Carbone London Privacy Policy

Privacy Notice

Effective Date: August 28, 2025

Latest Update and Release Date: August 28, 2025

30 Grosvenor Restaurant Propco Limited (“Carbone”, “we”, “our” or “us”) always attach great importance to the protection of your personal data in compliance with applicable data protection laws, including the US state privacy laws, UK Data Protection Act 2018, and the EU General Data Protection Regulation (GDPR). When you visit or otherwise make use of the websites owned and/or managed by us (collectively, the “Sites”), make reservations, dine at our restaurants, contact or otherwise interact with us and/or otherwise make use of our services, we collect and process your personal data. Our activities regarding the collection, use, sharing, and processing of your personal data are set out in this privacy notice (the “Notice”).

Before using the Sites, services, contacting and/or interacting with us, dining at our restaurants and/or staying at our hotels, please read this Notice carefully. This Notice and the Sites are intended for adults aged 18 or over. If you are under 18, please do not provide personal data without parental or guardian consent, in accordance with applicable laws.

Who We Are

30 Grosvenor Restaurant Propco Limited, d.b.a. Carbone is the data controller responsible for your personal data.

Our full company details are:

Legal entity name: 30 Grosvenor Restaurant Propco Limited

Company registration: Registered in England and Wales (Company number: 15235429)

Registered office: Elsley Court, 20-22 Great Titchfield Street, London, United Kingdom, W1W 8BE

Email address: privacy@majorfood.com

You can contact us at the above address should you have any questions about this Notice, or if you would like to exercise any of your rights under Data Protection Laws, which we set out below.

Information We Collect

We may collect various types of information, including personal data as defined under applicable laws, such as the GDPR and US state privacy laws, to the extent relevant:

When you interact with us: you may share your personal data with us when you provide information using any means on our Sites, including through using our website platform and event booking forms, and when you otherwise engage with us, including when you correspond with us by email, post, telephone or any other means, and when you visit us in person.

From third parties: we may obtain your personal data from available third parties (which, when combined with other personal data we may have of yours, may also constitute personal data) including Site and reservation platform providers and marketing providers.

Personal Data We Collect:

We may collect, use, store and transfer different kinds of personal data about you such as:

Identity and Contact Information about you including email address, street address, and phone number.

Financial and Transaction Information including reservations (online ordering & catering), dining preferences, spend and visit history, order history, stored credit card information (for a limited duration of time).

Technical and Usage Information including internet protocol (IP) address, your login data, browser type and version, time zone setting and geolocation, browser plug-in types and versions, operating system and platform, Unique identifiers (e.g., Google/and or Apple Advertising ID), device ID and hardware details and other technology on the devices you use to access our Sites, and information about how you interact with and use our Sites and us (e.g. pages viewed, time spent, navigation paths), and activity across other third party sites.

Marketing and Communications Information including your preferences in receiving marketing from us and our third parties and your communication preferences, tracking pixels to determine marketing effectiveness etc.

Video Information including CCTV footage (which includes location).

Services Information including information you provide when contacting us with questions or feedback and any other information you choose to provide that reflects our interactions with you, which includes offline interactions, and any allergy information, dietary preferences, accessibility needs.

We also collect, use and share Aggregated Information such as statistical or demographic data for any purpose. Aggregated Information could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Technical and Usage Information to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Notice.

How We Use Personal Data (Lawful Bases and Purposes)

Data Protection Laws require us to have a lawful basis for everything that we do with your personal information falling under one of the following categories:

Performance of a contract with you: Where we need to perform a contract we are about to enter into or have entered into with you.

Legitimate interests: We may use your personal data where it is necessary to conduct our business and pursue our legitimate interests, for example to prevent fraud and/or enable us to give you the best experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

Legal obligation: We may use your personal data where it is necessary for compliance with a legal obligation that we are subject to.

Consent: We rely on consent only where we have obtained your active agreement to use your personal data for a specified purpose.

Vital Interests: We may process your personal data where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

We use your personal data in a number of different ways and for different reasons – the bullets below set out what we do and why:

Identity and Contact Information

What do we do? Identify you when you visit our websites or you contact us for any reason.
Why do we do it? So we can identify you for security, personalised experience etc.
What is the Lawful Basis? Legitimate interests: necessary for us to be able to communicate with you.

