Pho Ta Restaurant operates Vietnamese dining at Pho Ta Finchley Road, 2 Canfield Gardens, South Hampstead, NW6 3BS. We are the data controller for personal information collected through this website and our online reservation system.

For privacy enquiries or to exercise your rights, contact us at Photafinchley@gmail.com, or call either branch during opening hours.

When you make a reservation or contact us, we may collect:

• Your name, email address, and telephone number
• Reservation details: date, time, party size, venue, and seating preference
• Special requests you choose to provide (e.g. dietary needs, celebrations, accessibility)
• Booking reference, status, and whether confirmations or reminders were sent
• Technical data when you use the site (browser type, IP address, pages visited) through our hosting provider

We do not intentionally collect sensitive personal data. If you mention allergies or health-related needs in special requests, we treat that information carefully to serve you safely — see our Food hygiene & allergies page.

We use your information to:

• Process and manage your table reservation
• Send booking confirmations and reminders by email (and SMS if enabled)
• Notify restaurant staff of new bookings
• Contact you about changes, cancellations, or questions regarding your visit
• Maintain customer records and booking history for repeat guests (admin use)
• Improve our service and keep our website secure

Our lawful bases under UK GDPR include: performance of a contract (honouring your booking), consent (where you agree to receive email communications), and legitimate interests (running our restaurants safely and efficiently).

Booking confirmations and reminders are sent by email. We may use a transactional email provider (such as Resend) or secure SMTP (e.g. our restaurant email account) to deliver messages. If SMS reminders are enabled, messages may be sent via Twilio using the mobile number you provide.

You can withdraw consent for marketing at any time — we do not send promotional emails unless you separately opt in. Service messages about your booking are part of managing your reservation.

We use trusted service providers who process data on our instructions:

• Supabase — secure database hosting for bookings and customer records
• Vercel — website hosting and infrastructure
• Email delivery — Resend and/or SMTP (restaurant email)
• Twilio — SMS notifications (when configured)

We do not sell your personal data. We may disclose information if required by law or to protect the rights and safety of our guests and staff.

Information you share about allergies, dietary needs, or special occasions is used only to prepare for your visit and improve your experience. Staff may record notes on guest profiles for internal use (e.g. VIP preferences). We do not publish guest details and restrict admin access to authorised personnel only.

• Active booking records are kept for the duration of your reservation and a reasonable period afterwards
• Customer profiles and booking history may be retained to recognise returning guests and improve service
• You may request deletion of your data — we will honour this unless we must retain records for legal or accounting reasons

Under UK data protection law, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request erasure of your data in certain circumstances
• Object to or restrict processing in certain circumstances
• Data portability where applicable
• Withdraw consent where processing is based on consent
• Lodge a complaint with the ICO (ico.org.uk)

To make a request, email Photafinchley@gmail.com with your name and booking reference if you have one.

Our public website uses minimal cookies. Staff admin login uses a session cookie. See our Cookie policy for details.

We use industry-standard measures including encrypted connections (HTTPS), access controls on admin systems, and reputable cloud providers. No method of transmission over the internet is completely secure; we work to protect your data and review our practices regularly.

We may update this policy from time to time. The date at the top of this page shows when it was last revised. Continued use of the website after changes constitutes acceptance of the updated policy where permitted by law.