Privacy Policy

Last updated: 14 September 2026

This Privacy Policy explains how Venn Canteen collects, uses, and protects personal data when you visit this website or book a table with us.

1. Who we are

This website is operated by Combined Ingredient, LDA, trading as Venn Canteen.
Tax number: PT516193430
Contact: [email protected]

2. What data we may collect

Depending on how you use the site, we may process:

• technical and usage data, such as page views, approximate location, browser, device type, referring source, and interaction events
• contact data, if you contact us by e-mail
• consent preference data, such as whether you accepted or rejected analytics
• reservation data, if you book a table with us (see section 4)

3. How we use your data

We use data only where there is an appropriate legal basis, including:

• to operate and secure the website
• to respond to enquiries
• to understand how the website is used, where you have consented to analytics
• to remember your cookie preference

4. Reservations and guests

This section applies when you book a table with us, whether through the booking widget on this website, Reserve with Google, TheFork, Instagram, by phone or e-mail, or in person.

4.1 What we collect

When you book, we process:

• your name, e-mail address and phone number
• the date, time and size of your party, and the status of the booking (confirmed, cancelled, no-show)
• any notes you add to the booking, including dietary requirements and allergies, and the occasion if you tell us (a birthday, an anniversary)
• your visit history with us: past bookings, cancellations and no-shows, and the estimated spend recorded by our reservation system for each visit
• the country code of your phone number, which we use to understand where our guests come from

Notes are free text. Please include only what we need to look after you at the table, and no health information beyond dietary requirements and allergies.

4.2 Where the data comes from

From you, when you book through the widget on this website (operated by UMAI), by phone, e-mail, Instagram or in person. Where you book through Reserve with Google or TheFork, that platform passes your booking details to us. Those platforms are separate controllers for their own services and have their own privacy policies.

4.3 What we use it for

• to take, confirm and manage your reservation, and to contact you about it (confirmations, reminders, changes)
• to prepare your visit, including passing dietary requirements and allergies to the kitchen and floor team
• to recognise you as a returning guest
• to manage cancellations and no-shows
• to understand demand and plan staffing and purchasing, mostly in aggregate (how many guests on a given night, where they come from, how far in advance they book)

4.4 Legal bases

• performance of a contract: taking and fulfilling your reservation and contacting you about it
• our legitimate interests: preparing service, recognising returning guests, managing no-shows, understanding demand so we can plan the restaurant, and the name check described in 4.8. You may object to processing based on legitimate interests (see section 12)
• your consent: the dietary requirements and allergies you choose to give us so we can prepare your meal; we use them for nothing else

4.5 Who receives it

• our team, to the extent needed to prepare and deliver your visit
• UMAI, the reservation platform that takes and stores bookings on our behalf
• the platform you booked through (Reserve with Google or TheFork), which receives the status of your booking
• the providers that host our internal systems: database and hosting (Supabase, Vercel), e-mail and automation (Google Workspace, GitHub)
• Anthropic, for the name check described in 4.8

We do not sell reservation data and we do not share it with advertisers.

4.6 How long we keep it

• reservation and guest records: 2 years after your last visit, after which they are deleted or reduced to anonymous aggregate counts
• free-text notes on a booking: 6 months after the visit
• UMAI keeps its own copy under its own policy; you can ask UMAI to delete your UMAI profile directly

4.7 International transfers

Our database is hosted in the European Union (Ireland). UMAI is based in Singapore and Malaysia and may process data outside the European Economic Area under its own terms. Some of our other providers are based in the United States. Where data leaves the EEA we rely on the European Commission’s standard contractual clauses or, where the provider is certified, the EU-US Data Privacy Framework. You can ask us for details of the safeguards in place.

4.8 Automated processing

We do not make automated decisions about you that have legal or similarly significant effects.

To help the owner prepare service, we may check whether the name on a booking matches a publicly known food, hospitality or media professional. Only the name is sent to an AI service provider (Anthropic, United States) for this check; your contact details and booking notes are not. Any suggestion is reviewed by the owner and does not affect whether your booking is accepted, the price, the menu, your table or the service you receive. We rely on our legitimate interest in preparing service. You may object at any time by writing to [email protected], and we will stop checking your bookings.

4.9 Your choices

You can correct or delete your booking details by writing to [email protected]. You can also manage your UMAI guest profile directly with UMAI. Section 12 describes your rights.

5. Analytics

If you consent, we use Google Analytics 4 to understand how visitors use the website. This may include page views, approximate geolocation, device and browser information, traffic source, and interactions with selected links or calls to action.

We use only Google Analytics 4 for analytics on this website. We do not currently use advertising pixels, remarketing tools, or other analytics trackers.

Google signals is disabled.

6. Categories of cookies and similar technologies

We currently use:

• Strictly necessary: required for core site function or remembering your cookie preference
• Analytics: used only if you consent, to measure visits, traffic sources, geography, devices, browsers, and selected interactions

7. Legal bases

Our legal bases may include:

• your consent, for analytics cookies and analytics measurement
• performance of a contract, for taking and fulfilling your reservation
• legitimate interests, where applicable, for basic site operation, security, and handling direct enquiries
• compliance with legal obligations where required

8. Who receives the data

Depending on your choices and how you use the site, data may be received by:

• Combined Ingredient, LDA / Venn Canteen
• our hosting provider and technical service providers
• Google, where you consent to Google Analytics 4
• UMAI, our reservation platform, if you book a table
• TheFork or Google, where you booked through them
• Anthropic, for the owner-reviewed name check described in section 4

9. International transfers

Where Google Analytics is enabled by your consent, analytics data may be processed by Google in accordance with Google's own infrastructure and terms. You should review Google's own privacy and data protection documentation for further detail.

Reservation data: see section 4.7.

10. Retention

We retain data only for as long as necessary for the purposes described above.

Consent preference data is kept so we can remember your choice.

Google Analytics user-level retention is configured at 2 months unless and until we change that setting.

Reservation data: see section 4.6.

11. How to change consent

You can change your analytics consent at any time by using the "cookies" control available on the website. You can also clear relevant site storage in your browser and revisit the site.

12. Your rights

If applicable under data protection law, you may have rights of access, rectification, erasure, restriction, objection, portability, and the right to withdraw consent at any time where processing is based on consent.

Where we rely on legitimate interests, you have the right to object at any time; we will stop unless we have compelling grounds to continue. You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt. We respond to requests within one month.

13. Contact

For privacy-related questions, contact [email protected].