1. Who We Are
Grilandia Ltd (“Grilandia”, “we”, “us”) is a Lebanese restaurant group operating six kitchens across London. We are the data controller for personal information collected through our website, reservation system, and dining experiences.
Our registered office is at 12 Hanover Street, London, W1S 1YH. We are registered with the Information Commissioner’s Office under registration number ZB412309.
- This policy applies to grilandia.com and all associated booking flows. We never sell your data to third parties and only share it where strictly necessary to provide our services.
2. What We Collect
2.1 Booking information
When you make a reservation — online, by phone, or in person — we collect your name, email address, phone number, party size, date and time preference, and any special requirements you share (dietary needs, occasion notes, accessibility requirements).
2.2 Marketing consent
When you make a reservation — online, by phone, or in person — we collect your name, email address, phone number, party size, date and time preference, and any special requirements you share (dietary needs, occasion notes, accessibility requirements).
2.3 Website usage data
Our website automatically collects technical data including your IP address, browser type, pages visited, and time spent — used solely to maintain site performance and security.
| Data type | Reservation Made | Retention |
|---|---|---|
| Booking details | Reservation made | 3 years |
| Marketing preferences | Opt-in confirmed | Until withdrawn |
| Technical / analytics | Site visit | 13 months |
| Payment records | Transaction processed | 7 years (legal) |
3. How We Use It
We use your information to confirm and manage your reservation, send pre-visit reminders, and communicate any changes to your booking. Where you have consented, we may send you news about seasonal menus, special events, and exclusive dining offers.
We also use aggregated, anonymised data to understand how guests use our website so we can improve the booking experience. This data cannot be traced back to any individual.
Our legal basis for processing booking data is contract performance. For marketing, we rely on consent. Technical analytics are processed under our legitimate interests in maintaining a secure and functional website.
4. Sharing & Transfers
We share data only with: our reservation management platform (OpenTable Ltd, UK-based servers); payment processors to fulfil transactions; and, where legally required, regulatory or law enforcement bodies. We do not transfer data outside the UK or EU.
All third-party processors are bound by data processing agreements that prohibit them from using your information for any purpose other than delivering the service contracted.
5. Cookies
We use essential cookies to make our site work (session management, security), analytics cookies via Google Analytics 4 (performance monitoring, anonymised), and preference cookies to remember your table-size selection between visits.
You can manage your cookie preferences at any time through the cookie banner or your browser settings. Refusing non-essential cookies will not affect your ability to make a reservation.
6. Your Rights
Under UK GDPR you have the following rights regarding your personal data. To exercise any of them, email us at legal@grilandia.com — we will respond within 30 days.
Access
Request a copy of all personal data we hold
Rectification
Ask us to correct any inaccurate or incomplete data.
Erasure
Request deletion of your data where we have no legal obligation to retain it.
Portability
Receive your data in a structured, machine- readable format.
Restriction
Ask us to limit processing while a dispute is resolved.
Objection
Object to processing based on legitimate interests, including for marketing.
You also have the right to lodge a complaint with the Information Commissioner’s Office at any time.
7. Retention
We keep booking records for three years from your last visit to handle any queries or complaints. Financial transaction records are retained for seven years to meet our statutory obligations. Marketing data is held until you unsubscribe or ask us to delete it.
After these periods, data is securely deleted or permanently anonymised.
8. Contact the DPO
Our Data Protection Officer can be reached at dpo@grilandia.com or by post at Grilandia Ltd, Attn: DPO, 12 Hanover Street, London, W1S 1YH.
We take all privacy concerns seriously and aim to resolve them promptly. If you remain unsatisfied, you may escalate to the ICO.
Questions about this policy? Our team is here to help — we aim to
respond to all enquiries within two business days.
