Privacy Policy

Who we are

Strati is the trading name of Joseph Peacock and Emily Lombardo, an ordinary partnership established in England and Wales. Our service address is Molly Mackerels, Attleford Lane, Shackleford, GU8 6BL. We are the controller of the personal information described in this notice.

For privacy questions or requests, contact info@strati.uk.

We ask you to read this notice, not to agree to it. Most processing is necessary to arrange and deliver a booking or meet our legal obligations. Where we rely on consent or optional permission, we ask separately.

Information we collect

When you enquire or book, we collect the lead guest’s name, telephone number, email address, event address, guest count, chosen menu, whether you are interested in wine pairing, and any notes you provide. The lead guest is the person making the booking and is responsible for the accuracy of information supplied about the event.

When you book, ask us to review a date or complete a proposal through our website, we also record whether you ticked the box to opt out of marketing emails, together with the wording you were shown and when you made your choice.

If you sign up to our newsletter on our website, we collect your email address, your first name if you choose to give it, the page or link you signed up from (for example the home page or a QR code at an event), and which version of the sign-up wording you were shown.

Gift cards

When you purchase a gift card, we collect your name and email address, the recipient’s name and, where you choose direct delivery, their email address. We also collect any personal message, the delivery option, date and time selected, and the details needed to process your purchase. We use this information to process the order, deliver the gift card and arrange any subsequent booking. If you choose to receive the gift card yourself, we won’t ask for or store the recipient’s email address, and we won’t contact them. Purchasing a gift card does not subscribe you or the recipient to our marketing emails. Please only provide another person’s contact details where you have an appropriate reason to do so.

To connect a dietary requirement to the correct guest, we ask for that guest’s first name or another simple identifier. We do not need their full legal name.

Stripe handles deposits and balance payments. We do not see or store full card details. If you contact us through WhatsApp, the conversation is held in Joseph’s WhatsApp account.

Our website and hosting providers receive standard technical request information, such as IP address, browser information, the requested page and timestamps, to deliver and protect the website. Our fonts are served directly from our own website, so no font provider receives your IP address.

We may also use reviewer names, review dates and excerpts that reviewers have made public on Google or Trustpilot.

Information may be supplied by an event planner, lead guest or another person arranging the event. When we receive information about you from another person, we ask them to show you this Privacy Notice. Strati remains responsible for explaining how your information is used. If we communicate with you directly, we will provide access to this notice no later than our first communication.

Allergy and dietary information

To plan each guest’s meal safely, the guest dietary form asks for a first name or other simple identifier, whether they have any allergies or dietary requirements, the foods or ingredients to avoid or accommodate, which kinds apply (food allergy, food intolerance, coeliac disease, another requirement or preference, or not sure) and, optionally, anything else they want us to know, such as advice they follow about traces or “may contain” labels. When booking, the lead guest can also give us an initial planning summary without names or medical details (for example, “2 vegetarian meals and 1 gluten-free meal”).

Information about an allergy, coeliac disease or a health-related intolerance is special-category health information. A dietary request can also reveal religious belief: a request such as halal, kosher or no pork may suggest it, but we do not assume that it does, and we never ask about or record anyone’s religion. We treat all identifiable dietary information with the same care as health information and only collect what we need to plan, prepare and serve the meal.

Our lawful basis for processing a guest’s identifiable dietary information is their consent (UK GDPR Article 6(1)(a)), and, because it may include health information or reveal religious belief, the condition we rely on is their explicit consent (Article 9(2)(a)). Each guest gives it on the form; for a child, their parent or guardian gives it. Where a guest tells Joe or Emily directly instead, we record that they did so and agreed. We do not accept another adult’s health information from the lead guest on their behalf: we ask that guest to use the form. The lead guest’s planning summary should not name anyone or include medical details; we use it only to plan quantities until individual answers arrive.

Identifiable dietary information stays in our protected booking system. It is not sent to Stripe, QuickBooks, Google Calendar, Google Maps, Google Analytics, routine booking emails or the AI assistant we use for our daily planning, and it is not written to our system logs. Only Joseph and Emily can see it. Where other catering or service staff help at an event, we give them only what they need to serve each guest safely, such as a first name and what to avoid, for that event; printed service notes are collected and destroyed after the event.

Weddings and larger events booked through a bespoke proposal

For weddings and larger events booked through a bespoke proposal only, the couple or organiser may send us a seating plan or guest list showing each guest’s dietary requirements, after letting their guests know these details will be shared with Strati so we can prepare their food. Please include only what we need: a name or table, and the requirement. This is an exception to the rule above about the lead guest; for all other bookings, that rule still applies.

