Privacy Policy

We respect your privacy and are committed to protecting your personal data. This privacy policy sets out how Wahaca, a trading division of Oaxaca Limited (referred to in this notice as “Wahaca”, “we” or “us”), collects and uses the personal data of its customers and website visitors (referred to in this notice as “you“). It also explains how personal data is shared and protected, what choices you have relating to your personal data and how you can contact us.

1. Who are Wahaca?

Wahaca (Oaxaca Limited) is a company registered in England and Wales with company number 05836870. Wahaca is the data controller  of your personal data.

2. What personal data do we collect?

Personal data means any information relating to a person who can be identified either directly or indirectly. We will collect and use your personal data when you interact with our website (www.wahaca.co.uk), our social media, contact us, enter into a competition, promotion or survey or, as a customer, request our products or services (together referred to in this policy as the “Services“).

We may collect the following personal data from you when you use our Services:

• identity and contact details, such as your name, age, address, email address and telephone number. For example, when you request to book a table at one our restaurants we will use your name and contact details to confirm your booking;
• payment details, such as your credit or debit card number. For example, when you pay the bill at one of our restaurants or order food on our website we will collect your payment card details to complete the payment.
• demographic data such as your preferences and interests (for example, your favourite dish and most visited restaurant);
• personal data you provide to us in customer surveys, competitions and/or offers (for example, your age and address); and
• technical data, such as data about your use of our website and your IP address, login data, geographical location and browsing actions and patterns.

We may also collect data about you from other sources. This may include the following:

• personal data you have shared publicly, including on social media; and
• personal data from providers of technical, payment and delivery services.

3. What do we use this personal data for?

We will only use the personal data that we collect to provide the Services to you which includes the following:

• to process and administer your booking requests;
• obtaining payment from you, if you purchase any of our goods or services like our delicious tacos;
• enabling our suppliers and service providers to carry out certain functions on our behalf, including payment processing, verification, technical, logistical or other functions, as may be required, in order to fulfil your orders or requests;
• resolving any refunds or disputes, if you lawfully exercise your rights or if you wish to dispute any part of our offering;
• sending you our marketing communications, where you have agreed that we may do so, in order to keep you informed of our products and services, which we consider may be of interest to you;
• personalising our Services for you, for example by using your data to help us form target audiences and for customer segmentation;
• ensuring the security of our business, preventing or detecting fraud or abuses of our website, for example, by requesting verification information in order to confirm your subscription to our newsletter;
• to help us identify you, for example, when you are using our requesting our services;
• developing and improving our products and services and to carry out market research, for example, by reviewing visits to our website and its various subpages, demand for specific goods and services; and
• to comply with applicable law, for example, in response to a request from a court or regulatory body, where such request is made in accordance with the law.

4. Marketing

When you give us your consent, we will send you marketing communications concerning Wahaca’s  products, services and other promotions (for example, to hear more about the latest Wahaca products). You can opt out at any time after you have given your consent. If you are an existing customer (for example, if you have placed an order with us) we may use the contact details you provided to send you marketing communications about similar Wahaca products or services where permitted by applicable law (unless you have opted out). You can opt out of receiving our marketing communications by following the unsubscribe instructions included in the marketing communications or by contacting us at [email protected]. 

5. Our grounds for using your personal data

To process your personal data lawfully we need to rely on one or more valid legal grounds. If you are a customer, our primary legal ground is that we need your personal data to fulfil our contract with you or to take certain steps prior to entering into our contract with you. However, there may be circumstances where we may also rely on other valid legal grounds for the processing of your personal data, such as:

• your consent to particular processing activities (for example, where you have consented to us using your personal data for marketing purposes);
• our legitimate interests as a business (except where such interests are overridden by your interests and fundamental rights). For example, it is within our legitimate interests to use your personal data to prevent or detect fraud or abuses of our website; or
• our compliance of our legal obligations.

Where the personal data we collect from you is needed to meet our legal or regulatory obligations or to enter into a contract, if we cannot collect this personal data, there is a possibility that we may be unable to provide you with our services or perform all of our obligations under our contract with you.

6. Disclosure of your personal data to third parties

There are circumstances where we wish to disclose or are compelled to disclose your personal data to third parties. This will only take place in accordance with the applicable law and for the purposes listed above. These scenarios include disclosure:

• to our subsidiaries or branches;
• to our service providers or suppliers to facilitate the provision of our services or goods to you, for example, the disclosure to your personal data to our delivery and order providers, booking providers, gift voucher providers, payment providers, wifi providers or our customer relationship management provider.  
• where required by law or to comply with judicial proceedings, court orders or legal or regulatory proceedings;
• necessary to protect the safety of our employees, our property or the public;
• necessary for the prevention or detection of crime, including exchanging data with other companies or organisations for the purposes of fraud protection and credit risk reduction;
• to another legal entity, on a temporary or permanent basis, for the purposes of a joint venture, collaboration, financing, sale, merger, reorganisation, change of legal form, dissolution or similar event. In the case of a merger or sale, your personal data will be permanently transferred to a successor company; or
• to any other third party we have identified to you and where you have provided consent.

7. International transfer of your personal data

We may transfer your personal data to third parties in countries that do not have same level of data protection as the UK for further processing in accordance with the purposes set out in this policy. In particular, your personal data may be transferred to our outsourced service providers located abroad. In these circumstances we will, as required by applicable law, ensure that your privacy rights are adequately protected, for example, by signing the standard contractual clauses.

8. Storage of your personal data

Your personal data is stored in electronic and physical records, which are maintained by Wahaca or our service providers. Your personal data will be retained until your last use or purchase of our Services and normally for a period of 2 years thereafter, unless longer retention is required by applicable local law or where we have a legitimate and lawful purpose to do so. The retention of your personal data will be subject to periodic review.

We may keep an anonymised form of your personal data, which will no longer refer to you, for statistical purposes without time limits, to the extent that we have a legitimate and lawful interest in doing so.

9. Security of your personal data

We will take all steps reasonably necessary to ensure that your personal data is treated securely and in accordance with this privacy notice. Unfortunately, the transmission of data via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your personal data transmitted to our website and any transmission is therefore at your own risk. Once we have received your data, we will use strict procedures and security features to try to prevent unauthorised access.

10. Your rights

Data protection law provides you with numerous rights, including the right to object to our processing of your personal data where permitted by applicable law. You also have the right to request:

• access to your personal data;
• an electronic copy of your personal data (portability);
• correction of your personal data if it is incomplete or inaccurate; or
• deletion or restriction of your personal data in certain circumstances provided by applicable law.

These rights are not absolute. Where we have your consent to process your personal data, you have the right to withdraw your consent at any time. If you would like to request a copy of your personal data or exercise any of your other rights please contact us at [email protected].

You also have the right to lodge a complaint about how we treat your personal data. In the first instance, if you would like to make a complaint, we suggest that you contact us using the contact details provided below. You can also lodge a complaint with the Information Commissioner’s Office (ICO) and you can visit their website www.ico.org.uk for more information.

11. Contact details

If you have any queries in relation to the processing of your personal data by Wahaca, please contact us on the following contact details:

• Oaxaca Limited, 5 Little Portland St, London, W1W 7JD
• Email: [email protected]

12. Updates to this privacy policy

We keep our privacy policy under regular review. This version was last updated on [09.04.21].