite you for an interview. If we decide to call you for an interview, we will use the information you provide to us at the interview to decide whether to offer you the work. If we decide to offer you the work, we will then take up references before confirming your appointment.

You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making.

If your application is successful, the information you provide during the application process will be retained by OBM as part of your employee file and held by the privacy section of OBM's staff handbook and our data retention policy or applicable laws.

If your application is unsuccessful, the information you have provided will be retained by OBM for six (6) months after we have communicated our decision to you. We retain your personal information for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment exercise fairly and transparently. We may also add your details to our Talent Bank so that we can inform you of other relevant roles. After this period, we will securely destroy your personal information by our data retention policy or applicable laws and regulations.

Visitors to our website

The following section of this policy sets out how OBM may process personal data and information (as a controller) and information about visitors to its website.

What personal data and information do we collect from visitors to our website?

The personal data and information which we collect may include:

name, title, address, telephone number, personal email address, date of birth;
technical data, including internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website, usage data (including information about how you use our website, products and services, and information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our website (including date and time)); products you viewed or searched for; page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call our customer service number.; and
marketing and communications preferences (including your preferences in receiving marketing from us and your communication preferences)]
We also work closely with third parties (including, for example, sub-contractors in technical, payment and delivery services) and may receive information about you from them.

How is the personal data and information about visitors to our website collected?

We use different methods to collect data from and about visitors to our website, including:

direct interactions with you, including by filling in our online forms, joining our marketing email list (please see the Marketing section of this policy), entering a competition, promotion or survey, booking a cookery lesson or reservation at one of our restaurants, ordering a takeaway and applying for a job (please see the Job Applicants section of this policy);
automated technologies or interactions. As you interact with our website and/or marketing emails, we may automatically collect technical data about your equipment, browsing actions and patterns. About the website, we collect this personal data and information by using cookies and similar technologies. Please see the Cookies and Marketing sections of this policy for further details.

Legal basis for processing information relating to visitors to our website

The legal bases we principally rely upon to process your data and information are that:

it is necessary for our legitimate interests (including improving our website, marketing and customer experiences), where such interests are not overridden by your rights or interests); and/or
we must comply with a legal obligation on us; and/or
you have given your consent to the processing.

The basis on which we process your data and right to withdraw consent

If we consider it necessary to obtain your consent about the use of your data and information, we will contact you to request this consent. In such circumstances, we will provide you with full details of the personal data and information that we would like and the reason we need it so that you can carefully consider whether you wish to consent. If you decide to provide your consent, you have the right to withdraw your consent at any time, although that will not affect the lawfulness of processes based on consent before its withdrawal. To withdraw your consent or to opt out of receiving any of our marketing communications, please contact us at privacy@orangebrandsmanagement.com or follow the unsubscribe instructions included in each electronic communication. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

What do we use the personal data and information of visitors to our website for?

Your data and information may be processed by OBM for the following purposes:

to use data analytics to improve our website, marketing, and customer experiences based on our legitimate interests;
to comply with legal or regulatory requirements;
to respond to messages from you and to send you communications, including marketing communications based on our legitimate interest;
to scan and monitor emails sent to us (including attachments) for viruses or malicious software, to process and encrypt personal data and information to protect and manage email traffic, and to store personal data and information on our systems to pursue our legitimate interests including for document retention purposes;
such other actions as are necessary to manage the activities of OBM, including processing instructions, and enforcing or defending the rights and/or interests of OBM, to comply with its legal and/or regulatory obligations and/or to pursue its legitimate interests;
to scan and monitor electronic communications sent to us (including attachments) for viruses or malicious software, to process and encrypt personal data and information to protect and manage email traffic, and to store personal data and information on our systems to pursue our legitimate interests including for document retention purposes; and
such other actions as are necessary to manage our activities, and to enforce or defend our rights and/or interests.

Links to our websites

Where our website provides links to other websites, we are not responsible for the data protection/privacy/cookie usage policies of such other websites, and you should check these policies on such other websites if you have any concerns about them. If you use one of these links to leave our website, we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting a linked website and such websites are not governed by this policy. You should always exercise caution and review the privacy policy applicable to the website in question.

Calls to our Reservations Department

Please note that calls made to both our Reservations Department and Restaurants may be monitored or recorded for training and quality purposes.

At certain times, and for group bookings, we may require a deposit to be held in the event of last-minute cancellation. We will never request these details over the phone, instead you will receive an email from our payment partner Stripe with information about entering your card details into a secure website.

Marketing to You

Your data and information may be used to send you details of those products or services that we offer that we have identified as likely to be of interest to you.

You may receive marketing communications from us:

by email if you have specifically requested that information from us (including by signing up for our mailing list); or
by email if you are a customer and you have not opted out of receiving that marketing (which you may do by contacting us using the contact details set out under "How to contact us" below or by emailing privacy@orangebrandsmanagement.com.

Email communications

We may use tracking technologies to determine whether (and where) you have read, clicked on, or forwarded certain email communications which are sent to you by us, or on our behalf so that we can make our communications more helpful and interesting. If you do not wish us to confirm whether (and where) you have opened, clicked on or forwarded our communications, you will need to unsubscribe, as we cannot send these emails without tracking enabled. Registered subscribers can update their communication preferences at any time by contacting us, or you can unsubscribe following the instructions in the individual email communications you receive from us.

You can ask us to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting us at any time using the contact details set out under "How to contact us" below or by emailing privacy@orangebrandsmanagement.com.

If you fail to provide personal data and information requested

Where you fail to provide that data when requested, we may not be able to perform the contract in place or which we are trying to enter into with you. In this case, we may have to cancel a service you have with us (including a reservation at one of our restaurants) but we will notify you if this is the case at the time.

