Privacy & Cookie Policy

1. Who we are

The Milk Thistle Bristol ("we", "us", "our") operates this website and the bar, private rooms and drinks experiences at Quay Head House, Colston Avenue, Bristol, BS1 1EB.

We are the data controller for the personal information described in this policy. If you have any question about privacy, please write to info@milkthistlebristol.com.

2. Information we collect

Depending on how you use this website, we may hold:

• Your name and email address, if you sign up to our newsletter. • The contact details and any information you include when you email us about private hire, a tasting experience or a cocktail masterclass. • Booking details you enter into the booking calendar embedded on our masterclasses page, which is handled by our booking provider. • A record of the marketing consent you gave, including the wording shown to you, the page you signed up from and the date and time. • Your cookie preferences, together with the date and the policy version they relate to. • Technical information created automatically when a page is served, such as IP address, browser type and request logs, used for security and reliability. • Administrator account details, for the small number of people who manage the website.

We do not ask for special category data and we do not knowingly collect information from children.

3. How we collect your information

We collect information directly from you when you complete the newsletter form, email us using the enquiry links, or make a booking through the embedded booking calendar.

We also receive limited technical information automatically from your browser when you visit, and from the cookies and similar technologies described below.

4. Why we use your information

• To reply to enquiries about private hire, tastings and masterclasses. • To take and manage bookings, and to contact you about a booking you have made. • To send newsletters and news of events and special evenings, where you have asked us to. • To operate, maintain and secure this website, and to prevent misuse of our forms. • To keep records we are required to keep, and to establish or defend legal claims.

We do not sell your personal information, and we do not use it to make automated decisions about you.

5. Our lawful bases

• Consent — optional marketing emails and non-essential cookies. You may withdraw consent at any time. • Contract, or steps taken at your request before entering a contract — taking and managing bookings for tables and experiences. • Legitimate interests — replying to enquiries you send us, running and improving this website, keeping it secure and preventing spam or abuse. We have considered your rights and interests when relying on this basis. • Legal obligation — where we must keep records, for example for tax and accounting purposes.

6. Newsletter and marketing communications

Subscribers give us their name and email address voluntarily by completing the sign-up form and ticking the consent box. The box is never pre-ticked.

Marketing emails are only sent where valid consent has been given. You can withdraw consent at any time, and every marketing email should include an unsubscribe link. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

If you unsubscribe, we keep a minimal suppression record — normally your email address and the fact that you unsubscribed — so that you are not contacted again by mistake.

7. Bookings and cocktail masterclasses

Masterclass bookings are taken through a booking calendar embedded on our masterclasses page and operated by our booking provider. When you use it, the details you enter are processed by that provider in order to confirm your booking, and the provider sets its own browser storage in your browser.

Because it is a third-party embed, we only load the booking calendar once you have allowed functional cookies or asked us to load it. We use your booking details to prepare for and deliver your experience.

8. Enquiries and private hire

The enquiry buttons on this website open a message in your own email programme, addressed to our team. We receive whatever you choose to include and keep the correspondence for as long as needed to deal with your enquiry and any resulting booking.

9. Website administration and security

A small number of authorised people can sign in to a private administration area to update the words, pictures and details on this website and to manage the mailing list. Access requires an individual account and is restricted by role, and administrator sign-in information is stored in the administrator's own browser only.

Our hosting and database providers keep technical logs, which help us keep the website available and secure.

10. Cookies and similar technologies

Cookies, and similar technologies such as local storage, are small pieces of data that a website stores in your browser. Some are essential; others are optional. Full details, including the cookie table and how to change your choices, are set out in the Cookie Policy further down this page.

11. Who we share information with

We share personal information only with the suppliers who help us run this website and our bookings, and with professional advisers or authorities where the law requires it. Our current processors are listed in the table below.

12. International data transfers

Some of our suppliers may store or process information outside the United Kingdom. Where that happens, we rely on the safeguards those suppliers put in place, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

Where an individual supplier's arrangements are still being confirmed, this is marked in the processor table.

13. How long we retain information

• Newsletter subscribers — until you unsubscribe or ask us to delete your details, after which a minimal suppression record is kept. • Enquiry correspondence — normally up to two years after our last contact. • Booking records — as held by our booking provider, and by us for as long as needed for the booking and any legal or accounting requirement. • Cookie preferences — stored in your browser and refreshed at least every six months. • Security and technical logs — for a short period set by our hosting and database providers.

14. How we protect information

Information is held in access-controlled systems, protected in transit by encryption, and only reachable by authorised accounts. Database access rules restrict who can read or change records, and administrator accounts are individually managed.

15. Your UK GDPR rights

Subject to the circumstances, you have the right to:

• Access the personal information we hold about you. • Have inaccurate information corrected. • Ask for information to be erased. • Ask us to restrict how we use your information. • Object to processing based on our legitimate interests, and to object to direct marketing at any time. • Receive certain information in a portable format. • Withdraw consent where we rely on it. • Complain to the Information Commissioner's Office.

To exercise any of these rights, email info@milkthistlebristol.com. We reply within one month.

16. Withdrawing consent

You can unsubscribe from marketing at any time using the link in our emails or by emailing us. You can change or withdraw your cookie consent at any time using the "Cookie Settings" link in the footer of every page — withdrawing is as easy as giving consent.

17. Making a complaint

Please contact us first so we can put things right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at https://ico.org.uk/.

Visit the Information Commissioner's Office

18. Changes to this policy

We update this policy when our practices or suppliers change. The effective date is shown at the top of this page. Where cookie use materially changes, we ask for your cookie consent again.

19. Contacting us

The Milk Thistle Bristol, Quay Head House, Colston Avenue, Bristol, BS1 1EB.

Privacy enquiries: info@milkthistlebristol.com