What do we do? Process any payment and (a) Manage payments, fees and charges (b) Collect and recover money owed to us.
Why do we do it? So we can provide you with what you have purchased.
What is the Lawful Basis? Performance of a contract with you.

Legitimate interests: necessary to ensure the financial health of our business and to manage our financial transactions efficiently.

What do we do? We collect and store your reservation details.
Why do we do it? To manage your booking and provide you with the services you requested
What is the Lawful Basis? Performance of a contract with you.

What do we do? To send you service updates, and updates to this Notice and/or our Terms.
Why do we do it? So we can keep you informed of any changes to our terms and data processing.
What is the Lawful Basis? Legitimate interests: necessary for the effective provision of our information notices and the terms in which you engage with us on.

What do we do? To send you information about our business.
Why do we do it? So we can let you know about new services that we offer that you might be interested in.
What is the Lawful Basis? Consent.

What do we do? To send you surveys and to ask and respond to feedback and correspondence or otherwise correspond with us.
Why do we do it? To offer you the opportunity to let us know how we are doing, to let us know your views on another subject, for us to leverage your feedback to further develop and tailor our business and to improve your experience.
What is the Lawful Basis? Legitimate interests: necessary to ensure we are providing the best service and to identify any areas of potential improvement.

Technical and Usage Information

What do we do? Identify you when you visit our Sites and any third party platform.
Why do we do it? To provide you with the best possible user experience.
What is the Lawful Basis? Legitimate interests: necessary to provide the best user experience.

What do we do? Monitor visitors to our Sites or platform and analyse their use of such, and perform tests on our IT systems.
Why do we do it? To protect our website, platform and our IT systems from fraud or cyberattacks and to improve such and our IT security.
What is the Lawful Basis? Legitimate interests: necessary to ensure our systems are secure and to protect against IT security incidents.

What do we do? Administer and protect our business and our Sites and platform (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data).
Why do we do it? For running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise.
What is the Lawful Basis? Legitimate interests: necessary to run our business and to provide effective and secure administration and IT services, network security and to prevent fraud. Necessary to comply with a legal obligation.

What do we do? Deliver relevant content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you.
Why do we do it? To study how customers use our services, to develop them, to grow our business and to inform our marketing strategy.
What is the Lawful Basis? Legitimate interests: necessary to optimise our marketing efforts and deliver targeted advertisements.

What do we do? Use data analytics to improve our Sites, platform, services, marketing, customer relationships and experiences.
Why do we do it? To define types of customers for our services, to keep our websites and platform updated and relevant, to develop our business and to inform our marketing strategy.
What is the Lawful Basis? Legitimate interests: necessary to enhance our business strategies and improve customer satisfaction.

What do we do? Deploy tracking pixels to understand your navigation to and access of our emails to you.
Why do we do it? To improve our services, personalise your experience, and measure marketing effectiveness.
What is the Lawful Basis? Consent.

Marketing and Communications Information

What do we do? We keep a record of your communication preferences (your “opt ins” and “opt outs”).
Why do we do it? So we can make sure that you only receive the communications from us that you would like to receive and so we can update our records if you change your mind.
What is the Lawful Basis? Legitimate interests: necessary to promote our business. Legal obligation.

What do we do? Send you electronic marketing.
Why do we do it? To inform you about offers, events, and updates that may interest you.
What is the Lawful Basis? Consent. Legitimate interests: soft opt-in where applicable.

Video Information

What do we do? We record CCTV footage in and around our premises.
Why do we do it? To ensure the safety and security of our guests, staff, and property; to investigate incidents; and to deter criminal activity.
What is the Lawful Basis? Legitimate Interests: necessary for the protection of individuals and property. Legal obligation (where required for health and safety compliance or law enforcement cooperation).

Services Information

What do we do? We use your data to provide the services and to continually improve and develop them.
Why do we do it? So we can make sure our services continue to be fit for purpose and to develop their commercial offering.
What is the Lawful Basis? Performance of a contract with you. Legitimate interests: necessary to improve our services.

