Privacy notice

Who we are

Iron Arcade & Steel Arrows, is the controller of your personal details. For anything about your details, ask at the venue.

What we collect

• When you book: your name, mobile number, email address and any special requests; your group size, date and time; any drinks you pre-order; that you confirmed everyone is 12 or over and accepted the booking terms, and, if you pre-order alcohol, that you confirmed you are 18 or over; and whether you agreed to hear from us about offers.
• When you pay: your card is handled by our payment provider, Stripe. Your card number never reaches us; we keep the amount, the date and Stripe's reference for the payment.
• When you send a party enquiry: your name, email address, phone number, preferred date, group size and ages, and your message.
• When you use the site: your IP address is used briefly to stop the booking and enquiry forms being misused. It is not stored with your booking. We count how many people reach each step of booking, without recording who they are.

We do not ask for your date of birth.

Why we use them

• To take and run your booking: to hold your oche, take payment, send your confirmation, reminder and any change or cancellation, and contact you if there is a problem. This is needed for our contract with you.
• To keep financial records, which the law requires.
• To answer your party enquiry, and to protect the site from misuse. These are our legitimate interests.
• To send you offers, only if you ticked the box to agree. You can change your mind at any time by telling us.

Who sees them

Our staff, to run your booking. We do not sell your details. These companies process them for us, under contract and only on our instructions:

• Stripe – card payments and refunds.
• Amazon Web Services – hosts this site and its data in London, and sends our emails.
• Cloudflare – may run a short security check before your oche is held, to stop automated bookings. It sees your IP address and browser details.

Stripe and Cloudflare may process some details outside the UK, under safeguards the UK recognises, such as the UK International Data Transfer Addendum.

How long we keep them

• Bookings: your name, contact details, special requests and staff notes are removed 24 months after the booking date.
• A booking you started but did not pay for: your details are removed 7 days after your hold ran out.
• Party enquiries: removed 24 months after the enquiry or the party date, whichever is later.
• Financial records (what was booked and paid, without your name or contact details) are kept for 6 years, as the law requires.

Cookies

We use only cookies the site needs to work, so we do not ask for consent: one that remembers the booking you are making in this browser (for up to 24 hours), and one that keeps our staff signed in. We use no advertising or tracking cookies.

Your rights

You can ask us for a copy of your details, to correct them, to delete them, to restrict or object to how we use them, or to give them to you in a format you can take elsewhere. Some details we must keep for the law (financial records). We will reply within one month.

If you are unhappy with how we have used your details, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes

If we change this notice we will update the date at the top. Our booking terms explain how bookings, cancellations and refunds work.