PRIVACY POLICY
No. Forty Nine
Operated by Cinder Restaurants Ltd
Registered Office:
159 High Street
Barnet
EN5 5SU
United Kingdom
Website: nofortynine.co.uk
Last updated: 10 August 2026
1. ABOUT THIS PRIVACY POLICY
At No. Forty Nine, we respect your privacy and are committed to protecting your personal information.
This Privacy Policy explains how Cinder Restaurants Ltd, trading as No. Forty Nine, collects, uses, stores and protects personal information relating to customers, website visitors, people making enquiries, job applicants and other individuals who interact with us.
Cinder Restaurants Ltd is the data controller for the personal information covered by this Privacy Policy. This Privacy Policy applies when you:
• visit or use our website;
• make or manage a reservation;
• dine at No. Forty Nine;
• contact us by telephone, email, social media or another communication method; • sign up to receive marketing communications;
• provide feedback or make a complaint;
• apply for a position with us; or
• otherwise interact with No. Forty Nine or Cinder Restaurants Ltd.
We process personal data in accordance with applicable UK data-protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR) and applicable amendments made by the Data (Use and Access) Act 2025.
2. WHO WE ARE
The organisation responsible for your personal data is:
Cinder Restaurants Ltd
159 High Street
Barnet
EN5 5SU
United Kingdom
Cinder Restaurants Ltd operates the No. Forty Nine restaurant.
For the purposes of UK data-protection law, Cinder Restaurants Ltd is generally the data controller of personal information collected through No. Forty Nine’s own operations.
If you make a reservation through OpenTable, OpenTable may also process your personal information under its own privacy arrangements. OpenTable’s own privacy policy explains how it processes information through its platform.
3. INFORMATION WE COLLECT
Depending on how you interact with us, we may collect different categories of personal information.
3.1 Information you provide directly
This may include:
• your name;
• telephone number;
• email address;
• postal address where relevant;
• reservation details;
• number of guests;
• date and time of your reservation;
• special requests;
• dietary or accessibility requirements that you choose to tell us about;
• birthday or celebration information where provided;
• preferences relating to your visit;
• correspondence between you and No. Forty Nine;
• feedback, reviews or complaints;
• information provided when entering a competition or promotion;
• information provided when applying for employment.
We will only ask for information that is reasonably necessary for the relevant purpose.
3.2 Reservation information
Reservations at No. Forty Nine are facilitated through OpenTable.
When you make a reservation, information such as your name, contact details, booking details, party size, special requests and other information necessary to manage your reservation may be processed by OpenTable and made available to No. Forty Nine.
We use this information to:
• administer your reservation;
• contact you regarding your booking;
• accommodate reasonable requests;
• manage cancellations and no-shows;
• provide an appropriate dining experience;
• communicate important information relating to your booking; and
• maintain appropriate records of restaurant activity.
OpenTable may separately process your information under its own privacy policy and terms. OpenTable states that it shares information with restaurants to facilitate reservations and related services.
3.3 Information collected when you visit our website
When you visit our website, we may collect information such as:
• IP address;
• browser type and version;
• device information;
• operating system;
• approximate geographical information;
• pages visited;
• time and date of visits;
• referring websites;
• website interaction information; and
• information collected through cookies or similar technologies.
Some of this information may constitute personal data where it can reasonably be associated with an identifiable individual.
3.4 Information collected when you contact us
If you contact us by telephone, email, social media, website form or another method, we may retain the information necessary to respond to your enquiry and maintain appropriate records.
This may include your name, contact details, the contents of your communication and any information you choose to provide.
3.5 CCTV
CCTV may operate at or around No. Forty Nine for legitimate security and safety purposes.
Where CCTV is used, it may capture images of customers, employees, contractors and members of the public.
CCTV may be used for:
• the prevention and detection of crime;
• the safety of customers, staff and visitors;
• the protection of our premises and property;
• investigating incidents;
• supporting investigations by law-enforcement authorities where appropriate; and • establishing, exercising or defending legal claims.
CCTV is not used to monitor customers for marketing purposes.
CCTV footage is retained only for as long as reasonably necessary for its stated purposes, subject to any requirement to preserve particular footage because of an incident, investigation, complaint, legal claim or law-enforcement request.
CCTV use will be subject to appropriate signage and controls.
The Information Commissioner’s Office expects organisations using CCTV to consider necessity, proportionality, transparency, security and retention, and small businesses using CCTV may have an obligation to register and pay the relevant data-protection fee.