Sharing your data and information with others

We may disclose personal data and information or information which we hold about you:

to companies forming part of our group;
to third parties who provide services to us (including, but not limited to our: IT service providers, booking software providers, email and marketing service providers, secure credit card processors, PR and social media agencies and platforms, recruitment interface providers, background and/or credit reference services, guest wi-fi provider;
to professional advisers including lawyers, bankers, auditors and insurers; and
to HM Revenue & Customs, regulators and other authorities who require reporting of processing activities in certain circumstances.

If we sell any business or assets or seek investment into our business, we may disclose personal data and information we hold about you to the prospective and actual buyer of such business or assets or investors. If a change happens to our business, then the new owners may use your data and information in the same way as set out in this Privacy Policy. In the unlikely event of our insolvency, winding up or liquidation, we may also disclose personal data and information we hold about you to a successor in interest.

We will not disclose personal data and information we hold about you to any other third parties except where required by law, or where the disclosure is 'necessary' for purposes of national security, taxation and/or criminal investigations, or we have your consent.

Transferring your data and information outside the EEA

We do not intend to transfer any personal data and information we hold about you to a country outside the UK or the European Economic Area ("EEA"). If, however, we do transfer your data and information out of the UK or the EEA, we shall ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards applies:

the countries to which it is transferred have been deemed to provide an adequate level of protection for personal data and information by the relevant regulators;
we have put in place with the transferee specific contracts approved by the relevant regulators which give personal data and information similar protection to that it has in Europe; or
if the transferee is in the US, it is registered with the Privacy Shield (or any similar replacement scheme) which requires it to provide similar protection to personal data and information as is required in Europe.

Data security

We have put in place appropriate security measures to prevent your data and information from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your data and information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your data and information on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data and information breaches and will notify you and any applicable regulator of a breach where we are legally required to do so.

How long do we keep your data and information?

We will only retain your data and information for as long as necessary to fulfil the purposes for which we collected it, including to satisfy any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data and information, we consider the amount, nature, and sensitivity of the personal data and information, the potential risk of harm from unauthorized use or disclosure of your data and information, the purposes for which we process your data and information and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances you can ask us to delete your data: see the "Your right to access your data and information and your other rights" section below for further information.

In some circumstances, we may anonymize your data and information (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

We will take all reasonable steps to destroy, or erase from our systems, all the personal data and information we hold about you when it is no longer required.

Your right to access your data and information and your other rights

In certain circumstances, you have rights under data protection laws about your data and information as follows:

to request access to your data and information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data and information we hold about you;
to request correction of the personal data and information that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected;
to request the erasure of your data and information. This enables you to ask us to delete or remove personal data and information where there is no good reason for us to continue to process it. We may not always be able to comply with your request for erasure for specific legal reasons;
to object to the processing of your data and information in certain circumstances where we are relying on a legitimate interest (or those of a third party) as the legal basis for processing your data and information;
to request restrictions on processing your data and information. This enables you to ask us to suspend the processing of personal information about you, for example, if you want us to establish its accuracy or the reason for processing it;
to request the transfer of your data and information to you or a third party; or
to withdraw consent at any time when we are relying on consent to process your data and information. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent or if we are processing it under another legal basis. To withdraw your consent or to opt out of receiving marketing communication, please contact us at privacy@orangebrandsmanagement.com or follow the unsubscribe instructions included in each electronic marketing communication. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

If you wish to exercise any of the rights set out above, please contact us by using the contact details set out below under "How to contact us" below or by emailing privacy@orangebrandsmanagement.com.

You will not have to pay a fee to access your data and information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

If you wish to exercise any of those rights, we may need to request specific information from you to help us confirm your identity. This is a security measure to ensure that personal data and information are not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information about your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made several requests. In this case, we will notify you and keep you updated.

Complaints

If you are not satisfied with our response to any queries or complaints you raise with us or believe we are not processing your data and information by the data protection laws you have the right to complain to the Information Commissioner's Office (ICO) (https://ico.org.uk/). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

Disclosure of Personal Data to 3rd Parties

We may pass on your data to service providers contracted to Orange Brands Management in the course of dealing with you. They act as a data processor on our behalf and are obliged under contract to keep your details securely, and only use them to fulfil the services they provide on our behalf. When they no longer need your data to fulfil this service, they dispose of the details in line with legal procedures.

We will not pass on your data to any other third parties without your consent unless the law requires us to do so.

Cookies

A cookie is a small piece of information sent by a web server to a web browser, which enables the server to collect information from the browser. They are widely used to make websites work, or work more efficiently, as well as to provide information to the owners of the website. Find out more about cookies at www.allaboutcookies.org.

We use cookies to identify you when you visit this website to keep track of your browsing patterns and build up a demographic profile.

You can set your browser to refuse all or some browser cookies or to alert you when websites are set to access cookies. If you want to know how to do this, please look at the menu on your browser or look at the instructions on www.allaboutcookies.org.

Please note however that turning off cookies will restrict your use of our website.

We have set out below, in a table format, a description of all the ways we plan to use your data and information, and the legal bases we rely on.

Changes to this policy

We may need to make changes to this privacy policy from time to time to take account of changes in law or the needs of our business. Please refer back to this page regularly to see any changes or updates to this policy.

How to contact us

If you have any questions about this privacy policy, including any requests to exercise your legal rights, please contact us using the details set out below:

Data Protection Officer

Orange Brands Management

T/A SUSHISAMBA, Duck & Waffle & Joao's Place

34-37 Liverpool Street

EC2M 7PP London

Email: privacy@orangebrandsmanagement.com