PRIVATE CARDPRIVACY POLICY

Private Card Limited ("Private Card", "we", "us" or "our") respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains what personal information we collect, how and why we use it, who it may be shared with, how long we keep it and your rights.

1. Who We Are

Private Card Limited
Company number 17181445

Registered office:
5 Brayford Square
London
England
E1 0SG

General enquiries: contact@private-card.com
Privacy and data protection: privacy.data@private-card.com

Private Card Limited is registered with the Information Commissioner's Office (ICO) and has paid the data protection fee. ICO registration number: ZC253955.

Private Card is the controller where we determine why and how personal information is processed. Participating restaurants and other organisations may also act as controllers in their own right where they determine their own purposes and means of processing.

2. Information We Collect

Identity and contact information

This may include your name, email address, telephone number, postal address, profile photograph and membership identifiers.

Membership and account information

This may include membership status, membership/card identifiers, digital membership credentials, account status, membership activity, security information and information required to authenticate and protect your account.

Reservation information

This may include restaurant, requested or confirmed date and time, number of guests, seating preference, reservation status, reservation history, cancellations or changes, dietary preferences, allergy information, specific reservation requests and information you choose to provide in connection with a reservation.

Restaurant visits and spend

Depending on the systems used by participating restaurants, we may receive the restaurant visited, date and time, visit information, total spend associated with your membership, benefits or discounts applied, Hearts earned, Hearts redeemed and associated loyalty activity. Private Card does not necessarily receive an itemised record of everything you purchase.

Hearts and Favours

We may process information about Hearts earned and redeemed, balances, adjustments and associated membership benefits. We may also process Favours you send or receive, sender and recipient information, redemption information, relevant restaurant/activity, Favour status and history.

Communications, photographs and files

We may process messages and communications between you and Private Card, Private Card personnel, personnel supporting Private Card and participating restaurant personnel where relevant, including replies generated with AI assistance and any reports you make about those replies. We may also process your profile photograph and files or attachments you choose to provide.

Device, security and technical information

Private Card does not collect your device location. We may process device and app information, session information, security events, push-notification identifiers, technical logs, diagnostic and error information reasonably necessary to operate and secure Private Card.

Membership cards and digital wallets

We may process information required to create, manage, replace or revoke physical membership cards, QR/member credentials, digital membership passes and supported digital-wallet passes, including Apple Wallet and Google Wallet.

3. Where We Obtain Information

We may obtain personal information directly from you when you join Private Card, complete your profile, make a reservation request, communicate with us, provide an allergy or specific reservation request, send or receive a Favour, upload a photograph, report a reply or otherwise use Private Card.

We may also receive relevant information from participating restaurants and connected systems, including information relating to reservations, visits, spend, loyalty and membership benefits. We may receive technical information from service providers used to operate, protect and support Private Card.

Where another member provides limited information about you in connection with a Favour or similar feature, we use that information only for appropriate purposes connected with providing that feature and will provide relevant privacy information as required.

4. Why We Use Your Information

We use personal information where appropriate to create and administer your membership; identify and authenticate you; provide Private Card; receive and manage reservation requests; manage confirmed reservations; communicate with you; communicate relevant reservation information to participating restaurants; administer Hearts and Favours; record relevant restaurant visits and spend; provide membership benefits; issue and manage membership credentials; send service notifications; review and act on reports about AI-assisted replies; secure Private Card; prevent and investigate fraud or misuse; provide support; investigate technical problems; maintain appropriate records; respond to data-protection requests; comply with legal obligations; and operate and improve Private Card where permitted.

We do not use allergy information for unrelated advertising.

5. Lawful Bases

Contract

We may process information where necessary to provide your Private Card membership or a service you have requested, including relevant membership and reservation services.

Legitimate interests

We may process information where necessary for our legitimate interests or those of another organisation and where those interests are not overridden by your rights. These interests may include appropriately operating and securing Private Card, preventing fraud and misuse, maintaining service quality, reviewing reported AI-assisted replies and managing our business. Where required, we assess and document these interests and the impact on members.

Legal obligation

We may process information where necessary to comply with a legal or regulatory obligation.

Consent

Where processing depends on your consent, you have the right to withdraw that consent. Additional requirements apply to allergy information that constitutes special-category health data.

6. Allergy Information and Specific Reservation Requests

Why we use it

You may choose to provide allergy information and specific reservation requests to help Private Card manage your reservations. Certain allergy information can reveal information about your health and therefore constitute special-category personal data. We use allergy information and specific reservation requests you choose to provide solely to help manage your reservations and associated member service. We do not use allergy information for unrelated advertising.

Allergy consent

Where allergy information constitutes special-category health information, Private Card relies on explicit consent as its Article 9 condition where this is the approved basis for the relevant processing.

At signup, you are asked separately from your acceptance of the Terms:

"I consent to Private Card using allergy information and specific reservation requests I choose to provide solely to help manage my reservations, as explained in the Privacy Policy."

Private Card records appropriate evidence of this consent, including the member, consent wording/version, date and time and current consent status.