If a guest has an allergy, an intolerance, a medical condition such as coeliac disease, or a requirement that may reveal their religious belief, we still ask them to confirm it on our guest dietary form, where they give their explicit consent. A parent or guardian does this for a child. Until a guest confirms, we use what the couple or organiser told us only to plan and serve that guest’s food safely. We keep this information for 6 months after the event, as for all dietary information, and we delete the original email or document as described below.

Guests telling us directly

After booking, the lead guest receives a private link to share with their guests, so each guest can tell us about their own requirements on the guest dietary form described above. We do not ask guests for an email address, phone number or any other contact details. If we need to clarify something, we ask the lead guest to pass on a message asking the guest to contact us, without telling the lead guest what it is about.

If you tell us about dietary requirements by email, text, WhatsApp or phone instead of using the form, we record what we need in our booking system in the same way (with your explicit consent for health or religious information) and then delete the original message from our email and messaging accounts within 14 days. Email and messaging services are run by third parties (Google Workspace for our email, and WhatsApp or your phone network for messages), so please use the form where you can.

When booking, or later on their guests page, the lead guest can instead confirm that they have checked with everyone attending (or a child’s parent or guardian) and nobody has any known allergies or dietary requirements. We record that confirmation for the booking, with its wording, the time and the number of guests it covered; it names no one. If the number of guests changes, we ask for it again.

The lead guest sees how many guests have replied and, if they told us they are not sure yet, the first names of those who have replied, but never what anyone told us. Guests cannot see each other’s answers.

A guest can change or remove their answer from the same phone or computer until 3 days before the event, or at any time by contacting us. To allow this, only their first name and a private key are remembered in their browser; their dietary details are not kept there. Any change is reviewed again. Removing an answer withdraws consent and deletes it; if that means we can no longer assess a requirement, we will tell the lead guest that we cannot adapt the meal for an undisclosed requirement and discuss the options. Withdrawing consent does not affect processing before it was withdrawn.

Children

Bookings can only be made by someone aged 18 or over. Children may attend as guests. A parent or guardian completes the dietary form for a child and gives the explicit consent on the child’s behalf, using wording for that purpose. We record only a first name or simple identifier and the information needed to plan safely; we do not ask for a date of birth.

Photography and media

We may ask for optional permission to photograph or film the food and table setting for marketing. The choice is unticked by default and is not required to book. We do not include identifiable guests.

Media is stored locally on our devices without automatic cloud backup and may be published on our website, Instagram, YouTube or TikTok. You can withdraw permission by contacting us. We will stop future use and remove the material from channels we control where reasonably possible, although copies independently shared by other people may remain outside our control.

Marketing emails

When you book, ask us to review a date or complete a proposal through our website, we may occasionally email you about Strati’s own menus, available dates and events. We only do this if you did not tick the box to opt out when you gave us your details, and we only email you about services similar to those you booked or asked about. We do not send marketing by text message or WhatsApp, and we never share your details with anyone else for their own marketing.

Every marketing email says who it is from and includes an unsubscribe link. You can also opt out at any time by emailing info@strati.uk. Opting out is free, does not affect your booking, and does not stop the emails we need to send you about a booking you have made.

We send marketing emails through Brevo. Brevo records whether each email is delivered and, in anonymised form, whether emails are opened or links are clicked, so that we can see how our emails perform overall. We do not use this to build a profile of you.

We keep your email address on our marketing list until you opt out. If 12 months pass without us sending you a marketing email, we remove you from the list. After you opt out, we keep only the minimum information needed to make sure we do not email you again.

Our newsletter

You can sign up to our newsletter on our website. We ask for your email address and, if you wish, your first name. After you sign up we email you a confirmation message, and we only add you to the newsletter list once you click the confirm button. If you do not confirm, we do not send you the newsletter.

We record where you signed up (for example the home page or a QR code at an event) so that we can see what is working, and which version of the sign-up wording you were shown. We send the newsletter through Brevo, which records whether each email is delivered and, in anonymised form, whether emails are opened or links are clicked. We do not use this to build a profile of you. We never share your details with anyone else for their own marketing.

Every newsletter includes an unsubscribe link. You can also unsubscribe at any time by emailing info@strati.uk. Signing up is optional and you do not need to sign up to book.

If you take up the canapés offer that comes with signing up, we use your email address, telephone number and event address to check that the booking is your first and to add the canapés to it.

We keep your details on the newsletter list until you unsubscribe. If 12 months pass without us sending you a newsletter or marketing email, we remove you from the list. After you unsubscribe, we keep only the minimum information needed to make sure we do not email you again. Sign-ups that are never confirmed are not added to the list and are deleted when we next clear them out, at least once a month.