4. HOW WE USE YOUR PERSONAL INFORMATION
We may use personal information for the following purposes:
Reservations and customer service
To:
• process and administer reservations;
• contact you about your booking;
• accommodate requests;
• manage table availability;
• communicate changes to reservations;
• manage cancellations and no-shows;
• provide customer service; and
• provide and improve your experience at No. Forty Nine.
Restaurant operations
To:
• manage day-to-day restaurant operations;
• understand customer requirements;
• maintain appropriate business records;
• investigate complaints and incidents;
• protect our customers, staff and property;
• prevent fraud, misuse or other unlawful activity; and
• establish, exercise or defend legal claims.
Marketing
Where permitted by law and, where required, with your consent, we may use your personal information to send:
• news about No. Forty Nine;
• invitations;
• events information;
• offers and promotions;
• restaurant updates; and
• other marketing communications.
You can unsubscribe from marketing communications at any time.
Website management
To:
• operate and maintain our website;
• monitor website performance;
• understand how visitors use our website;
• improve website functionality; and
• maintain website security.
Recruitment
Where you apply for employment or another position with Cinder Restaurants Ltd, we may process information provided as part of your application.
This may include:
• your name and contact details;
• CV and employment history;
• qualifications;
• references;
• right-to-work information;
• interview information; and
• other information reasonably necessary to assess your suitability for employment.
Recruitment information will be processed for recruitment and employment-related purposes and in accordance with applicable employment and data-protection legislation.
5. OUR LAWFUL BASES FOR PROCESSING YOUR INFORMATION
Under UK data-protection law, we must have a lawful basis for processing personal information. Depending on the circumstances, we may rely on one or more of the following:
Contract
We may process information where it is necessary to take steps at your request before entering into an arrangement with you or to perform an arrangement with you.
For example, this may apply to managing a reservation or providing services you have requested. Legal obligation
We may process personal information where necessary to comply with a legal obligation. This may include obligations relating to:
• accounting;
• taxation;
• employment;
• health and safety;
• licensing;
• legal proceedings; and
• regulatory requirements.
Legitimate interests
We may process personal information where this is necessary for our legitimate interests, provided those interests are not overridden by your rights and interests.
Our legitimate interests may include:
• operating and managing our restaurant;
• providing customer service;
• maintaining security;
• preventing fraud and crime;
• managing complaints;
• improving our services;
• maintaining appropriate business records;
• protecting our business and property;
• communicating with customers where permitted by law; and
• establishing, exercising or defending legal claims.
Where we rely on legitimate interests, we consider whether the processing is necessary and proportionate and whether your rights and interests are appropriately protected.
Consent
Where required by law, we will ask for your consent before processing your personal information for a particular purpose.
For example, this may apply to certain electronic marketing or non-essential cookies. Where processing is based on consent, you may withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing that took place before you withdrew it.
The ICO confirms that organisations must identify and communicate their lawful basis for each relevant processing purpose.
6. SPECIAL CATEGORY INFORMATION
Certain information is considered “special category data” under UK data-protection law.
In a restaurant context, you may voluntarily provide information relating to allergies, dietary requirements or medical conditions.
For example, you may tell us that you have a food allergy or medical condition requiring particular precautions.
Where information you provide constitutes special category data, we will only process it where there is an appropriate lawful basis and special-category condition under applicable law.
We may use such information to:
• help us respond appropriately to your requirements;
• protect your health and safety;
• communicate relevant information to our kitchen or service team;
• provide the services you have requested; and
• comply with applicable legal obligations.
You should only provide sensitive information where it is relevant to your request.
7. MARKETING
We may send marketing communications where permitted by applicable law.
This may include information about:
• new menus;
• restaurant events;
• special occasions;
• private dining;
• promotions;
• restaurant news; and
• other No. Forty Nine activities.
Where consent is required, we will ask for it before sending the relevant marketing communications. You can stop receiving marketing communications at any time by:
• using the unsubscribe option contained in the relevant communication; or
• contacting us using the details in Section 17 of this Privacy Policy.
Stopping marketing communications will not affect service-related communications, such as information about an existing reservation.
8. COOKIES AND SIMILAR TECHNOLOGIES
Our website may use cookies and similar technologies.
Cookies are small text files placed on your device which can help websites operate and remember information about your visit.
We may use cookies for purposes including:
• essential website functionality;
• security;
• remembering preferences;
• understanding website usage;
• analysing website performance; and
• marketing or advertising, where applicable and permitted.
Where required, we will ask for your consent before placing non-essential cookies on your device.