What do we do? Enable customer support and feedback messaging.
Why do we do it? To assist with queries and ensure services quality.
What is the Lawful Basis? Legitimate interests: to maintain operational efficiency.

What do we do? Generate and manage reservations, order confirmations, invoices, and cancellations.
Why do we do it? To manage transactions and provide documentation.
What is the Lawful Basis? Performance of a contract. Legitimate interests: to ensure smooth operations.

What do we do? We collect allergy information, dietary preferences, and accessibility needs.
Why do we do it? To ensure your health, safety, and comfort during your visit, and to accommodate your specific needs.
What is the Lawful Basis? Consent.

All Personal Data

What do we do? We may transfer your personal information in part or whole in connection with any merger, sale, transfer of our assets, investment, acquisition, bankruptcy, or similar event or corporate transaction
Why do we do it? So we can ensure the continued service and function and to ensure we can protect and grow our business.
What is the Lawful Basis? Legitimate interests: to ensure we can protect and grow our business.

What do we do? Comply with legal and regulatory obligations.
Why do we do it? So we can meet our legal responsibilities.
What is the Lawful Basis? Legal obligation.

What do we do? Retain your personal information to establish, exercise, or defend legal claims.
Why do we do it? So we can protect our interests.
What is the Lawful Basis? Legitimate interests: to seek legal advice, protect ourselves, our users or others in legal proceedings.

In limited circumstances we may process any of the personal data we hold to the extent necessary to defend, establish and exercise legal claims or to comply with legal or regulatory obligations.

Where we need to collect personal information due to a legal or regulatory obligation, or for performance of a contract, and you do not provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with our services). We will notify you of this at the time.

Automated Decision-Making and Profiling

We do not make decisions that have legal or similarly significant effects on individuals based solely on automated processing. However, we do use profiling techniques to better understand our customers and tailor our services and marketing communications accordingly.

What we do:We analyse data such as your reservation history, frequency of visits, spend, items ordered, and location to identify patterns and preferences. This helps us segment our audience and deliver more relevant offers, loyalty rewards, and communications.

Why we do it:

This profiling allows us to:

Recognise and reward loyal customers
Send personalised marketing messages
Improve your experience by tailoring services to your preferences

What information we use:We use data collected through our reservation platforms, point-of-sale systems, and marketing tools. This includes:

Dates and locations of your visits
Amount spent and items ordered
Your interaction with marketing emails

Logic and impact:Our systems group customers based on their activity (e.g., frequent diners, high spenders) and assign them to segments. These segments may receive different types of offers or communications. This does not result in decisions that affect your legal rights or access to services.

Your rights:You have the right to:

Object to profiling
Request human intervention if a decision is made solely by automated means
Access meaningful information about the logic involved

If you would like to know more or exercise your rights, please contact us at privacy@majorfood.com.

How We Share Your Personal Data (Data Sharing and Processors)

We do not sell your personal data, nor share it with third parties outside of the reasons outlined below, except as permitted or required by applicable law.

We may share your personal data with third parties who provide services to us, for example, our IT, communications, CRM, email and marketing automation and hosting providers. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

We may share your personal data with third parties in the following circumstances:

We will share your personal data internally between Carbone’s wider group (the Major Food Group) and our investors to the extent required for internal administrative purposes, management purposes or other business-related purposes;

When we engage third party service providers to provide services to us (for instance, IT & website hosting, reservation system, CRM, communications and analytics service providers, such as Open Table, or Resy), who are contractually obligated to protect your data and use it only for the purposes we specify;

With professional advisors such as tax or legal advisors (for example, as necessary for the establishment, exercise or defence of legal claims or to protect the rights or safety of the Sites, our platform, our Services or us;

With consultants, insurance companies/claim managers and accountants;

With agents, suppliers or sub-contractors and other associated organisations where they are engaged by us to help deliver a service that we have instructed them on;

In order to operate the Sites, including hosting, maintenance, and analytics;

