Privacy Policy

This Privacy Policy explains how MalabarCoast.co.uk (“we”, “us”, “our”), trading as Malabar Coast, collects, uses, shares and protects your personal data. We handle personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). Please read it alongside ourCookie Policy.

The data controller responsible for your personal data is Malabar Coast.

Address:33 Main Street, Holytown, ML1 4TH, United KingdomEmail:reservations@malabarcoast.co.uk

For any privacy question, to exercise your rights, or to make a complaint, please contact us using the details above.

• Order data, name, email, phone number, order details, collection or delivery information, and payment confirmation. We do not store full card details.
• Table reservation data, contact details, date, arrival time, party size, occasion, dietary information, accessibility requirements and booking notes.
• Hall enquiry data, contact details, preferred and alternative dates, estimated guest count, occasion, contact preference and the event information you provide.
• Communications & support data, messages you send us by email, phone or another available contact channel, plus feedback or reviews you provide.
• Marketing preferences, your consent choices and how you engage with messages, if marketing subscriptions are introduced.
• Device & usage data, technical request and security information. Additional analytics or advertising data would only be collected after valid consent.
• Delivery data, delivery address, chosen date or slot, and any delivery instructions you submit.

We must have a lawful basis under the UK GDPR for using personal data. We rely on the following:

What we doLawful basis

Process and fulfil orders, take payment, provide confirmations and customer support.Performance of our contract with you.

Send service messages about an order or delivery.Contract; our legitimate interest in keeping you informed.

Manage table reservations, hall enquiries and related service messages.Steps taken at your request; performance of a contract where a booking is confirmed; our legitimate interest in operating the restaurant.

Send marketing messages, if offered.Your consent, which you can withdraw at any time.

Set non-essential analytics or advertising storage, if introduced.Your consent.

Operate, secure and improve the Site, prevent fraud and keep business records.Our legitimate interests; legal obligations.

Meet legal, tax and regulatory requirements.Compliance with a legal obligation.

We use storage that is strictly necessary for basket, checkout, security and order-access functions. If non-essential analytics or advertising tools are introduced, they will remain off until you consent. See ourCookie Policyfor current details.

We do not sell personal data. We share it only with trusted service providers acting on our instructions, where needed to provide the service, or where required by law. These may include:

• Stripe, secure hosted payment processing and payment-status confirmation.
• Supabase, secure database and application services used to store and process order records.
• Brevo, transactional email delivery for order, table reservation and hall enquiry messages.
• Delivery partners, where needed to fulfil a delivery order.
• Professional and regulatory recipients, where necessary to comply with law or establish, exercise or defend legal rights.

Some service providers may process data outside the UK. Where personal data is transferred internationally, we use an applicable lawful safeguard, such as UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or approved contractual protections.

We keep personal data only for as long as necessary for the purposes above. Order and transaction records are generally retained for up to seven years to meet tax and accounting obligations. Reservation and enquiry details are retained only for operational, dispute and record-keeping needs, then deleted or anonymised under the restaurant's approved retention schedule. Consent records are retained for as long as needed to demonstrate and honour your choice.

We use appropriate technical and organisational measures to protect personal data, including hosted payment pages so card details do not enter this application. No internet transmission is completely secure, but once we receive data we apply controls intended to prevent unauthorised access, alteration or disclosure.

We will only send optional marketing messages where there is a valid legal basis, normally your consent. Any marketing message will provide an appropriate way to unsubscribe. Opting out of marketing does not affect necessary service messages about an order you placed.

Under the UK GDPR, you may have the right to be informed; access your data; correct inaccurate data; request erasure; restrict or object to processing; receive portable data; and withdraw consent where we rely on it. You also have rights relating to solely automated decisions that significantly affect you; we do not currently carry out that type of decision-making.

To exercise a right, emailreservations@malabarcoast.co.uk. We will normally respond within one month. Rights can be subject to legal exemptions, and we may retain information where the law requires or permits us to do so.

Some information is necessary for us to take payment, fulfil an order, reserve a table or respond to a hall enquiry. If you choose not to provide it, we may be unable to provide the relevant service.

The Site and online ordering service are intended for people aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has provided personal data, please contact us.

Please contact us first atreservations@malabarcoast.co.ukso we can try to resolve your concern. You also have the right to complain to the UK Information Commissioner’s Office through itscomplaints serviceor by calling 0303 123 1113.

We may update this policy for legal, operational or regulatory reasons. We will publish material changes on this page and update the review date.