PRIVACY POLICY

Last updated: 6 May 2026

Smokestack (“we”, “us”, “our”) is committed to protecting your privacy. This policy explains what personal information we collect, how we use it, who we share it with, and the rights you have under UK data protection law.

If anything below isn’t clear, get in touch — details are at the bottom of the page.


1. Who we are

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the data controller is:

Smokestack Cocktails Limited (trading as Smokestack) Company number: 13272303 Registered in England and Wales

Trading address: 159a Lower Briggate, Leeds, LS1 6LY Email: bookings@smokestackleeds.co.uk Phone: 0113 245 2222


2. The information we collect

We only collect information that we actually need to run the bar, take bookings, market our events, and keep the website working properly.

Information you give us directly

  • Bookings — your name, email address, phone number, party size, date, time, and any notes you add (dietary requirements, occasion, etc.). Table bookings, private hire enquiries and masterclass bookings all fall under this.
  • Mailing list sign-ups — your email address, and your name if you choose to provide it.
  • Enquiries — anything you send us by email, phone, social media DM, or contact form.
  • Payments — when you pay a deposit or settle a tab, your card details are handled directly by our payment provider. We don’t see or store your full card number.

Information we collect automatically

  • Website analytics — when you visit our site we collect anonymised technical data through cookies and similar technologies, including IP address, browser type, device type, pages viewed and time spent. This helps us understand what’s working and what isn’t.
  • CCTV — for the safety of our staff and guests, CCTV operates inside the venue. Footage is recorded and retained for a limited period before being overwritten.

Information from third parties

  • Social media — if you tag us, message us, or interact with our posts on Instagram or Facebook, we’ll see whatever those platforms make visible to us.
  • Booking platforms — when you book through OrderTab (our booking system), we receive the details you enter into their form.

3. How we use your information and why we’re allowed to

UK GDPR requires us to have a “lawful basis” for processing your personal data. Here’s what we do with your information and the basis we rely on:

What we use your data for Lawful basis
Managing your booking, masterclass or private hire Contract — we need this to provide the service you’ve asked for
Replying to your enquiries Legitimate interests — responding to customers who contact us
Sending you our newsletter and offers Consent — you ticked the box, and you can untick it any time
Running the website and improving it Legitimate interests — keeping the site secure, fast and useful
Operating CCTV at the venue Legitimate interests — protecting staff, customers and the premises
Meeting our legal and tax obligations Legal obligation — we have to keep certain records for HMRC and other authorities
Defending legal claims Legitimate interests — if something goes wrong, we may need records to protect our position

We don’t sell your personal data. Ever. To anyone.


4. Marketing emails

If you’ve signed up to our mailing list, we’ll send you occasional updates about events, offers, new menus and the odd story from behind the bar.

You can unsubscribe at any time using the link at the bottom of every email, or by emailing bookings@smokestackleeds.co.uk. Once you unsubscribe, we’ll stop — though we may still need to email you about a specific booking you’ve made.

We won’t pass your email to other companies for their own marketing.


5. Cookies and tracking

A cookie is a small text file that gets stored on your device when you visit a website. We use cookies for a few different purposes:

  • Strictly necessary cookies — these make the site work. Things like remembering your cookie preferences or letting you navigate between pages. These don’t need your consent.
  • Analytics cookies — these help us understand how people use the site, so we can make it better. We use Google Analytics for this. The data is aggregated and doesn’t identify you personally.
  • Marketing cookies — if these are running, they help us measure how effective our advertising is and show you more relevant content on other sites.

When you first visit our site, you’ll see a banner letting you accept or manage cookies. You can change your preferences at any time, and you can also block or delete cookies through your browser settings — though doing so may break parts of the site.

[To be confirmed: exact list of cookie providers in use. Common ones for an Elementor/WordPress site include Google Analytics, Meta Pixel, and Elementor’s own session cookies. A cookie audit using a tool like Cookiebot or a manual scan is worth running before publishing this policy.]