You can control or delete cookies through your browser settings. Disabling certain cookies may affect the functionality of parts of our website.
Where third-party services place cookies or similar technologies on our website, their processing may also be governed by their own privacy policies.
9. THIRD-PARTY SERVICE PROVIDERS
We may use trusted third-party suppliers and service providers to help operate No. Forty Nine. Depending on the services we use, these may include providers of:
• restaurant reservation systems;
• payment services;
• website hosting;
• website analytics;
• email and communications;
• IT services;
• accounting and financial services;
• CCTV and security systems;
• marketing services;
• recruitment services;
• customer relationship management systems; and
• professional, legal or regulatory services.
We only permit suppliers to process personal information where appropriate and require appropriate contractual and security arrangements where applicable.
10. OPENTABLE
No. Forty Nine uses OpenTable to facilitate restaurant reservations.
When you make or manage a reservation through OpenTable, your information may be processed by both OpenTable and No. Forty Nine as applicable to the relevant service.
OpenTable has its own privacy policy governing its processing activities. OpenTable explains that it may collect information such as contact details and dining information and may share relevant information with restaurants to facilitate bookings and related services.
You should review OpenTable’s privacy information if you wish to understand how OpenTable processes your information independently of No. Forty Nine.
11. WHO WE MAY SHARE YOUR INFORMATION WITH
We may share personal information where reasonably necessary with:
• OpenTable;
• service providers and contractors;
• payment processors;
• IT and website providers;
• professional advisers;
• accountants and auditors;
• insurers;
• legal advisers;
• regulators and public authorities;
• law-enforcement agencies where appropriate;
• courts or tribunals where required;
• prospective purchasers or investors in connection with a business transaction; and • other third parties where required or permitted by law.
We do not sell your personal information to third parties.
We will not share personal information with third parties for their own direct marketing purposes unless this is lawful and appropriately authorised.
12. INTERNATIONAL TRANSFERS
Some of our suppliers or service providers may process personal information outside the United Kingdom.
Where personal information is transferred outside the UK, we will ensure that appropriate safeguards are in place as required by applicable data-protection law.
These safeguards may include:
• an adequacy regulation or decision;
• appropriate contractual safeguards;
• the UK International Data Transfer Agreement;
• the UK Addendum to applicable standard contractual clauses; or
• another lawful transfer mechanism.
Where appropriate, further information about relevant safeguards can be obtained by contacting us.
13. HOW LONG WE KEEP YOUR INFORMATION
We will not keep personal information for longer than is reasonably necessary for the purpose for which it was collected, unless we are required or permitted by law to retain it for longer.
Retention periods may vary depending on the type of information.
As a general guide:
Information Typical retention approach
Reservation information Retained for as long as reasonably necessary for restaurant operations,
customer service, legal and accounting
purposes
Customer enquiries Retained for as long as reasonably necessary to deal with the enquiry and
any resulting matter
Marketing information Until you unsubscribe, withdraw consent or the information is no longer required
Customer complaints Retained for as long as reasonably necessary to investigate and resolve the
complaint and protect our legal interests
CCTV footage Normally retained for a limited period appropriate to the security purpose, unless
required for an incident, investigation or
legal matter
Financial records Retained for periods required by
applicable accounting and tax legislation
Recruitment records Retained for a reasonable period following completion of recruitment, unless longer
retention is justified or required
Where a legal claim, investigation or regulatory matter requires us to retain information, we may retain relevant information for the duration of that matter and any applicable limitation period.
Retention periods are reviewed periodically.
14. HOW WE PROTECT YOUR INFORMATION
We take reasonable and appropriate technical and organisational measures to protect personal information against:
• unauthorised access;
• accidental loss;
• destruction;
• alteration;
• disclosure; and
• other unlawful or unauthorised processing.
Access to personal information is limited to people who need it for legitimate business purposes. Where appropriate, we use measures such as:
• password protection;
• access controls;
• secure systems;
• staff confidentiality requirements;
• supplier due diligence;
• appropriate contractual controls; and
• secure disposal of information.
However, no electronic transmission or storage system can be guaranteed to be completely secure.
15. YOUR DATA PROTECTION RIGHTS
Depending on the circumstances and subject to applicable legal conditions and exemptions, you may have the following rights:
Right to be informed
You have the right to receive clear information about how we use your personal information. This Privacy Policy provides that information.
Right of access
You can ask us for a copy of personal information we hold about you.
Right to rectification
You can ask us to correct inaccurate or incomplete information.
Right to erasure
In certain circumstances, you can ask us to delete your personal information.
