Privacy
Last updated: 13 October 2026
The short version
When you book a table through Seated, the venue you are booking with decides what happens to your details. Seated stores them and sends your emails on the venue's behalf. We do not sell your details, show you adverts or share them with other venues.
Who we are
Seated is a table booking service for restaurants, bars and cafés, built by Humbug Labs in Glasgow. Contact: support@rotadone.co.uk.
For guest bookings, the venue is the data controller and Seated is its processor. For venue accounts (owners, managers and staff who sign in), Seated is the data controller.
If you book a table
| What | Why | Lawful basis |
|---|---|---|
| Name, email, phone (optional), party size, date and time | To hold your table, send your confirmation and a reminder the day before, and let the venue contact you about your booking. | Contract (taking your booking) |
| Notes you add, such as allergies or a birthday | So the venue can look after you. Allergy notes are health information, so only add what the venue needs to know. | Your explicit consent, given by writing the note |
| A request for a review after your visit, and the review if you leave one | Reviews show on the venue's page with your first name and last initial only. You can leave one or ignore the email. | Legitimate interests (the venue hearing how it went) |
| Your visits to that venue, and notes its team keeps for next time (an allergy, a favourite table, an occasion) | So the venue recognises you and looks after you the same way each visit. It is only ever seen by that venue's team, never by other venues. | Legitimate interests; for allergy or health notes, your explicit consent when you tell the venue |
| Your name, phone number and party size if you join a walk-in waiting list | To let you know when your table is ready. | Legitimate interests |
| Your internet address, recorded with the booking | To stop automated or abusive bookings. | Legitimate interests (security) |
You never need an account to book. The link in your confirmation email lets you see or cancel your booking.
If you run a venue on Seated
- Name, email and a scrambled copy of your password, so you can sign in. We cannot read your password.
- Venue details, opening hours, floor plan, photos and page text you add.
- Which team member made changes to bookings, for the venue's records.
Where it is kept and who else sees it
- Data is stored on a server in the UK, and all traffic is encrypted (HTTPS).
- Emails are sent through IONOS, our email provider.
- Venues pay for Seated through Stripe, which handles their card details. We never see card numbers.
- We use a cookie only to keep venue staff signed in. No advertising or tracking cookies.
- Nightly backups are kept for up to six months, then deleted.
How long we keep it
Twelve months after your booking date, your name, email, phone number and any notes are deleted. The venue keeps only the bare booking (the date, time and number of people) so its records still add up. A venue's notes about you are deleted once you haven't booked there for twelve months, and waiting-list details after two days. A review you left stays on the venue's page with the first name and initial it already showed. Internet addresses are deleted on the same twelve-month clock.
Venue accounts are kept while the venue uses Seated. When a venue leaves Seated, its bookings, guests, photos and team are deleted with it, apart from copies in our backups, which expire within six months.
Your rights
Under UK GDPR you can ask to see, correct or delete your details, object to how they are used, or take a copy. For a booking, the quickest route is to ask the venue. You can also email support@rotadone.co.uk and we will pass it to the venue or deal with it ourselves, within one month.
If you are unhappy with how your data has been handled, you can complain to the Information Commissioner's Office at ico.org.uk.