Privacy Policy

2. The data we collect

• Booking details — your name, email, phone number, party size, date and time, and any special-occasion notes.
• Dietary and allergen information — where you choose to share it. As this can concern your health, we treat it with particular care (see below).
• Order and payment data — items ordered, amounts, and tokenised payment details.
• Visit and marketing data — your visit history and spend, your contact preferences, and how you engage with our messages, where you have opted in.
• Website data — device and usage data collected by cookies and similar technologies, with your consent where required.
• CCTV footage — where CCTV operates on our premises, with signage displayed.

We collect only what we need, and you can dine with us providing no more than a booking and payment require.

4. Marketing and profiling

If you opt in, we may contact you by email, SMS with news, events and offers. You can withdraw consent at any time — an unsubscribe link in every email. To keep what we send relevant, we build a guest profile that combines your booking and visit history, spend, and how you engage with our messages. This is used only to tailor offers; it has no legal or similarly significant effect, and you can object at any time. Making a booking stores your details as a guest record in our systems, but we only send you marketing if you have separately opted in — a booking alone never adds you to marketing.

5. Who we share your data with

We share personal data only with the providers we rely on to run Doolally, each under a data-processing agreement, and we use trusted integration services to move data securely between these systems.

Reservations (OpenTable)

Reservations are taken through OpenTable. When you book, OpenTable acts as an independent controller under its own terms and privacy policy, which you accept at the time. The guest records we hold in our OpenTable book are ours, and for those OpenTable acts as our processor under a data-processing agreement. OpenTable may transfer data to the United States under appropriate safeguards.

Orders and payments (Toast)

Orders and payments are processed through Toast, acting as our processor. Card details are tokenised and handled in line with PCI-DSS. Data may be transferred to the United States under Standard Contractual Clauses.

Email and SMS marketing (Klaviyo)

Our marketing communications and guest database are operated in Klaviyo, acting as our processor, with data stored in the United States under the EU–US Data Privacy Framework (Standard Contractual Clauses as a fallback).

Advertising (Meta)

With your consent, we use Meta advertising tools (the Meta Pixel) to measure and improve our advertising. For the collection and transmission of this event data, we and Meta Platforms Ireland Limited act as joint controllers under Article 26 GDPR; thereafter Meta processes the data as an independent controller under its own policy. Data may be transferred to the United States under the EU–US Data Privacy Framework. These tools run only if you accept marketing cookies, and you can withdraw consent at any time.

Advertising (Google Ads)

With your consent, we use Google Ads for advertising measurement and remarketing. Event data about your visit (such as pages viewed and completed bookings) is shared with Google Ireland Limited and may be transferred to Google LLC in the United States under the EU–US Data Privacy Framework. These tags run only if you accept marketing cookies, and you can withdraw consent at any time.

Advertising (TikTok)

With your consent, our website uses the TikTok Pixel, which shares event data about your visit (such as pages viewed and completed bookings) with TikTok Technology Limited (Ireland). Transfers outside the EEA are made under Standard Contractual Clauses. It runs only if you accept marketing cookies, and you can withdraw consent at any time.

Website analytics (Google Analytics 4)

With your consent, we use Google Analytics 4 to understand and improve how our website is used, operated by Google Ireland Limited as our processor with Google Consent Mode. Data may be processed in the United States under the EU–US Data Privacy Framework. Analytics cookies run only if you accept them.

Website insights (Microsoft Clarity)

With your consent, we use Microsoft Clarity for aggregated heatmaps and session insights to improve our website; it masks text you enter into forms. Microsoft acts as our processor, and data may be transferred to the United States under the EU–US Data Privacy Framework. It runs only if you accept analytics cookies.

Other recipients. Professional advisers, insurers and public authorities where the law requires, and a buyer or seller if our business changes hands, under confidentiality.6. Dietary and allergen information

6. Dietary and allergen information

Allergen and dietary notes can reveal information about your health, which the GDPR treats as special category data. We record it only with your explicit consent, use it solely to prepare and serve your food safely, and limit access to the team who need it. Where it is stored on your guest profile so we can serve you safely on return visits, we keep it while you remain an active guest and remove it on request. Sharing it is always optional.

7. International transfers

Some providers process data outside the European Economic Area, mainly in the United States. Where they do, transfers are protected either by a European Commission adequacy decision (the EU–US Data Privacy Framework) or by Standard Contractual Clauses under Chapter V GDPR. You can request details of the safeguard that applies at privacy@eclective.ie.

9. Your rights

You have the right to access your data; to correct or erase it; to restrict or object to processing (including objecting to direct marketing at any time, which we will always honour); to data portability; and to withdraw consent at any time without affecting prior processing. To exercise any right, email privacy@eclective.ie and we will respond within one month. You may also complain to the Data Protection Commission (dataprotection.ie), though we would welcome the chance to resolve any concern first.

10. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls and staff training, and we require the same of our providers. If a breach occurs that is likely to risk your rights and freedoms, we will notify the Data Protection Commission, and you where required, without undue delay.

11. Children

Our services and marketing are directed at adults. We do not knowingly collect the data of children under 16, the digital age of consent in Ireland, for marketing. If you believe a child has provided us with personal data, contact privacy@eclective.ie and we will remove it.

12. Changes

We may update this policy from time to time. The effective date above shows the current version, and we will flag significant changes on our website.