Who needs to receive the information

Where necessary to manage your reservation, relevant information may be made available to authorised Private Card personnel; authorised personnel involved in handling the reservation; the participating restaurant concerned; and service providers processing information on Private Card's behalf where technically necessary to operate the reservation and communication service. We seek to limit disclosure to information reasonably necessary for the relevant purpose.

Technology-assisted processing

Private Card may use automated or AI-assisted technology to help receive, organise, understand and respond to reservation requests and member communications. Where allergy information or specific reservation requests are processed through supporting technology, Private Card seeks to minimise the information involved and limit processing to the relevant Private Card purpose. Private Card does not use allergy information for unrelated advertising or marketing profiling. An AI-assisted reply will not confirm on its own that a restaurant can safely accommodate an allergy; that confirmation comes from the Private Card team or the restaurant.

Your choice and withdrawal

You choose whether to provide allergy information or specific reservation requests. If you do not provide particular information, Private Card cannot take that information into account when helping manage your reservation. Where processing relies on your explicit consent, you may withdraw that consent at any time by using any withdrawal facility provided in the app or by contacting privacy.data@private-card.com. Withdrawal does not make processing carried out before withdrawal unlawful.

7. Reservation Information and Restaurants

When you ask Private Card to arrange or manage a restaurant reservation, we process information necessary to handle the request. Relevant reservation information may be provided to the participating restaurant so that your reservation and requests can be handled. The restaurant may process information under its own data-protection responsibilities.

We do not provide restaurants with unrestricted access to all Private Card member information merely because they participate in Private Card. Access should be limited according to the restaurant, member, reservation and staff permissions applicable to the service.

8. Communications and AI-Assisted Replies

Private Card uses technology to assist with member communications and reservation management. This includes AI technology, hosted on Microsoft Azure, that can analyse the content of a request and generate replies. Some of these replies are sent to you directly in the app without a person reviewing them first.

Any reply you receive in the chat may have been prepared or sent with AI assistance. Replies are not individually marked. You can ask to speak to a member of the Private Card team at any time.

Sharing with our AI provider

Replies in the chat are prepared with the help of our AI provider, Microsoft (Azure OpenAI Service). To do this, the messages you send us and relevant booking details (such as the restaurant, date, time and number of guests) are sent to Microsoft.

Before anything is sent, our own systems remove your name, contact details and account details, and replace them with placeholders. Names of other people you mention are removed in the same way. This is designed so that Microsoft is not given anything that identifies you, and the details are put back only when the reply returns to our systems. Messages may still include dietary or allergy information you choose to mention, but it is not linked to your name.

Microsoft processes this information only on Private Card's behalf and does not use it to train AI models. We do not sell or share your information with AI providers for their own use.

We explain this on the sign-up screen, and you agree to it when you accept our Terms and Conditions and this Privacy Policy. If you would prefer not to use AI-assisted replies, you can contact us by email at contact@private-card.com instead of using the in-app chat.

Reporting a reply

If a reply in the chat is inaccurate, inappropriate, offensive or concerns an allergy or dietary need you are worried about, you can report it in the app by pressing and holding the message and choosing Report this reply. A report sends us the reply, the reason you chose and any comment you add. The Private Card team reviews reports, may contact you about them, and uses them to correct the conversation and improve the service. We keep reports as set out in section 17.

Where a technology provider processes personal information on Private Card's behalf, we require appropriate contractual and security arrangements. We seek to minimise personal information sent to supporting technology to what is reasonably necessary for the relevant purpose. We do not permit our AI provider to use your information to train its models.

Private Card does not make decisions producing legal or similarly significant effects about members solely using automated processing.

9. Hearts, Visits and Spend

Private Card may process information about your restaurant visits and associated spend to administer membership benefits and Hearts and provide relevant membership functionality. Depending on connected restaurant systems, Private Card may receive a total transaction value rather than an itemised receipt.

Where more detailed transaction information is introduced in future, this Privacy Policy and our data-protection documentation will be reviewed before that processing begins.

10. Favours and Information About Other People

If you send a Favour, you may provide limited information about its intended recipient. Please only provide information reasonably necessary to send or administer the Favour.

Private Card may use recipient information to identify or contact the intended recipient where appropriate, deliver or administer the Favour, prevent misuse, record redemption and provide the associated service. Where the recipient is not already a Private Card member, we will provide appropriate privacy information as required. We do not use the Favour feature as permission to use a recipient's information for unrelated marketing.

11. Profile Photographs and Uploaded Content

Profile photographs and private member files are intended to be accessible only to people or systems authorised for the relevant Private Card purpose. Private Card applies access controls and security measures appropriate to the nature of this information.

12. Membership Cards and Digital Wallets

We process information necessary to issue and administer physical and digital membership credentials. If you add your Private Card pass to Apple Wallet, Google Wallet or another supported digital wallet, that provider may process information under its own privacy terms. Private Card may revoke or replace membership credentials where required for security, membership administration or at your request.

