Privacy notice

This website is run by Bluewater Restaurant Group Ltd ("BRG", "we", "us"). We run the Shrimp & Co restaurants in Brixton and Walthamstow in London, Broad Street and Star City in Birmingham, and Middlesbrough (opening soon).

• Company number: 15728520, registered in England and Wales
• Registered office: Hampton Tower, Flat 1710, 75 Marsh Wall, London E14 9WS

BRG is the controller of the personal information described in this notice. This means we decide how and why it is used, and we are responsible for looking after it.

• You can look around this website without telling us who you are. It sets no cookies.
• We only collect personal information when you send us something: a message, a job application, a table booking through OpenTable or, once our own online booking opens, a table booking on this website.
• We use it to reply to you, to consider your application or to look after your booking. We never sell it.
• We delete CVs six months after they arrive.
• You can ask to see, correct or delete your information at any time.

When you use the contact form on our corporate page, we collect:

• which team your message is for (property, partnerships, press or general enquiries)
• your name and email address
• your phone number and company name, if you give them
• your message
• the date and time it arrived

Your message goes straight from the website to our team's inbox in our own management system. The website itself does not keep a copy. The people in our team who deal with that kind of message read it and reply to you by email. You do not have to send us these details, but we cannot reply to you without your name and email address.

When you apply through our careers page, we collect:

• the kind of job you are looking for and which of our restaurants you would like to work at
• your name, email address and mobile number
• whether you have the right to work in the UK
• when you could start, if you tell us
• anything you write about yourself
• your CV and its file name, if you attach one (a PDF, Word document or photo, up to 4 MB)
• the date and time it arrived

Your application goes straight from the website to our team's inbox. The website itself does not keep a copy. Only our managers and head office team can see it. You do not have to apply through this website, but we cannot consider an application without the details the form asks for.

We do not ask for sensitive information, such as your health, religion, ethnic origin or any criminal record. Please leave it out of your CV and your message. If you include it anyway, we will not use it to decide on your application.

A person reads every application. We do not make decisions about you by automated means.

This website does not take bookings itself yet. To book a table, use the Book buttons, which take you to OpenTable, or call the restaurant.

Booking through OpenTable. OpenTable runs its own booking website. When you book there, OpenTable collects your details under its own privacy policy and passes your booking to the restaurant you chose. We use what it shares with us (your name, contact details, the date, time and number of guests, and any notes you add) only to look after your booking and your visit. Please read OpenTable's privacy policy before you book.

Our own online booking, once it opens. Booking a table on this website will collect:

• the restaurant, date, time and number of guests
• your name, mobile number and email address
• the occasion, if you choose one
• any allergies or dietary needs you tell us about
• any other note you add
• whether you ticked the box to receive news and offers from Shrimp & Co

Your booking will go from the website straight to the diary of the restaurant you chose, in our own booking system, and to no other restaurant. The website itself will not keep a copy. We will use your mobile number and email address to confirm your booking and to contact you about it.

Allergies and dietary needs can reveal information about your health, which the law treats as a special category of personal information. We ask for it only so our kitchen can prepare your food safely, and we use it only for your booking. Telling us online is optional: you can always tell our team at the restaurant instead.

The news and offers box is unticked unless you tick it. If you tick it, we may send you news and offers from Shrimp & Co by email. We send nothing of the kind unless you have agreed, and every message will tell you how to stop.

Measuring visits. We use Vercel Web Analytics to count visits and see which pages are useful. It does not use cookies and stores nothing on your device. For each page view it records the page address, the site that sent you here, the time, your device type, operating system and browser, and an approximate location (country, region and town) worked out from your internet (IP) address. To tell visits apart, it makes a temporary code from your request, which is discarded after 24 hours. We only ever see totals, and nothing in them identifies you. If your browser sends a Global Privacy Control signal, we do not count your visit at all.

Technical logs. Like every website host, our hosting provider receives your IP address and browser details when your browser asks for a page. It uses them to deliver the page and to protect the website against attacks, and keeps its logs for a short time.

Spam protection. When you send a form, the website turns your IP address into a scrambled one-way code, using a secret key, and sends only that code with your form. We use it only to limit how many forms can be sent from one place in an hour, so that nobody can flood our inbox. Your IP address itself is not stored with your form.

Data protection law says we must have a lawful basis for each way we use personal information. Ours are:

• Replying to your message: our legitimate interests in answering people who contact us and in running our business.
• Considering your job application and contacting you about it: because you have asked us to consider you for a job, and our legitimate interests in recruiting the right people.
• Asking whether you can work in the UK: our legitimate interests, because we can only employ people who have the right to work here and must check this before anyone starts.
• Taking and managing your booking: because you have asked us to, so we can do what you asked.
• Allergies and dietary needs: your explicit consent, which you give by choosing to tell us. If you would rather we did not hold it, tell us and we will remove it, but please then tell our team at the restaurant before you order.
• News and offers: your consent. You can withdraw it at any time.
• Measuring visits: our legitimate interests in understanding how the website is used, using totals only.
• Technical logs and spam protection: our legitimate interests in keeping the website and our inbox safe and working.
• Legal claims and duties: where we need to keep or share information to meet a legal duty, or to make or defend a legal claim.

