PRIVACY NOTICE

PRIVACY NOTICE FOR CUSTOMERS AND OTHER BUSINESS RELATED PERSONAL DATA

1. Who is responsible for processing your personal data and how to contact us
2. What personal data we collect and why
3. Who we share your personal data with
4. Transfers of personal data outside the UK, EU and European Economic Area
5. Your rights
6. Children
7. California residents
8. Changes to this privacy notice

Annex 1 – List of Gordon Ramsay Restaurants Limited’s Affiliates

1. WHO IS RESPONSIBLE FOR PROCESSING YOUR PERSONAL DATA

Gordon Ramsay Restaurants Ltd (“GRR”, “we”, “us” and “our”) is the data controller for personal data we process in connection with our website at https://www.gordonramsayrestaurants.com/, digital channels (including social media pages and booking platforms) and restaurants that we own or operate, and the services that we make available through those platforms and restaurants. This privacy notice explains how we collect, use, disclose, retain and protect personal data relating to our website users, guests, customers, prospective customers, newsletter subscribers, WiFi users, visitors to our premises and other individuals who interact with us.

This privacy notice does not apply to the processing activities of third-party partners that operate restaurants under the Gordon Ramsay brand (“Partner Restaurants”) and digital channels (including booking platforms) that are operated in connection with Partner Restaurants. This includes the Gordon Ramsay at Sea Containers restaurant, which is operated by Sea Containers Hotel Limited (“Sea Containers”). Sea Containers processes personal data in connection with the operation of its Partner Restaurant in accordance with its privacy policy at https://www.seacontainerslondon.com/privacy-policy/.

Where we support the operation of Partner Restaurants, including managing group booking and event enquiries, and operating social media channels for Partner Restaurants, this privacy notice will continue to apply.

2. ABOUT US AND HOW TO CONTACT US

GRR is a company registered in England and Wales (Company No.: 07360142) with its registered office at 539-547 Wandsworth Road, London, SW8 3JD. GRR is registered as a controller with the Information Commissioner’s Office (Registration No.: Z3232334).

If you have any questions about this privacy notice or would like to exercise your data protection rights, please contact us at datarequest@gordonramsay.com or by post marked ‘Data Subject Requests’ to our registered office address.

3. HOW WE COLLECT PERSONAL DATA

We collect personal data directly from you when you make a booking, buy a voucher or other product, sign up to receive marketing, contact us, take part in a promotion or survey, use our website or WiFi, visit our premises, attend an event, interact with us on social media or otherwise provide information to us. We may also receive personal data from booking platforms, payment providers, delivery partners, gift voucher providers, marketing and analytics providers, social media platforms, our group companies, partner organisations and other third parties where permitted by law.

4. WHAT PERSONAL DATA WE COLLECT, WHY AND OUR LAWFUL BASIS

The personal data we collect and use depends on how you interact with us. This may include identity and contact details; booking, purchase and payment information; dietary requirements and preferences; marketing preferences; feedback, survey responses and competition entries; CCTV images; WiFi, device, website usage and cookie information; social media handles and interactions; group booking and event enquiry details; and information you provide when contacting us or using our services.

We use this information to provide and manage our services, process bookings and purchases, respond to enquiries, administer vouchers, competitions and promotions, send marketing where permitted, personalise and improve our website and services, manage food safety and accessibility requirements, provide WiFi, protect our premises and systems, prevent fraud, comply with legal obligations, deal with complaints and disputes, and operate our business.

Where we support the operation of Partner Restaurants as described in section 1, we may also collect and use personal data in connection with those activities. This includes:

• managing group booking and event enquiries through our booking systems (such as customer names, contact details, event requirements and dietary or accessibility information);
• operating social media channels for the relevant venue (such as user handles, comments and other interaction data);
• sending you marketing communications in relation to Partner Restaurants, where we have the appropriate permissions to do so and using our own marketing database; and
• carrying out reporting and analytics in connection with the operation of the relevant venue, including anonymising personal data for that purpose.

Our lawful bases include performing a contract with you, complying with legal obligations, pursuing our legitimate interests, protecting vital interests where necessary, and relying on consent where required, for example for certain marketing communications or cookies. You can withdraw consent at any time where we rely on it.

