Last updated: 11 September 2026

1. Who we are

The London Steakhouse Co. is operated by Halstone Limited, trading as London Steakhouse Company (company number 04817107), a company registered in England and Wales. Our registered office is Castle Hill House, 12 Castle Hill, Windsor, Berkshire, SL4 1PD.

When this notice says “we”, “us” or “our”, it means Halstone Limited. When it says “you” or “your”, it means you, the person giving us feedback.

We are the data controller for the personal data described here.

For any privacy question or request, contact us at customersupport@londonsteakhousecompany.com.

2. What this notice covers

This notice describes how we handle what you tell us when you scan the QR code on your table and give us feedback about your visit.

It does not cover bookings made through our website or by telephone, which are handled by our reservations system, or purchases made through an experience-day partner such as Virgin Experience Days, Buyagift or Red Letter Days — those partners have their own privacy policies and are their own data controllers for what you told them.

3. At a glance

You do not have to give us your name, your email address, or anything else that identifies you. A rating on its own is a complete and useful answer, and every other field is optional.

We never ask for your address, your date of birth, or your payment details.

If you choose to write comments, we may share what you write with the company you booked through, and it may be published on their website as a review of the restaurant. We say so again on the screen where you write them, so you know before you type. If you would rather that did not happen, leave the comment boxes blank and just give us the rating, or speak to the manager instead.

4. What we collect

WhatWhenOptional?
Your star ratingWhen you tap a starNo — it is the one thing we ask for
A code identifying the card on your table, and the timeAutomatically, with the ratingNo
What we got right, and what we could have done betterIf you write themYes
How you booked, and your voucher referenceIf you tell usYes
Your name and email addressOnly if you ask to hear from usYes

We do not store your IP address. If we need to detect misuse of the form we use a one-way scrambled value that cannot be turned back into an address, and we change how it is scrambled every month.

5. Why we use it, and our legal basis

PurposeData usedLegal basis (UK GDPR)
Putting something right while you are still with usRating, table card, commentsLegitimate interests
Improving the food, the service and the restaurantRating, commentsLegitimate interests
Understanding which booking channels our guests useBooking channel, voucher referenceLegitimate interests
Sharing your comments with the company you booked through, where they may be published as a reviewComments, rating, booking channelLegitimate interests, with clear notice at the point you write them
Sending you news about the restaurantName, email addressConsent

Where the legal basis is consent, you can withdraw it at any time — use the unsubscribe link in any email we send, or write to us at the address in section 12.

Where the legal basis is legitimate interests, we have assessed that our interest in running and improving the restaurant does not override your privacy rights, particularly because giving feedback is voluntary, every field beyond the rating is optional, and we tell you before you write anything that your comments may be shared and published.

6. Who we share it with

6.1 Service providers acting for us

These providers handle data under contract, only as needed to run the feedback form:

  • Supabase — stores the responses.
  • Vercel — hosts the page you fill in.
  • Meta Platforms (WhatsApp) — carries the alert to our duty manager when a rating needs immediate attention. That alert contains your table card, your rating and, where you have written one, a short extract of your comment. It does not contain your name or email.
  • Resend — sends any email we send you.

We do not sell your data and we do not share it with advertisers.

6.2 The company you booked through

If you booked through an experience-day partner and you write comments, we may pass those comments, your rating and the fact you booked through them to that partner. They may publish them on their website as a review of the restaurant, usually with a first name or no name at all. We do not pass them your email address.

We only ever send a partner the feedback from guests who booked through that partner. We do not tell one partner anything about another.

6.3 Our own team

Restaurant managers and a small number of head-office staff can see responses. Only managers can see a name or email address.

6.4 Legal disclosures

We may disclose data where required by law, court order, or to enforce our terms or protect our rights.

6.5 Business transfers

If we go through a corporate transaction such as a merger, acquisition or sale of assets, your data may transfer as part of it. This notice continues to apply until any successor publishes its own.

7. International transfers

Some of the providers above process data outside the United Kingdom. Where that happens we rely on appropriate safeguards under UK GDPR, including the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses.

8. How long we keep it

  • Ratings and comments: 24 months from the date you give them, then deleted or anonymised. We keep them that long so we can compare a season against the same season a year earlier.
  • Name and email address: until you withdraw consent, or after 24 months with no engagement, whichever comes first.
  • Comments already shared with a partner and published on their site: we cannot remove those from the partner’s website ourselves, but we will pass on your request and give you their contact details.

9. Your rights

Under UK GDPR you have the right to be informed, of access, to rectification, to erasure, to restrict processing, to data portability, to object, and to withdraw consent. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, though we would appreciate the chance to put things right first.

To exercise any of these, contact us at the address in section 12. Because most feedback is given without a name, we may need you to tell us the date and approximate time of your visit and your table so we can find the right record — and if we cannot identify it, we may not be able to act on the request.

10. Children

The feedback form is intended for guests aged 16 and over. We do not ask children to complete it and we do not knowingly collect their personal data through it.

11. Security

We use encrypted transport, access controls and database-level access rules so that the feedback form itself can add a response but cannot read anyone else’s. If we become aware of a breach affecting your personal data we will notify the ICO and, where required, you.

12. Contact us

Email: customersupport@londonsteakhousecompany.com
Post: Halstone Limited, Castle Hill House, 12 Castle Hill, Windsor, Berkshire, SL4 1PD