Privacy Policy

For the purposes of this website, the data controller is:

Telephone: 0113 226 0276

If you have a question about how your personal information is used, you can contact us using the telephone number above or speak to the restaurant directly.

Online reservations

When you make a reservation through our website, we may collect:

• your name;
• email address;
• telephone number, if provided;
• party size;
• booking date and time;
• special requests or information you choose to provide;
• confirmation and booking reference information; and
• technical information needed to process and protect the booking request.

Please avoid including unnecessary sensitive personal information in the special-requests field.

Private Dining

The Private Dining section of our website currently provides telephone and Visit Us contact options.

It does not currently submit or store Private Dining enquiry details through an online form.

Technical and security information

When you use the website or booking service, certain technical information may be processed automatically, including:

• IP address;
• browser or user-agent information;
• request times;
• error and diagnostic information; and
• information required for rate limiting, security and bot protection.

IP addresses used for our application rate limiter are held temporarily in Cloudflare KV for approximately 60 seconds.

We use personal information where necessary to:

• receive, manage and administer restaurant reservations;
• check table availability;
• provide and manage booking confirmation codes;
• allow reservations to be looked up or cancelled;
• respond to operational issues relating to a booking;
• keep the website and booking service secure;
• prevent abuse, spam and excessive automated requests;
• diagnose technical faults and improve service reliability; and
• comply with legal obligations where applicable.

For reservation information, we primarily process your information because it is necessary to take steps at your request and to provide the booking service you have asked us to provide.

For website security, rate limiting and technical error monitoring, we rely on our legitimate interests in operating a secure, reliable and functioning website.

The booking form allows you to enter special requests.

You should only include information that is reasonably necessary for the restaurant to understand and accommodate your booking.

Special requests may sometimes contain information about allergies, accessibility requirements or other health-related needs. Where you choose to provide this information, we will use it only as reasonably necessary to understand and accommodate your request and will not use it for marketing purposes.

Booking personal information will normally be retained for 12 months after the relevant booking date.

After that period, personal information will be deleted or anonymised unless we reasonably need to retain particular information for longer because of a legal obligation, dispute, complaint or other legitimate legal requirement.

Cancelled bookings are subject to the same retention approach.

Short-lived security information, such as IP-based rate-limit records, is retained for much shorter periods.

We use a limited number of service providers to operate the website and booking system.

Cloudflare

Cloudflare provides website infrastructure, hosting, API services, media delivery, rate limiting and related security functionality.

Cloudflare Turnstile may also be loaded on the reservation page to assist with bot and abuse protection.

Supabase

Supabase provides the database infrastructure used to store and manage restaurant booking records.

Booking information submitted through the website is transmitted securely through our Cloudflare API service and stored in Supabase.

Sentry

We use Sentry to monitor technical errors and performance issues.

Sentry may receive technical information such as browser information, IP/network metadata, error details and diagnostic information.

Our implementation is configured to avoid intentionally sending guest names, email addresses and telephone numbers in error reports.

Session replay is not enabled.

Sanity

Sanity is used to provide website content such as menus and other restaurant information.

Visitor booking information is not sent to Sanity.

Email services

The website contains technical support for reservation confirmation emails through Resend, but automated booking confirmation email sending is currently disabled.

If this feature is enabled in the future, this Privacy Policy should be updated before or at the time the feature becomes active.

At present, the Gallio Leeds website does not use:

• Google Analytics;
• Google Tag Manager;
• Meta Pixel;
• TikTok Pixel;
• advertising trackers;
• marketing cookies;
• browser localStorage for visitor tracking; or
• browser sessionStorage for visitor tracking.

The website does not currently operate a marketing or advertising profiling system.

If this changes in the future, we will update this Privacy Policy and introduce any consent controls required by law.

The website may contain links to third-party services.

For example, the Visit Us section may link you to Google Maps for directions.

These are external links rather than embedded tracking services. Once you follow an external link, the third party's own privacy policy and terms will apply.

We do not sell your personal information.

We only disclose information where reasonably necessary to:

• operate the booking service;
• use the infrastructure providers described above;
• protect the website and restaurant from fraud, abuse or security threats;
• comply with the law; or
• establish, exercise or defend legal claims.

Our service providers process information only for the services required to operate the website and booking system.

Some technology providers used by the website may process information using infrastructure located outside the United Kingdom.

Where personal information is transferred internationally, appropriate safeguards should be used in accordance with applicable UK data-protection law.

Depending on the circumstances, UK data-protection law may give you the right to:

• ask for access to personal information we hold about you;
• ask us to correct inaccurate information;
• ask us to delete information in certain circumstances;
• ask us to restrict how information is used;
• object to certain processing;
• receive certain information in a portable format; and
• withdraw consent where processing is based on consent.

These rights are not absolute and may depend on the circumstances and the lawful basis for processing.

To make a privacy request, contact Gallio Leeds using the contact details in this policy.

We may need to verify your identity before responding to a request.

If you have concerns about how your personal information is handled, please contact Gallio Leeds first so that we can try to resolve the matter.

You also have the right to raise a concern with the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.

We use technical and organisational measures intended to protect information handled through the website.

These include controlled server-side database access, rate limiting, error monitoring and restricted administrative access.

No internet service can guarantee absolute security, but we aim to use measures proportionate to the information being handled.

We may update this Privacy Policy if the website, booking system, service providers or legal requirements change.

The latest version will always be published on this page together with its last-updated date.