5. WHO WE SHARE YOUR PERSONAL DATA WITH

We may share personal data with GRR affiliates, restaurants and venues within our group, booking and reservation platforms, payment providers, gift voucher and loyalty providers, marketing and analytics providers, IT hosting and support providers, WiFi providers, customer service providers, delivery partners, professional advisers, insurers, regulators, law enforcement bodies and other third parties where required or permitted by law.

Where we support the operation of Partner Restaurants as described in section 1, we may share limited personal data with the relevant third-party partner where necessary to support those activities, including to facilitate group bookings and events, for operational coordination, complaint handling, or legal or regulatory matters.

Where we share reporting and analytics information with third-party partners, this will be anonymised or aggregated wherever possible. In limited circumstances, personal data may be included in reporting or analytics where necessary for the operation of the relevant venue.

Personal data that we hold will not be shared with a third-party partner for that partner's own direct marketing purposes. Equally, a third-party partner will not share personal data with us for our direct marketing purposes.

6. COOKIES AND AUTOMATIC TECHNOLOGIES

When you use our website or digital services, we and our service providers may collect information automatically through cookies, pixels, tags, software development kits, server logs and similar technologies. This information may include your IP address, device and browser type, operating system, pages viewed, links clicked, time spent on our website, referring website, approximate location and other usage information. We use these technologies to operate the website, remember preferences, understand how our website is used, improve performance, measure marketing effectiveness and, where permitted, support personalised content or advertising.

Some of these cookies and similar technologies on our website may be set by third parties, including analytics providers, advertising networks, social media platforms, booking platforms and embedded content providers. These third parties may use the information collected through their technologies for their own purposes in accordance with their privacy notices. Where required, we will ask for your consent before setting non-essential cookies and you can update your cookie preferences through the cookie controls available on our website.

7. THIRD-PARTY LINKS

Our website may contain links to websites, booking pages, payment pages, social media pages, applications or services operated by third parties. If you follow a third-party link, that third party may collect and use your personal data in accordance with its own privacy notice. We are not responsible for the privacy practices of third-party websites or services, and we encourage you to read the relevant privacy information before providing personal data to them.

In particular, for Partner Restaurants, our website may include links or booking tiles that direct you to websites and digital channels (including booking platforms) operated by or on behalf of the relevant third-party partner. If you use those websites or digital channels, the third-party partner is responsible for the personal data it collects, including reservation and guest data.

8. DATA SECURITY

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These measures may include access controls, system monitoring, supplier due diligence, contractual protections and internal policies and procedures. No website, system or transmission is completely secure, but we take steps designed to protect personal data and to respond appropriately if a data security incident occurs.

9. TRANSFERS OF PERSONAL DATA OUTSIDE THE UK, EU AND EUROPEAN ECONOMIC AREA

We may transfer personal data outside the UK, EU and European Economic Area where this is necessary for the purposes described in this privacy notice, including where our affiliates, service providers or technology platforms are located in other countries. Where we do so, we take steps to ensure appropriate safeguards are in place, such as adequacy decisions, standard contractual clauses, the UK International Data Transfer Agreement, the UK Addendum or other lawful transfer mechanisms.

If you are located in the UK, EU or EEA, you may request further information about the safeguards we use by contacting us using the details in section 2.

10. YOUR RIGHTS

You have certain rights in relation to the processing of your personal data, including to:

• Request access to personal data about you (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you, and to check that we are lawfully processing it.
• Request rectification, correction, or updating to any of the personal data that we hold about you. This enables you to have any inaccurate information we hold about you corrected.
• Request personal data provided by you to be transferred in machine-readable format (“data portability”).
• Request erasure of personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove personal data where you have exercised your right to object to processing (see below).
• Request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you (e.g. if you want us to establish its accuracy or the reason for processing it).
• Object to the processing of your personal data in certain circumstances. This right may apply where the processing of your personal data is based on our legitimate interests, as explained above.
• Withdrawal of consent. If we rely on your consent (for example, when setting cookies on your device or for direct marketing), you may withdraw your consent at any time.
• Complain to us. If you believe that our processing of your personal data does not comply with applicable privacy laws or you otherwise have a concern about the way we have handled your personal data, you have the right to complain to us. Once we receive your complaint, we will acknowledge receipt within 30 days. We will then take appropriate steps to investigate the matters you have raised and will keep you informed of our progress. We will notify you of the outcome of your complaint without undue delay.
• Complain to a supervisory authority. In addition to your right to complain to us, you have the right to complain to a supervisory authority if you believe our processing of your data does not comply with applicable data protection law. As we are incorporated in the United Kingdom, our main supervisory authority is the Information Commissioner’s Office (“ICO”). You can complain to the ICO by visiting https://ico.org.uk/make-a-complaint/.