This is sometimes referred to as the “right to be forgotten”.
Right to restrict processing
In certain circumstances, you can ask us to restrict how we use your personal information. Right to data portability
In certain circumstances, you may have the right to receive personal information you have provided to us in a structured, commonly used and machine-readable format and to request that it be transferred to another organisation.
Right to object
You may have the right to object to certain processing, including processing based on legitimate interests. You have an absolute right to object to the use of your personal information for direct marketing. Rights relating to automated decision-making
Where applicable, you may have rights relating to decisions made solely by automated processing that produce legal or similarly significant effects.
We do not currently intend to make significant decisions about our customers solely through automated decision-making.
The precise availability of these rights depends on the circumstances and the lawful basis on which we process your information. The ICO’s current guidance confirms these individual rights and the circumstances in which they apply.
16. HOW TO EXERCISE YOUR RIGHTS
If you wish to exercise any of your data-protection rights, please contact us.
Please provide enough information to allow us to identify you and understand your request.
We may need to request additional information to verify your identity before releasing or changing personal information.
We will respond to valid requests within the time period required by applicable data-protection law.
We will not normally charge a fee for exercising your data-protection rights. However, applicable law permits organisations to charge a reasonable fee or refuse to act in certain circumstances, including where requests are manifestly unfounded or excessive.
17. CONTACTING US ABOUT PRIVACY
For questions about this Privacy Policy, your personal information or your data-protection rights, please contact:
Cinder Restaurants Ltd
159 High Street
Barnet
EN5 5SU
United Kingdom
Website: nofortynine.co.uk
You may contact No. Forty Nine through the contact details published on our website.
If Cinder Restaurants Ltd appoints a dedicated Data Protection Officer or privacy contact in the future, the relevant contact details will be added to this Privacy Policy.
18. COMPLAINTS
We hope that we can resolve any privacy concerns you have directly.
If you are unhappy with how we have handled your personal information, you can contact us using the details above.
You also have the right to complain to the UK’s data-protection regulator:
Information Commissioner’s Office (ICO)
The ICO is the independent supervisory authority responsible for data-protection matters in the UK. Further information about making a complaint is available through the ICO’s website.
We would encourage you to contact us first so that we have an opportunity to investigate and resolve your concern.
19. CHILDREN
Our website and services are not specifically directed at children.
Where a child visits No. Forty Nine with a parent, guardian or other responsible adult, we may process information necessary to provide our services, including information relating to dietary requirements or allergies where this is voluntarily provided.
We do not knowingly collect children’s personal information for marketing purposes.
20. SOCIAL MEDIA
No. Forty Nine may operate or maintain social-media profiles.
If you interact with us through a social-media platform, the relevant platform may process your personal information independently of us.
Your use of those platforms is subject to their own privacy policies and terms.
We may receive information that you choose to provide to us through social media, such as comments, messages or other communications.
We may use this information to respond to you, manage our social-media presence and deal with customer enquiries or complaints.
21. THIRD-PARTY WEBSITES
Our website may contain links to websites operated by third parties.
These websites operate independently from Cinder Restaurants Ltd and may have their own privacy policies.
We are not responsible for the privacy practices, content or security of third-party websites. You should review the privacy policy of any third-party website before providing personal information.
22. DATA BREACHES
We maintain procedures designed to identify, assess and respond to personal-data breaches.
If a personal-data breach occurs, we will assess the incident and take appropriate steps in accordance with applicable law.
Where legally required, we will notify the Information Commissioner’s Office and/or affected individuals.
23. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect:
• changes to our business;
• changes to the services we use;
• changes to how we process personal information;
• changes to applicable law or regulatory guidance; or
• improvements to our privacy practices.
The latest version will be published on our website.
Where required by law, we will provide additional notice of significant changes before they take effect.
24. GOVERNING LAW
This Privacy Policy is governed by the laws of England and Wales.
Any disputes relating to this Privacy Policy will be subject to the jurisdiction of the courts of England and Wales, except where applicable law provides otherwise.
25. SUMMARY
At No. Forty Nine, we aim to collect only information that we reasonably need, use it for clear and legitimate purposes, keep it secure and retain it only for as long as necessary.
If you have any questions about how we handle your personal information, please contact Cinder Restaurants Ltd using the details provided in this Privacy Policy.
Cinder Restaurants Ltd Trading as No. Forty Nine 159 High Street
Barnet
EN5 5SU
United Kingdom
Website: nofortynine.co.uk
Privacy Policy version: 1.0
Effective date: 10 August 2026