Privacy notice

We only ask for what an order or a booking actually needs.

• To take an order: your name, email address, telephone number, what you ordered and — for delivery — your address. Our lawful basis is performance of a contract.
• To hold a table: your name, email address, telephone number, party size, and anything you tell us about an occasion or a dietary requirement. Lawful basis: performance of a contract.
• Dietary and allergy information: this can be health data, which is a special category under UK GDPR. We use it only to serve you safely, on the basis of your explicit consent, given when you type it into the booking or order form.
• If you create an account: a password, stored only as a bcrypt hash that cannot be reversed, plus your order history and Lacco Club points.
• If you opt in to marketing: your email address, on the basis of your consent, which you can withdraw at any time.

Card payments are processed by Stripe. Your card details are entered directly into Stripe’s systems and are never seen by, sent to, or stored on our servers. We keep only the outcome of the payment, the amount, and the last four digits and brand of the card so we can find your transaction if you need us to. Stripe is a separate controller for the data it processes; see stripe.com/gb/privacy.

A short list, and no one else:

• Stripe — card payments.
• Resend — sending your confirmation and receipt emails.
• Our hosting and database providers, which store the site and its records.
• Our AI assistant provider, if you use “Ask Lacco”, which receives your question and our menu. Do not type personal details into it.

We never sell your data, and we do not share it for anyone else’s marketing.

• Order and payment records: six years, because HMRC requires it for VAT.
• Reservations: two years, so we can recognise regulars and resolve disputes.
• Marketing consent: until you withdraw it.
• Accounts: until you close yours.

Under UK GDPR you can ask for a copy of your data, correct it, have it erased, restrict or object to how we use it, and take it elsewhere. If you have an account you can do the first two yourself in My account — including a one-click export of everything we hold and a request to close the account.

When you close an account we anonymise your order records rather than delete them, because VAT law requires us to keep the financial record. Everything that identifies you is removed.

For anything else, email info@laccorestaurant.co.uk or write to us at the address above. If you are unhappy with our response you can complain to the Information Commissioner’s Office at ico.org.uk.