We also disclose your personal data with third parties if disclosure is required by law or in the context of an investigation, regulatory requirement, judicial proceeding, court order or legal process (including to law enforcement or competent authorities like the police/tax authorities, such as HMRC in the UK);

In order to protect against our liability and ensure safety, including fraud prevention and security measures;

With third parties in case of a corporate transaction. In addition, information about our customers and users, including personal data, may be disclosed as part of any merger, sale, transfer of our assets, investment, acquisition, bankruptcy, or similar event, including while engaging with our actual or potential investors;

To fulfill the purpose for which you provide it. For example, if you give us an email address to use the "email a friend" feature of our Sites, we will transmit the contents of that email and your email address to the recipients;

For any other purpose disclosed by us when you provide the information; and

With your consent.

Required by law. We may be required to disclose personal data as part of a legal process. We may also be required to disclose personal data in response to lawful requests by government authorities, including requests from national security agencies or law enforcement. Some of these requests may be by regulatory oversight agencies investigating a complaint, while others may be by law enforcement seeking information. We will comply with such requests only to the extent required by law and will seek to limit disclosure where possible.

We may provide anonymous information to analytics and search engine providers to help us improve and optimise our services. We will only share this information in a form that does not directly identify you.

Your Privacy Rights and Choices

You have a number of rights under data protection laws in relation to your personal data. You may exercise these by contacting us at privacy@majorfood.com:

Right to access. You have the right to request access to your personal data (commonly known as a "subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Right to correction. You have the right to request correction of inaccurate or incomplete personal data, though we may need to verify the accuracy of the new data you provide to us.

Right to deletion. You have the right to request deletion of your personal data, subject to certain limitations and exceptions in compliance with applicable law, including retention for legal or legitimate business purposes. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Right to Object. You have the right to object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.

You also have the absolute right to object any time to the processing of your personal data for direct marketing purposes.

Right to Portability. You have the right to request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Right to Withdraw Consent. You have the right to withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.

Right to Restriction. You have the right to request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in one of the following scenarios:

If you want us to establish the data's accuracy;
Where our use of the data is unlawful but you do not want us to erase it;
Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

RIGHT TO COMPLAIN

You have the right to make a complaint at any time to the relevant data protection regulator. In the UK this is the Information Commissioner’s Office (ICO) (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach any regulator, so in the first instance please contact us at privacy@majorfood.com.

Marketing Choices

We offer you several options to manage how your information is used for marketing and advertising purposes, including rights to object or withdraw consent where applicable.

Opt-Out of Marketing Communications: You can opt out of marketing communications directly from us by following instructions in our communications (i.e. via the unsubscribe link in our emails) or contacting us directly at privacy@majorfood.com. Please note that even if you opt out of marketing messages, we may still send you transactional or service-related communications necessary for the provision of services.

For more information about the cookies we use and how to change your cookie preferences, please see our Cookies Notice here.

Use of Analytics and Tracking Technologies

We use third-party analytics tools, including Google Analytics and Meta (Facebook) Pixel, to understand how visitors engage with our websites and to improve our services. For further information on this, please see our Cookies Notice here.

You can learn more about how Google collects and processes data at: https://policies.google.com/technologies/partner-sites and opt out of Google Analytics at: https://tools.google.com/dlpage/gaoptout.

You can learn more about how Meta uses your data at: https://www.facebook.com/privacy/policy and adjust your Facebook ad preferences at: https://www.facebook.com/adpreferences/ad_settings.

How We Protect Your Information

While we implement commercially reasonable technical and organisational measures to protect your personal data, no security system is completely impenetrable. We cannot guarantee the security of your data on the Sites or any third-party sites, but we strive to maintain appropriate safeguards in compliance with applicable laws.

How Long Your Personal Data Will Be Kept

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

International Data Transfers

Whenever we transfer your personal data out of the UK or the EEA to service providers or any other third party, we ensure a similar degree of protection is afforded to it by ensuring that the necessary safeguards are in place, for example:

We will only transfer your personal data to countries that have been deemed by regulators in the UK or the EU to provide an adequate level of protection for personal data; or

We may use specific standard contractual terms approved for use in the UK and EU which give the transferred personal information the same protection as it has in the UK and EU (e.g. the Standard Contractual Clauses as amended by the UK Addendum).

