PRIVACY POLICY
Privacy Policy
Black Horse Hospitality Limited · Last updated 16 October 2026
ICO registration number ZC276578
Contents
Black Horse Hospitality Limited (“we”, “our”, “us”) runs The Black Horse, Brent Pelham, Hertfordshire, SG9 0AP. We are committed to protecting your privacy. This policy explains what personal data we collect, why we collect it, how we use it and the rights you have.
We are the data controller of your personal data for the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, as amended from time to time.
Registered in England and Wales, company number 15336429
Registered office: Black Horse, Brent Pelham, Buntingford, England, SG9 0AP
ICO registration number: ZC276578
Contact: contact@blackhorsebrentpelham.co.uk, 01279 778925, or by post to The Black Horse, Brent Pelham, Hertfordshire, SG9 0AP.
This policy applies to you if you:
book a table, order food or drink, buy a gift voucher, or pay at The Black Horse (including online and through our QR code order and pay service);
book or stay in one of our rooms;
make an enquiry about events, functions or gift vouchers, or otherwise contact us;
visit our website, blackhorsebrentpelham.co.uk; or
sign up to receive news and offers from us.
It does not cover our staff or job applicants, who are given a separate privacy notice.
Table bookings
Your name, telephone number, email address, date and time of booking, number of guests and any notes or special requests you give us.
Room bookings and stays
Your name, address, telephone number, email address, arrival and departure dates and payment information. If you are aged 16 or over and are not a British or Irish citizen, the law requires us to record your nationality, passport number (or other identity document) and place of issue, and, if known, your next destination.
If you book a room through a third-party website, such as an online travel agent, that website will pass your booking details to us, and its own privacy policy will also apply.
Orders and payments
Details of what you order, your table number and the value of your transaction. Card payments are processed securely by our payment providers (see section 5). We do not see or store your full card number.
Allergies and dietary requirements
If you tell us about an allergy or dietary requirement, this may be information about your health. We only collect it if you choose to give it to us, and we use it only to prepare your food safely.
Enquiries and feedback
Your contact details and the content of your message when you contact us by phone, email, social media or our website.
Marketing
Your name and email address if you sign up for our newsletter or offers.
Website
Our website uses cookies and similar technologies. Some are essential to make the site work. With your consent, we also use Google Analytics cookies to understand how visitors use the site, which collect information such as your IP address, device and browser type and the pages you visit. You can accept or reject non-essential cookies when you first visit the site, and change your choice at any time.
CCTV
We operate CCTV in and around the premises for the safety of our customers and staff and to prevent and detect crime. Signs are displayed where CCTV is in use.
Guest Wi-Fi
If you use our guest Wi-Fi, our provider may collect your device identifier and any email address you use to log in.
We only use your personal data where the law allows us to. The table below sets out what we use it for and the lawful basis we rely on.
Purpose
Lawful basis
Taking and managing table bookings, including sending confirmations and reminders
Performance of a contract with you
Processing your orders and payments
Performance of a contract with you
Managing room bookings and your stay
Performance of a contract with you
Keeping a register of overseas guests
Legal obligation (Immigration (Hotel Records) Order 1972)
Using allergy and dietary information to prepare your food safely
Your explicit consent
Responding to enquiries about events, functions and vouchers
Taking steps at your request before entering into a contract; our legitimate interests in responding to you
Keeping accounting and tax records
Legal obligation
Preventing fraud, protecting our premises, customers and staff, and dealing with disputes or legal claims
Our legitimate interests
Sending news and offers by email
Your consent, or, for existing customers, our legitimate interests in telling you about similar offers. You can unsubscribe at any time.
Operating our website (essential cookies)
Our legitimate interests
Understanding how visitors use our website (Google Analytics)
Your consent
Providing guest Wi-Fi
Our legitimate interests in providing a secure service
CCTV
Our legitimate interests in safety and crime prevention.
