Privacy Policy

Last updated: 22/04/2026

This Privacy Policy explains how Roam Cafe Bistro (“we”, “us”, “our”) collects, uses and protects your personal data when you visit our website at roamcafebistro.co.uk (the “Website”), make a booking, apply for a job or otherwise get in touch.

We are committed to protecting your privacy and handling your data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

For the purposes of UK data protection law, Roam Cafe Bistro is the “data controller” of the personal data you provide via this Website.

Address: The Farmstead, Linmere, Houghton Regis, LU5 5GX
Email: info@roamcafebistro.co.uk
Phone: 01525 213989

2. What personal data we collect

We may collect and process the following categories of personal data:

Booking enquiries: name, email address, phone number, date and time of booking, party size, any dietary requirements or special requests.
General enquiries and feedback: name, email, phone (optional), message content.
Careers applications: name, county of residence, date of birth, email, current or previous employer, position applied for, CV and covering letter, any additional information you provide.
Website usage data: IP address, browser type, device type, pages visited, time spent on pages, referring website. This is collected via analytics and similar technologies (see Section 8 on cookies).

We do not knowingly collect personal data from children under 16. If you believe a child has provided data through our Website, please contact us and we will delete it.

3. How we collect your data

We collect personal data when you:

Fill in a form on our Website (booking, contact, careers)
Email or call us directly
Interact with our social media accounts (Instagram, TikTok, Facebook)
Browse our Website (via cookies and analytics)
Leave a review on third-party platforms (e.g. Google)

4. Why we use your data and the lawful basis

We use your personal data for the following purposes, each under one of the lawful bases set out in UK GDPR:

Purpose	Lawful basis
To confirm, manage and amend your booking	Contract — taking steps at your request prior to entering a contract with you
To respond to general enquiries or feedback	Legitimate interests — responding to people who contact us
To consider your careers application and communicate with you about it	Legitimate interests — hiring staff, or pre-contract steps if we make you an offer
To operate, secure and improve the Website	Legitimate interests — running and maintaining a functional, secure site
To send marketing communications (only if you opt in)	Consent
To meet our legal or regulatory obligations (e.g. tax, health and safety, complaints)	Legal obligation

You can withdraw your consent at any time where we rely on consent (see Section 10).

5. Who we share your data with

We do not sell your personal data. We may share it with:

Service providers that help us run the business, including our website host, email provider, booking and form software, analytics provider and IT support. These providers only process your data on our instructions and under contract.
Legal and professional advisors where needed to protect our legal rights or comply with the law.
Public authorities where required by law (e.g. HMRC, law enforcement).

Where a service provider is based outside the UK, we take steps to ensure your data is protected to UK GDPR standards, for example through approved transfer mechanisms such as the UK International Data Transfer Agreement.

6. How long we keep your data

We only keep your personal data for as long as we need it for the purpose we collected it for, and to meet any legal obligations.

Booking data: typically up to 12 months after the booking date.
General enquiries and feedback: typically up to 24 months after the last contact.
Careers applications (unsuccessful): typically up to 12 months after the recruitment decision, unless you ask us to delete it sooner.
Careers applications (successful): retained as part of your employment file in line with employment law.
Website analytics data: retained in aggregate form in line with our analytics provider’s standard retention periods.

7. How we protect your data

We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access or disclosure. These include secure hosting, access controls, staff training and regular review of our processes. No transmission of data over the internet can be guaranteed 100% secure, but we work to minimise the risks.

8. Cookies and analytics

Our Website uses cookies and similar technologies to make it work, to remember your preferences and to help us understand how it’s used.

Strictly necessary cookies keep the site working (e.g. forms, security). These do not require consent.
Analytics cookies (e.g. Google Analytics) help us see which pages are popular and how we can improve. These are only set if you give consent via the cookie banner.
Marketing cookies (if used) may be set by embedded tools such as social media widgets or advertising pixels. These are only set if you give consent.

You can manage or withdraw your cookie consent at any time via the cookie banner or your browser settings.

9. Third-party links and social media

Our Website may contain links to external sites (e.g. Google Maps, Instagram, TikTok, Facebook). We are not responsible for the privacy practices of those sites. Please review their privacy policies before providing any personal data.

10. Your rights

Under UK GDPR you have the following rights in relation to your personal data:

Right of access — to request a copy of the data we hold about you.
Right to rectification — to ask us to correct inaccurate or incomplete data.
Right to erasure — to ask us to delete your data in certain circumstances.
Right to restrict processing — to ask us to pause processing in certain circumstances.
Right to object — to object to our processing where we rely on legitimate interests, or to direct marketing.
Right to data portability — to receive your data in a structured, commonly used format.
Right to withdraw consent — where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us using the details in Section 12. We will respond within one month, in line with UK GDPR.

11. Complaints

If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator:

Website: ico.org.uk
Helpline: 0303 123 1113

12. Contact us

For any questions about this Privacy Policy or your personal data, please contact us:

Email: info@roamcafebistro.co.uk
Phone: 01525 213989
Address: Roam Cafe Bistro, The Farmstead, Linmere, Houghton Regis, LU5 5GX

13. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available on this page, with the “Last updated” date refreshed accordingly. Where changes are significant, we will make reasonable efforts to let you know directly (e.g. by email if we have your address for that purpose).