For more information about these safeguards, please contact us at privacy@majorfood.com.

External Websites

This Site may contain links to other independent third-party websites. Access to any other sites linked to this Site is at your own risk and Carbone assumes no responsibility for the accuracy or reliability of any information, data, opinions, advice or statements made on these linked sites. Carbone provides these links merely as a convenience and the inclusion of such links does not imply an endorsement.

We encourage you to read the Notice and legal terms of websites or online services that you visit or use.

SUPPLEMENTARY INFORMATION FOR US RESIDENTS

Notice to Residents of Nevada

This section applies only if our privacy practices are governed by the Nevada Privacy Law, and only with respect to the Site. The processing of certain personal data about you may be subject to the Nevada Privacy Law. This law gives you certain rights with respect to the processing of your personal data.

We do not sell personal data for compensation, however you have the right to opt out of the sale of your personal data if we ever engage in such activities in the future. To submit an opt out request, please contact us at privacy@majorfood.com with the subject line “Nevada Privacy Rights Request.” We will verify your identity and process your request with the timeframe required by law.

For more information about your privacy rights under Nevada law, you may visit the Nevada Attorney General’s website or contact them at:Office of the Nevada Attorney General

100 North Carson Street

Carson City, NV 89701

Notice to Residents of Colorado

This section applies only if our privacy practices are governed by the Colorado Privacy Act (“CPA”), and only with respect to the Site. As a resident of Colorado, you have the following rights regarding your personal data:

Access: You have the right to request access to the personal data we collect about you. You can ask for a copy of your data and information about how we process it.
Correct: You have the right to request the correction of inaccurate personal data that we hold about you.
Deletion: You have the right to request the deletion of your personal data, subject to certain exceptions where we may need to retain your information for legal or operational purposes.
Data Portability: You have the right to obtain a copy of your personal data in a portable format, allowing you to transfer it to another entity.
Opt-Out: You have the right to opt out of the sale of your personal data or the processing of your data for targeted advertising purposes.
Non-Discrimination: You have the right not to be discriminated against for exercising any of your rights under the CPA.

To exercise any of these rights, please contact us at privacy@majorfood.com. We will verify your identity and process your request with the timeframe required by law.

Notice to Residents of California

We use third-party analytics tools, including Google Analytics and Meta (Facebook) Pixel, to understand how visitors engage with our websites and to improve our services. For further information on this, please see our Cookies Notice here.

Under California law (CCPA/CPRA), the use of these tools may be considered a “sale” or “sharing” of personal information. If you are a California resident, you have the right to opt out of such sale or sharing by using the “Do Not Sell or Share My Personal Information” link in the footer of our website.

You can learn more about how Meta uses your data at: https://www.facebook.com/privacy/policy and adjust your Facebook ad preferences at: https://www.facebook.com/adpreferences/ad_settings.

Your State Privacy Rights

State consumer privacy laws may provide their residents with additional rights regarding our use of their personal data.

California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia provide (now or in the future) their state residents with rights to:

Confirm whether we process their personal data.
Access and delete certain personal data.
Correct inaccuracies in their personal data, taking into account the information's nature processing purpose (excluding Iowa and Utah).
Data portability.
Opt-out of personal data processing for:
- targeted advertising (excluding Iowa);
- sales; or
- profiling in furtherance of decisions that produce legal or similarly significant effects (excluding Iowa and Utah).
Either limit (opt-out of) or require consent to process sensitive personal data.

The exact scope of these rights may vary by state. To exercise any of these rights please contact us at privacy@majorfood.com. To appeal a decision regarding a consumer rights request, please contact us at privacy@majorfood.com

Changes to Our Privacy Notice

It is our policy to post any changes we make to our privacy notice on this page. If we make material changes to how we treat our users' personal data, we will notify you through a notice on the Sites home page. The date the privacy notice was last revised is identified at the top of the page. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting our Sites and this privacy notice to check for any changes.

How to Contact Us

If you have any questions with respect to this Notice or the way in which we process your personal data, you may contact us via email at privacy@majorfood.com.