Privacy Policy

Who Is Responsible for Your Data

PubKitchens is operated by Taro Schenker. For the purposes of UK data-protection law, the operator of pubkitchens.co.uk is the controller of the personal data described in this policy. Contact contact@pubkitchens.co.uk with privacy questions or requests.

Personal Data We Collect

• Account and private operator details — name, email, optional phone number and business name, business type and stage, cuisine, preferred cities, budget, preferred start date, kitchen-use and contract preferences, and information you add to free-text fields.
• Public profile content — the name, headline, biography, menu, photos, food styles, experience, previous venues, preferred cities, kitchen-use preference, self-reported opportunity status and confirmation date, social handle, and website that you choose to publish.
• Contact-request data— the sender's name, email address, optional pub name, message, IP address, user-agent information, time, and intended profile recipient.
• Account, communication, and security records — sign-in and email delivery records, publication state, profile views, saved venue interests, support messages, consent records, and rate-limit or abuse-prevention data.
• Analytics data — page views, broad device and browser information, referral source, and interaction events, but only when you allow analytics cookies.

How We Use Personal Data

We use personal data to:

• create, authenticate, and administer your account;
• save your operator details and publish a profile when you ask us to;
• show published profiles in the directory and relevant location pages;
• receive, store, and relay contact requests to the chosen operator;
• send service messages such as sign-in codes and contact notifications;
• prevent spam, fraud, misuse, and technical attacks;
• provide support, diagnose faults, and maintain the service; and
• understand and improve site use when analytics consent is active.

We do not use private profile data to provide a manual matching or recruitment service, and we do not send profiles privately to pubs on a user's behalf. Pubs discover operators through profiles that operators choose to publish.

Our Lawful Bases

UK data-protection law requires a lawful basis for each use of personal data. We rely on:

• Contract where processing is necessary to provide the account, profile-publishing, and contact-relay features you request under our Terms of Use.
• Legitimate interests to operate and secure the directory, prevent abuse, answer support requests, keep appropriate service records, and improve reliability. Those interests are providing a useful and safe directory while protecting the rights of users and visitors.
• Consent for optional analytics cookies and for optional marketing if we offer and you choose it. You can withdraw consent without affecting earlier lawful processing.
• Legal obligation where we must keep or disclose information to comply with applicable law or a valid legal request.

What You Need to Provide

The fields marked as required during signup are needed to create and administer an operator account. The required contact-form fields are needed to relay an enquiry. You do not have a statutory obligation to provide them, but without them we cannot provide the relevant feature. Optional fields can be left blank.

We do not use personal data to make solely automated decisions that produce legal or similarly significant effects. Directory filters, rate limits, and spam controls may operate automatically, but they do not make employment or commercial decisions for pubs or operators.

Published Operator Profiles

Creating an account does not publish your operator profile. You choose when to publish. Once published, the public profile fields listed above can be viewed by anyone, shared by visitors, and indexed or cached by search engines and other third parties. Your private account fields, including your sign-in email, phone number, budget, and business-stage information, are not displayed on the public profile.

You can edit or unpublish your profile from your dashboard. Unpublishing removes the live profile from the directory, but search engines and third parties control their own caches and may take time to remove an older copy.

Contact Requests

When you contact an operator, your submitted name, email address, pub name if given, and message are stored by PubKitchens and sent to that operator. Your email is not posted publicly, but the operator needs it in order to reply. We also keep limited technical data and may receive an operational copy so we can prevent abuse and investigate delivery problems.

An operator's email address is not shown to the sender through the form. If the operator replies from their own email account, their email provider and message may reveal that address to the recipient. Further correspondence then takes place directly between the parties and is outside PubKitchens.

Public Venue Data

We obtain venue and area information from public sources such as the Food Standards Agency, OpenStreetMap, postcode data, and government statistics. Some records may contain a sole trader's or business contact's personal data. We use this information under our legitimate interest in providing venue research and market context. A public record is not evidence that a kitchen is available or that the pub wants to be contacted.

If a venue record about you is inaccurate or you want to raise a data-protection concern, email contact@pubkitchens.co.uk. You may also need to ask the original data provider to correct its source record.

Who Receives Personal Data

Depending on how you use the service, data may be received by:

• the operator you choose to contact;
• visitors and search engines when you publish a profile;
• service providers that host the site, store data, authenticate accounts, deliver email, provide security, or process consented analytics, including Vercel, Supabase, Resend, and Google Analytics; and
• professional advisers, regulators, courts, or authorities where reasonably necessary or legally required.

Service providers process data for their contracted purpose. Depending on their infrastructure, this may involve the EEA, the United States, or other countries outside the UK. Where data-protection law requires a transfer safeguard, we use an applicable UK adequacy regulation or contractual safeguard such as the UK International Data Transfer Agreement or UK Addendum. Contact us for information about the safeguard relevant to your data. We do not sell personal data.

How Long We Keep Data

We keep account and profile data while your account is active or until you ask us to delete it, unless a longer period is needed for security, dispute resolution, legal claims, or a legal obligation. Contact requests and operational records are kept for only as long as reasonably needed for the enquiry, account history, abuse prevention, and those same legal purposes. Retention is reviewed using the record's age, account status, sensitivity, and continuing operational or legal need.

An uncompleted signup request expires after one hour. Expired and completed signup records may remain for a short cleanup and security-audit period. Deleted data can remain temporarily in restricted backups before those backups are overwritten.

Security

We use technical and organisational measures intended to protect personal data, including passwordless authentication, access controls, input validation, and contact-form rate limits. No internet or storage system can be guaranteed completely secure.

Your Rights

Depending on the circumstances, UK data-protection law may give you the right to access, correct, erase, restrict, or receive a portable copy of your personal data, and to object to certain processing. You can also withdraw consent at any time where processing relies on consent. These rights are not all absolute, and we may need to verify your identity before acting on a request.

Your right to object: where we rely on legitimate interests, you can object to that processing based on your particular situation. We will stop unless we have compelling legitimate grounds to continue or need the data for legal claims. You can always object to direct marketing, and we will stop using your data for that purpose.

To exercise a right, email contact@pubkitchens.co.uk. You can complain to the Information Commissioner's Office, although we would appreciate the chance to address your concern first.

Children

The account and contact features are for people aged 18 or over. We do not knowingly collect account or contact-request data from children.

Cookies and Changes to This Policy

See our Cookie Policy for information about necessary and analytics cookies. We may update this policy as the service or law changes. The latest version will appear here with a revised date, and we will take reasonable steps to flag material changes to account holders.