13. Notifications

We may send operational communications necessary to provide Private Card, including reservation updates, confirmations, reminders, security notices and membership information. Where marketing communications require consent or another specific legal basis, these will be handled separately from essential service communications. You can normally manage push-notification permissions through your device.

14. Who We Share Information With

Depending on the service you use, personal information may be shared with or processed by appropriate categories of recipients including participating restaurants; cloud and database providers; reservation and restaurant technology providers; loyalty and point-of-sale technology providers; communications providers; email and messaging providers; application infrastructure providers; AI technology providers; digital-wallet providers; mapping providers; security, diagnostics and error-monitoring providers; professional advisers where necessary; and authorities where disclosure is legally required.

Participating restaurants currently include The Dover, Dover Street Counter, Chelsea Counter and Martino's. Each restaurant receives only the information needed for reservations and services at that restaurant.

We do not sell member personal information. Private Card maintains a supplier and processor register recording the role, contractual requirements and safeguards applicable to relevant providers.

15. International Processing and Transfers

Some organisations supporting Private Card may process information outside the United Kingdom, including in the United States and the European Economic Area. Before personal information is transferred internationally where UK data-protection law requires additional protection, Private Card assesses the transfer and uses an applicable lawful transfer mechanism and safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or the UK-US Data Bridge where the recipient is certified. Information about applicable safeguards can be requested from privacy.data@private-card.com.

16. Security

Private Card uses technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, loss or destruction. These measures include encryption of information in transit, authentication and authorisation controls, access restrictions, session controls, security monitoring and other safeguards appropriate to the systems involved.

No online system can guarantee absolute security. If you believe your membership or personal information has been compromised, contact us promptly.

17. How Long We Keep Information

Private Card keeps personal information only for as long as reasonably necessary for the purpose for which it was collected, including applicable legal, security, accounting, dispute-resolution and regulatory requirements. Our Personal Data Retention Schedule sets a period for each category of information. The main periods are:

When information is no longer required, it will be deleted or anonymised in accordance with the Retention Schedule, subject to information that must legitimately be retained.

18. Deleting Your Account

You can delete your Private Card account and associated personal information at any time:

• In the app: go to Settings > Delete account and follow the steps to confirm.
• On the web: visit https://private-card.com/delete-account to request deletion without using the app.
• By email: write to admin@private-card.com from the email address on your account, with the subject Account deletion request.

We may ask you to verify your identity before we act on a request. Once confirmed, your account is closed immediately, your membership card and wallet passes stop working, and any Hearts or Favours you have not used are cancelled.

Within 30 days we delete or irreversibly anonymise your personal information, including your profile, photograph, allergy information, consent history, messages and uploaded files, and we ask participating restaurants to delete reservation information they received from us where they no longer need it. Deleted information drops out of our encrypted backups within 35 days.

We keep a limited amount of information only where we have a lawful reason, and we restrict its use to that reason: transaction records of Hearts, visits and spend for 6 years for accounting and tax purposes; and information needed for an open complaint, dispute, fraud investigation or security incident until it is resolved.

Account closure is not used as a substitute for handling a valid data-erasure request.

19. Accessing and Exporting Your Information

You may ask Private Card for access to personal information we hold about you. Where applicable, you may also be entitled to receive relevant information in a portable format. Requests can be made to privacy.data@private-card.com.

We may need to verify your identity before releasing personal information. We will not provide another member's personal information merely because it appears in information associated with your account.

20. Your Data-Protection Rights

Depending on the circumstances and lawful basis involved, you may have rights including the right to be informed about how your information is used; access your personal information; correct inaccurate information; request deletion; restrict certain processing; data portability in applicable circumstances; object to certain processing; and withdraw consent where processing is based on consent.

These rights are not absolute in every circumstance. To exercise a right, contact privacy.data@private-card.com. We may need to verify your identity. We respond within one month.

21. Your Right to Object

You have the right to object to certain processing of your personal information where we rely on legitimate interests. If you wish to object, contact privacy.data@private-card.com. We will consider the circumstances and applicable legal requirements.

22. Complaints

If you have a concern about how Private Card handles your personal information, please contact us first so we can investigate it at privacy.data@private-card.com.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator, at https://ico.org.uk/make-a-complaint.

23. Changes to This Privacy Policy

Private Card may update this Privacy Policy from time to time. Routine updates to the Private Card app do not automatically require a new Privacy Policy or require you to provide your consent again.

We will keep this Policy under review so it accurately describes our processing. Where we make a material change to how we use personal information, we will bring relevant information to members' attention where required. Where a change means that an existing consent is no longer sufficiently specific or informed for the processing proposed, we will obtain fresh consent before relying on that consent for the new processing.

The current version of this Privacy Policy is available in the app and at https://private-card.com/privacy.

24. Contact Us

For account deletion, email admin@private-card.com. For privacy questions, data requests, consent withdrawal or concerns about your information:

Private Card Limited
Company number 17181445
5 Brayford Square
London
England
E1 0SG

Privacy & Data Protection: privacy.data@private-card.com
Account deletion: admin@private-card.com
General enquiries: contact@private-card.com

Version: 1.1
Effective: October 2026

Version History