Where we rely on legitimate interests, we have weighed our interests against your rights and expectations. You can object at any time (see "Your rights").

We never sell your personal information. We use these service providers to run the website and our systems. They handle your information only on our instructions, under contracts that require them to keep it safe:

• Vercel Inc. hosts this website, our management system and our booking system, runs the code that receives your forms, and provides Vercel Web Analytics.
• Supabase Inc. hosts the databases that store your messages, applications, CVs and, once online booking opens, bookings, on servers in London.
• OpenTable, which runs the booking website you reach through our Book buttons. It collects your booking under its own privacy policy and holds it for the restaurant you chose.
• Our email provider carries the emails we send you and your replies to us.

We may also share information:

• with our professional advisers, such as lawyers and accountants, where they need it
• with the police, regulators or courts, where the law requires it or to protect someone's safety
• with a buyer or investor if all or part of our business is sold or reorganised, who would have to look after it as this notice describes

If you follow a link from this website to another site, such as maps for directions, our social media pages, news articles about us, or a calendar or messaging app to share a booking, that site's own privacy notice applies.

Vercel and Supabase are based in the United States. Our databases are in London and our management system runs in London, but some processing can take place outside the UK, including in the United States. For example, the website's servers may handle your form there on its way to us, measurement totals may be stored there, and our providers' support staff may access our systems to keep their services running.

Where information is sent outside the UK, we rely on the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, which form part of each provider's data processing terms. You can ask us for more details.

• Messages: up to two years after they arrive, then we delete them.
• CVs: deleted automatically six months after they arrive.
• The rest of a job application: up to twelve months after it arrives, then we delete it. If you come to work with us, what we need becomes part of your staff record.
• Bookings made through OpenTable: kept in our restaurants' OpenTable accounts only as long as we need them to look after your visit and keep our records. OpenTable's own privacy policy explains what OpenTable keeps.
• Bookings, once our own online booking opens: we will set out here how long we keep booking details, including any allergies or notes, before online booking opens.
• News and offers: until you ask us to stop. After that we keep your email address on a list of people not to contact, so we do not message you by mistake.
• Spam protection codes: kept with the form they came with, and deleted with it.
• Measuring visits: the temporary visitor code is discarded after 24 hours. The totals we keep do not identify anyone.
• Technical logs: kept by our hosting provider for a short time, normally no more than 30 days.

If there is a complaint or a legal claim, we keep what we need until it has been dealt with.

• Everything you send travels over an encrypted connection.
• The website sends your form to our inbox with a secret key, so nothing else can add to it.
• Your information can only be read through our own systems, by our managers and head office team.
• CVs can only be downloaded by people with access to our inbox.

You have the right to:

• ask for a copy of the personal information we hold about you
• ask us to correct anything that is wrong or incomplete
• ask us to delete your information
• ask us to limit how we use it
• object to how we use it where we rely on legitimate interests, and to stop news and offers at any time
• ask for information you gave us in a format you can take elsewhere
• withdraw your consent at any time, where we rely on it

To use any of these rights, contact us as described below. We may ask you to prove who you are. We will reply within one month. If your request is complicated, we may need up to two more months, and we will tell you if so. There is normally no charge.

You can contact us about this notice or your information:

• By post: Data protection, Bluewater Restaurant Group Ltd, Hampton Tower, Flat 1710, 75 Marsh Wall, London E14 9WS
• Online: use the contact form on our corporate page. Choose "General enquiries" and start your message with "Privacy".

If you are unhappy with how we have used your information, please tell us first so we can try to put it right. We will acknowledge your complaint within 30 days and keep you updated.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:

• Website: ico.org.uk (opens in a new tab)
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

This website does not set any cookies.

It stores one setting in your browser. If you press the button that pauses the website's videos and motion, your browser remembers that choice in its local storage, under the name "sc-motion", so the website stays still on your next visit. It records only whether motion is paused, and it is never sent to us. Because it is needed for a feature you asked for, it does not need your consent. You can clear it at any time in your browser's settings.

Vercel Web Analytics, which we use to measure visits, does not use cookies or store anything on your device.

Other sites you reach through our links, such as maps and social media, may set their own cookies under their own policies.

If we ever add tools that do use cookies, such as Google Analytics or advertising tools, we will ask for your permission first and update this notice.

We will update this notice when the way we use personal information changes, for example when online booking opens. The date at the top shows when it last changed. We will make any significant change clear on this page.