6. Who we share your data with

We only share your information with third parties who help us run the business, and only as much as they need to do their job. The main ones are:

  • OrderTab — our booking and table management platform. They handle the booking details you submit through their forms.
  • Our email marketing platform — we use a third-party email marketing service to send our newsletter and store our subscriber list. Your email address (and name, if you’ve given it to us) is held on their systems while you’re subscribed.
  • Payment processors — for card payments at the bar and for masterclass and private hire deposits.
  • Hosting and IT providers — the companies that keep our website running and back up our data.
  • Google — for website analytics and embedded maps.
  • Meta (Facebook & Instagram) — for social embeds and any advertising we run on their platforms.
  • Our accountants and professional advisers — where there’s a genuine business need.

We may also share information where we’re legally required to — for example, with the police, courts, or other regulatory bodies.


7. Where your data goes

Most of our suppliers are based in the UK or EU. Some — like Google and Meta — are US companies. When data leaves the UK, we make sure there’s a proper legal mechanism in place (usually a UK adequacy decision or the International Data Transfer Agreement) so your information stays protected to the same standard as it would here.


8. How long we keep your data

We don’t hold onto your data forever. Here’s a rough guide:

  • Booking details — kept for up to 2 years after your visit, for operational and reporting reasons.
  • Mailing list — kept until you unsubscribe, after which we’ll remove your details within 30 days (we may keep a suppression record so we don’t accidentally re-add you).
  • Enquiries — kept for up to 2 years after the conversation ends, unless they relate to a complaint or a booking that took place.
  • Financial records — kept for 6 years, in line with HMRC requirements.
  • CCTV footage — typically retained for around 30 days before being overwritten, unless an incident requires it to be kept longer.
  • Website analytics — anonymised and retained according to Google Analytics’ default settings (currently 14 months).

9. Your rights

Under UK GDPR you have a number of rights over your personal data:

  • The right to be informed — you’re reading it now.
  • The right of access — you can ask us for a copy of the personal data we hold about you.
  • The right to rectification — if something we hold is wrong, we’ll correct it.
  • The right to erasure — you can ask us to delete your data, in most circumstances.
  • The right to restrict processing — you can ask us to stop using your data in certain ways.
  • The right to data portability — you can ask for your data in a portable format.
  • The right to object — you can object to us processing your data for marketing or based on legitimate interests.
  • The right to withdraw consent — where we rely on your consent, you can take it back any time.
  • Rights in relation to automated decisions — we don’t make automated decisions about you, so this one’s straightforward.

To exercise any of these rights, email bookings@smokestackleeds.co.uk. We’ll respond within one month. There’s no charge unless your request is excessive or repeated, in which case we may charge a reasonable fee or decline to act.


10. Keeping your data safe

We take reasonable steps to protect your data. Our website runs over HTTPS, our suppliers are chosen with security in mind, and access to personal data is limited to people who actually need it.

That said, no system is completely secure. If something does go wrong, we’ll tell you and the Information Commissioner’s Office (ICO) where the law requires us to.


11. CCTV

We operate CCTV at the venue for the safety of our staff and guests, and to protect the premises. Cameras cover public areas only — never toilets or staff-only spaces. Signs are displayed at the entrance to let you know recording is in progress.

Footage is held securely, accessed only by authorised people, and overwritten on a rolling basis unless we need to keep it for a specific reason (e.g. an incident, or a request from the police).


12. Children

Smokestack is a licensed venue and our website isn’t directed at children. We don’t knowingly collect personal data from anyone under 18. If you think we’ve accidentally got data on a child, let us know and we’ll remove it.


13. Changes to this policy

We’ll update this policy from time to time as things change — new tools, new services, new legal requirements. The date at the top tells you when it was last revised. If we make significant changes, we’ll let you know either by email or with a notice on the website.


14. Complaints

If you’re not happy with how we’ve handled your data, please get in touch first so we can try to put it right.

If you’re still not satisfied, you have the right to complain to the UK’s data protection regulator:

Information Commissioner’s Office Wycliffe House, Water Lane Wilmslow, Cheshire SK9 5AF

Phone: 0303 123 1113 Website: ico.org.uk


15. Get in touch

For anything privacy-related — questions, requests, complaints, or just to flag something — contact us at:

Email: bookings@smokestackleeds.co.uk Phone: 0113 245 2222 Post: Smokestack, 159a Lower Briggate, Leeds, LS1 6LY