How and why we use information

• Contract or steps before a contract: answering enquiries, planning menus, arranging travel and scheduling, taking payments, managing bookings, selling gift cards and communicating with the lead guest or gift card buyer.
• Legal obligations: keeping accounting and tax records and responding where the law requires us to.
• Legitimate interests: sending a gift card to the recipient chosen by the buyer and arranging their dinner, maintaining basic repeat-customer history, protecting the website and booking system, preventing fraud, selecting public reviews to display, and sending occasional marketing emails about our own similar services to customers and enquirers who have not opted out. We assess these interests against your rights.
• Consent: sending our newsletter to people who sign up for it on our website. You can withdraw consent at any time by unsubscribing.
• Separate explicit consent: identifiable dietary information, including health information and information that may reveal religious belief (UK GDPR Articles 6(1)(a) and 9(2)(a)).
• Separate optional permission: photography or video of food and table settings.

We do not use customer information for automated decision-making, profiling or AI-driven processing.

Who receives information

PocketBase is the database software we operate on Fly.io infrastructure. We do not sell personal information.

Website analytics

With your consent, we use Google Analytics to understand how people use our public website and improve it. Google receives technical information such as the pages viewed, browser and device information, cookie identifiers and network information including your IP address when connecting to its service. Our lawful basis for this processing is consent.

We do not send booking form answers, dietary information, guest names or customer details to Analytics. Private proposal pages, the guest dietary form and the lead guest’s guest page, administration pages, payment confirmation pages and the embedded booking form are excluded, and the private links to them are never sent. We strip query strings and fragments from the page addresses supplied to Analytics and reduce referrers to the referring website. Advertising personalisation and Google signals are disabled.

You can refuse analytics or withdraw consent at any time using Cookie settings at the bottom of the page, without affecting our services. Withdrawal stops future collection but does not undo previous processing. See our Cookie Notice and Google’s Privacy Policy. Google may process data outside the UK; its applicable data-processing and international-transfer arrangements form part of our provider review.

International transfers

Some providers operate outside the UK. Where personal information is transferred internationally, we use an appropriate UK-recognised mechanism after reviewing the relevant provider. Depending on the provider, this may include UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

This review covers providers including Stripe and the other international services listed above. You can ask info@strati.uk for more information about a provider’s arrangements.

How long we keep information

• Booking, contract, payment and tax records, including gift card purchases and their use: 6 years.
• Basic repeat-customer history: 6 years after the latest booking.
• Enquiries that do not become a booking: 12 months.
• Identifiable dietary information (allergy, health and other dietary information, including anything that may reveal religious belief), from guests, the lead guest or, for a bespoke event, the couple or organiser: 6 months after the event, so we can answer any questions or complaints about the meal, then deleted automatically. We do not reuse it for later bookings. Ordinary booking and accounting records are kept for longer, as listed above, without these details.
• Information needed for an active complaint or legal claim: until the matter and relevant legal retention period have ended.
• Marketing email list: until you opt out, or until 12 months pass without us sending you a marketing email.
• Marketing opt-out records: the minimum information needed to honour the opt-out.
• Newsletter list: until you unsubscribe, or until 12 months pass without us sending you a newsletter or marketing email. Unsubscribers: the minimum information needed to honour the unsubscribe. Sign-ups that are never confirmed: deleted when we next clear them out, at least once a month.

When a retention period ends, we delete or anonymise the information unless a legal hold requires it to be kept longer.

Security

Access to booking records is limited to Joseph and Emily through separate password-protected accounts. Booking collections are not publicly readable, connections to the website and booking API use HTTPS, administrative action links are signed and time-limited, and payment card details remain with Stripe. We apply access controls, request limits, security headers and operational checks to reduce unauthorised access or misuse.

No electronic system can be guaranteed completely secure. If a personal-data breach creates a risk to people, we will follow the applicable assessment, notification and record-keeping requirements.

Your rights

Depending on the circumstances, you may ask us for access to your information, correction, deletion, restriction or portability. Where we rely on consent, you can withdraw it at any time without affecting earlier lawful processing.

You have the right to object to processing based on legitimate interests. We will stop unless we have compelling legitimate grounds to continue or the information is needed for legal claims. If you object to marketing, we will always stop sending it.

Contact info@strati.uk to exercise a right. You can also complain to the Information Commissioner’s Office at ico.org.uk or telephone 0303 123 1113.

Cookies and changes

See our Cookie Notice for the current website technology. We will update this notice and its date when our practices materially change.

Contact us

Email: info@strati.uk

Service address: Molly Mackerels, Attleford Lane, Shackleford, GU8 6BL.