These rights may be subject to conditions under applicable data protection and privacy legislation. We will handle any request to exercise your rights in accordance with applicable law and any relevant legal exemptions. If you would like to exercise any of your rights, please contact us using the details in section 2.

11. CHILDREN

We may collect personal data relating to children with consent of a parent/guardian, for example if a booking is made on a child’s behalf. However, we do not otherwise knowingly solicit personal data from, or market to, children. If, as a parent or guardian, you become aware that your child has provided us with personal data, you should contact us at the contact details found at the top of this privacy notice.

12. HOW LONG WE KEEP YOUR PERSONAL DATA

We will only keep your personal data for as long as necessary for the purposes set out in this privacy notice, unless we have a legal right or obligation to retain the data for a longer period, or the data is necessary to comply with our legal obligations, resolve disputes, or establish, exercise or defend legal claims.

Where we collect images through CCTV cameras at our premises, we will typically retain that footage for no longer than 90 days unless retention for a longer period is necessary for the purposes set out above.

If you have opted out of receiving marketing communications from us, we will need to retain certain personal data on a suppression list so that we know not to send you further marketing communications in the future. However, we will not use this personal data to send you further marketing unless you subsequently opt back in to receive such marketing.

13. CALIFORNIA RESIDENTS

This section provides additional information for California consumers. These disclosures are intended to supplement this privacy notice with information required by California law.

To understand what personal data we may collect about you, where we collect it from, and why we collect and use it, please see section 4, What Personal Data We Collect, Why and our Lawful Basis.

We may have disclosed the following categories of personal data for business or commercial purposes to the categories of recipients listed below.

For more information about how we share personal data, please see section 5, Who We Share Your Personal Data With.

Your Rights

In addition to the rights to access, correct, and request deletion of your personal data that are listed in the Your Rights section above, California residents also have the right to opt out of the sale of personal data. You can request access to, correction of, or deletion of your personal data by emailing us at the email address in section 2.

California residents also have the right to limit the use of sensitive personal data (as that term is defined under California law) where a business uses such data to infer characteristics about you. GRR only uses sensitive personal data to provide goods and services to you; to ensure the security and integrity of the payment process and our systems; to detect, prevent, and investigate security incidents and other malicious, deceptive, fraudulent, or illegal actions; and to ensure the physical safety of natural persons. We do not use sensitive personal data to infer characteristics about you.

We will not deny services, charge different prices, offer a different quality of service or otherwise discriminate against you for exercising your rights under California law.

Sale of Personal Data

GRR does not sell or share personal data in exchange for money. However, GRR uses cookies and similar technologies to analyse website usage and assist in marketing efforts (including targeted advertising). In some cases, the use of these cookies may be considered a “sale” under California law. California law defines “sale” broadly to include any disclosure of information in return for any value. The value does not need to be monetary like in a traditional sale.

The categories of personal information disclosed that may be considered a “sale” under California law are: Device Information, Internet or Other Electronic Network Activity, and Inferences.

The categories of third parties to whom personal information is disclosed that may be considered a “sale” under California law are advertising and promotional agencies and consultants and those organisations or online platforms selected by us to carry out marketing campaigns on our behalf (for example, Facebook, Google, Instagram).

You can learn more and opt out of the use of cookies that involve the “sale” of personal data by clicking the “Do Not Sell or Share My Personal Information” link at the bottom of our website and updating your preferences.

We also recognize the Global Privacy Control as a valid request from you to opt out of cookies that involve the “sale” of personal data.

Your request to opt out, including through use of the Global Privacy Control, will be linked to your browser only. As such, you will need to apply these settings on each device and browser from which you wish to opt out. Similarly, if you clear your browser’s cache, such as by deleting cookies, you will have to apply this setting again.

We do not sell or share, and have no actual knowledge of any sale or sharing of, the personal information of minors under 16 years of age.

14. CHANGES TO THIS PRIVACY NOTICE

We may change this privacy notice at any time. The new privacy notice will be displayed on our website.

This privacy notice was last updated in October 2026.

ANNEX 1 - GROUP COMPANIES AND AFFILIATES