We use trusted service providers who process personal data on our behalf, under written contracts that require them to keep it secure:
Tabology Ltd, Avenue HQ, 10–12 East Parade, Leeds, LS1 2BH – our till system, online table booking, gift vouchers and QR code order and pay service. Online card payments through Tabology are processed by Stripe.
Dojo (the trading name of Paymentsense Limited) – card payments. Dojo may also act as an independent controller for some payment data, for example for fraud prevention and regulatory purposes. See dojo.tech/legal/privacy.
Little Hotelier (provided by SiteMinder) – our room booking and guest management system, including online room bookings. See siteminder.com/legal/privacy.
Framer – our website host.
Google – website analytics (Google Analytics), only where you have accepted analytics cookies.
Our email marketing and guest Wi-Fi providers.
We may also share your personal data:
with our professional advisers, such as our accountants;
with the police, HMRC or other authorities where we are required to do so by law, including providing our guest register when lawfully requested;
where needed to protect the rights, property or safety of Black Horse Hospitality Limited, our customers or others, including for fraud prevention; and
with a buyer, if we sell our business or substantially all of its assets. In that case, your personal data would be one of the transferred assets and would continue to be protected in line with this policy.
We never sell your personal data.
Some of our providers, including SiteMinder (Little Hotelier), Framer and Google, may process personal data outside the UK. Where they do, we make sure the transfer is protected: either the destination is recognised by the UK as providing adequate protection (for example the European Economic Area, or US companies certified under the UK–US Data Bridge), or appropriate safeguards are in place, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
We keep personal data only for as long as we need it.
Information
How long we keep it
Table booking details
2 years from the date of your booking
Allergy and dietary notes
Only for as long as needed for your booking, unless you ask us to keep them on file for future visits
Room booking records
2 years from the end of your stay
Overseas guest register
12 months from the date of your stay, as required by law
Payment and accounting records
6 years from the end of the financial year they relate to, as required by HMRC
Enquiries and correspondence
12 months from our last contact with you
Marketing preferences
Until you unsubscribe. We then keep a minimal record so that we do not contact you again.
CCTV footage
Normally 30 days, unless we need it longer to investigate an incident.
Our payment provider, Dojo, sets its own retention periods for payment data it holds as a controller. These are explained in its privacy policy.
We take appropriate technical and organisational measures to protect your personal data. Access is limited to those who need it, and we use reputable providers who meet recognised security standards. Card payments are handled by providers who comply with the Payment Card Industry Data Security Standard (PCI DSS).
We do not make decisions about you based solely on automated processing.
Under data protection law, you have the right to:
Access – ask for a copy of the personal data we hold about you (a “subject access request”).
Correction – ask us to correct incomplete or inaccurate data. We may need to verify the new data you provide.
Erasure – ask us to delete your data where there is no good reason for us to keep using it. We may not always be able to agree, for example where we must keep records by law. If so, we will tell you why.
Object – object to us processing your data on the basis of legitimate interests, and to direct marketing at any time.
Restriction – ask us to pause processing your data, for example while we check its accuracy or consider an objection.
Portability – ask us to transfer data you have given us to you or to another organisation, in a structured, commonly used, machine-readable format, where we process it by automated means based on your consent or a contract.
Withdraw consent – where we rely on your consent, you can withdraw it at any time. This does not affect processing carried out before you withdraw it.
To exercise any of these rights, contact us at contact@blackhorsebrentpelham.co.uk. There is normally no charge, and we will respond within one month. We may need to confirm your identity before we act on your request.
If you have a concern about how we handle your personal data, please contact us first so that we can try to put things right. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection:
Website: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
We may update this policy from time to time. The latest version will always be available on our website at blackhorsebrentpelham.co.uk, and the date at the top shows when it was last updated.
Questions, comments and requests about this policy are welcome. Please email contact@blackhorsebrentpelham.co.uk or write to us at The Black Horse, Brent Pelham, Hertfordshire, SG9 0AP.