Privacy Policy

SATEPO LIMITED · Company number 11315614 · Registered address: 318 Old Street, London, England, EC1V 9DR

Trading as Smith's Bar & Grill and Ayllu, 25 Sheldon Square, Paddington Central, London, W2 6EY

Last updated: 20 August 2026. This notice replaces the version dated 25 May 2018.

1. Introduction

Your personal data is any information that identifies you as an individual. This notice explains what personal data we collect when you visit our restaurants, use our websites, make a reservation or hear from us, how we use it and the rights you have over it.

Our processing of personal data is governed by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025.

2. Who is responsible for your personal data

SATEPO LIMITED is the data controller for personal data processed in connection with Smith's Bar & Grill and Ayllu ("we", "us", "our"). You can contact us about your personal data at either venue:

3. Personal data we collect

Depending on how you interact with us, we may collect:

• your name and contact details (email address, telephone number, postal address);
• reservation details: date, time, party size, occasion and any preferences or requests you add to a booking;
• dietary requirements and allergy information you choose to share with us (see section 4);
• payment and transaction details when you pay a deposit, buy a gift voucher or settle a bill (we do not store full card numbers; payments are handled by our payment providers);
• records of correspondence between you and us, including emails and messages;
• marketing preferences and, if you sign up, your newsletter subscription details;
• competition, prize draw and promotion entries;
• technical data when you use our websites, such as IP address, browser type and pages visited (collected via cookies, see section 10);
• CCTV images if you visit our premises, which we operate for the safety of guests and staff;
• information about accidents or incidents on our premises where we have a legal duty to record them.

We no longer collect job titles, gender, age as standard and we do not use fax. We only ask for information we actually need.

4. Dietary and allergy information (special category data)

Information about allergies or medical dietary requirements is health data, which has extra protection in law. We only use it to prepare and serve your food safely, we record it against your booking with your explicit consent and we do not use it for any other purpose. You may withdraw that consent at any time, though we may then be unable to cater safely for the requirement.

5. How we use your data and our lawful bases

UK GDPR requires us to have a lawful basis for every use of your personal data. These are ours:

6. Who we share your data with

We do not sell or lease your personal data. We share it only with service providers who help us run the business, under contracts that protect your data:

• our reservations platform (OpenTable), which processes bookings on our behalf;
• our gift voucher provider (GiftPro);
• Mailchimp, our email marketing platform, used to send newsletters to subscribers;
• payment processors and our bank;
• our website hosting and IT providers;
• professional advisers such as accountants, insurers and lawyers where necessary;
• the police, regulators or other authorities where the law requires it.

7. International transfers

Some of our service providers (for example reservation and email platforms) are based in, or store data in, countries outside the UK, including the United States. Where that happens we make sure an adequate level of protection applies, through a UK adequacy decision (including the UK-US Data Bridge) or the UK International Data Transfer Agreement or Addendum, so that your data receives protection that is not materially lower than under UK law.

8. How long we keep your data

9. Your rights

You have the following rights over your personal data, all free of charge:

• Access: request a copy of the personal data we hold about you (a "subject access request"). No fee applies and we will respond within one month, though we may pause that period if we need to ask you to clarify your request;
• Rectification: have inaccurate or incomplete data corrected;
• Erasure: ask us to delete your data in certain circumstances;
• Restriction: ask us to limit how we use your data while a query is resolved;
• Portability: receive the data you gave us in a machine-readable format;
• Objection: object to processing based on legitimate interests and to any direct marketing, which we will always stop on request;
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting earlier processing;
• Automated decisions: we do not make solely automated decisions that have legal or similarly significant effects on you.

To exercise any of these rights, email reservations@smithsbarandgrill.co.uk or reservations@ayllu.co.uk or write to us at 25 Sheldon Square, Paddington Central, London, W2 6EY. We may need to verify your identity before responding.

10. Cookies

Our websites use cookies: small text files stored on your device. Strictly necessary cookies (for example those that keep the site secure or remember your cookie choices) are always on. All other cookies, such as analytics and marketing cookies, are used only with your consent. When you first visit our website you can accept or reject these cookies through our cookie banner, and you can change your choice at any time through the cookie settings link on our website or by adjusting your browser settings.

11. Marketing

We only send email or SMS marketing if you have opted in, or if you are a recent customer and the message is about our own similar services, in which case every message includes a simple way to opt out. We will never pass your details to third parties for their own marketing without your permission. To stop marketing at any time, use the unsubscribe link in any message or contact us using the details above.

12. Security

We use appropriate physical, electronic and organisational measures to protect your personal data against unauthorised access, loss or disclosure, and we limit access to those who need it to do their jobs. Where we use service providers, we require them to protect your data to the same standard.

13. Children

Our websites and marketing are aimed at adults. We do not knowingly collect personal data from children online. Where children dine with us, any information (such as an allergy) is provided by the accompanying adult.

14. Complaints

If you are unhappy with how we have handled your personal data, please contact us first using the details in section 2. We will acknowledge your complaint within 30 days and investigate it.

You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk · 0303 123 1113 · Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

15. Changes to this notice

We may update this notice from time to time, for example to reflect new legal requirements or changes to our services. The latest version will always be available on our websites with the date it was last updated.

Download this privacy policy (PDF)