Guest privacy in a restaurant that remembers you

The best restaurants remember their guests. They know the regular's usual table, the allergy that matters, the anniversary in October. Guests love it: being remembered is one of the warmest feelings a restaurant can give. But there is a line. A restaurant that remembers too much, or remembers the wrong things, or uses what it knows in ways the guest never expected, stops feeling warm and starts feeling watchful.

Guest privacy is how a venue stays on the right side of that line. It covers what you store about guests, who can see it, how long you keep it, what you use it for and what guests can ask of you. Done well, it lets a venue be memorable without being creepy, and it keeps the venue within the data protection rules that apply where it trades.

This guide covers the difference between being remembered and being watched, the guest data worth keeping, who should see it, how long to keep it, marketing consent, what guests may ask for and how to build privacy into everyday service. Every venue and figure in it is an example, and none of it is legal advice.

The difference between being remembered and being watched lies mostly in expectation. A guest expects a restaurant to remember their booking, their allergy and perhaps their favourite table, because they told the restaurant those things. They do not expect it to remember who they dined with last month, how much they tipped or what they looked like.

Use what guests have shared, for the purpose they shared it, and the memory feels like care. Use what they did not share, or use it for something unexpected, and the same memory feels like surveillance.

The wider principle of information privacy is about exactly this: people keeping some control over what is known about them and how it is used.

The guest data worth keeping is the data that helps you serve guests well and reach them if they want to hear from you: their name, contact details, bookings and visits, allergies and dietary needs, preferences they have shared, notes that help the next visit and whether they have agreed to receive marketing.

Each of those has a clear purpose. Guests would recognise and accept most of them. Our guide to guest data: what to collect and what to leave covers the list in more detail.

Some data has no place in a restaurant's records: comments on appearance, guesses about health, religion or relationships, opinions about guests as people, details overheard at the table. None of it helps service, and all of it would embarrass the venue if a guest saw it.

Our guide to notes you should not keep about a guest covers the line with examples, and the simple test: would you be comfortable if the guest read the note over your shoulder?

Allergies and dietary needs are health information, which data protection rules in many countries treat with extra care. Guests share them so the kitchen can keep them safe, and that is the purpose to use them for.

Record them precisely, keep them where they reach the booking, the table and the kitchen, and do not use them for anything else. A guest who told you about a nut allergy did not agree to be marketed to as "a guest with a nut allergy".

Guest privacy depends as much on who can see data as on what is stored. Not everyone on the team needs every guest's full history. A host taking a booking needs a name, a number and any allergies; a manager may need visit history and spend; a marketing lead may need consent and segments.

Give each role the access it needs and no more. Fewer people with access means fewer chances for data to be misused, read out of curiosity or taken when someone leaves.

Data is only as safe as the accounts that can reach it. Make sure every member of staff has their own sign-in, with a strong password or a second step for managers, and remove access on the day someone leaves.

Lost devices are a risk too. A tablet left on a train with a manager signed in can expose every guest's details. Lock devices, sign out of shared screens and know how to remove a lost device's access quickly.

Data protection rules in many countries expect you to keep personal data only as long as you need it. A regular's profile is needed as long as they keep visiting. A guest who visited once five years ago, never returned and never agreed to marketing may not need to be kept at all.

Decide how long you keep different kinds of data, and review it from time to time. Notes about a single visit can go after a while; a profile with no visits for many years and no consent may be worth removing. Write your approach down, so it is applied consistently.

Holding a guest's email address does not mean you may send them marketing. In many countries, you need their consent, freely given and clearly recorded, before sending offers and news. A guest who booked a table agreed to hear about that booking, not to receive a monthly newsletter.

Ask clearly, at the right moment, with a box the guest ticks for themselves. Record when and how they agreed. Make it easy to unsubscribe in every email. Our guide to marketing consent, collected so it holds up covers how.

Consent can be withdrawn at any time, and a guest who unsubscribes must stop receiving marketing straight away. Respect it promptly and completely: a guest who unsubscribes and keeps receiving emails from another list feels ignored, and may complain.

Consent can also go stale. A guest who agreed years ago and has never opened an email may no longer want to hear from you. Many venues ask long-quiet guests whether they still want to stay on the list, and remove those who do not answer.

Under data protection rules such as the UK and EU rules, guests usually have rights over their data. They can ask what you hold about them, ask you to correct it if it is wrong, ask you to stop using it for marketing and, in many cases, ask you to delete it.

Know how you would answer each request before it arrives: where the data lives, who gathers it, how quickly you must respond and how you would remove it if asked. Take advice on the rules where you trade.

When a guest asks to see what you hold, gather it from every system: the booking system, the till, the email tool, any spreadsheets. Check it before sending, and correct anything that is wrong. Answer within the time the rules allow.

A request like this is also a useful mirror. If you would be uncomfortable sending a guest their own profile, something in how the team records data needs to change.

When a guest asks you to delete their data, remove it from every place it lives, unless you have a legal reason to keep part of it, such as records needed for tax. Confirm to the guest that you have done so.

Take care with allergies. If a guest who asked to be forgotten books again, they will be a new guest to you, and their allergy will need to be asked again. That is the right outcome; it is their choice.

Most of a venue's guest data lives in systems provided by others: the booking system, the till, the email tool. Under data protection rules, the venue usually remains responsible for that data. Check each provider's terms: where the data is stored, who can access it, how it is protected and what happens when you leave.

Choose providers who can answer clearly, and who give you the tools to see, correct and remove guest data when a guest asks. Our guide to owning your guest data when you switch systems covers the questions to ask.

Privacy matters in the room as well as in the records. Do not read out a guest's allergy or history in front of their companions unless they have shared it themselves. Do not greet a guest with "your usual table for two?" when they arrive with someone new. Do not mention a past complaint loudly at the door.

Train the team to use what they know discreetly. Recognition should make the guest feel welcome, not exposed.

Campaigns are where guest data is easiest to misuse. Sending to guests who did not agree, targeting guests by sensitive details or using data for something they would not expect all damage trust.

Send marketing only to guests who opted in, segment by what guests would expect, such as how often they visit, and never single guests out by health information such as allergies. A campaign that feels personal is welcome; one that feels like it knows too much is not.

Privacy works best when it is part of the routine rather than a policy in a drawer. Include it in training: what to record, what not to, who can see what and how to handle a guest's request. Review access when staff change. Clean up old notes and dormant profiles from time to time.

A short written privacy approach, shared with the team, turns good intentions into consistent practice.

Guests are more comfortable being remembered when they know what you keep and why. A clear, plain privacy notice on your booking page and website, explaining what you collect, why, how long you keep it and how to ask questions, builds that trust.

Keep it short and readable. A privacy notice written in plain words, that a guest can understand in a minute, does more for trust than a long legal document nobody reads.

Guest privacy has a mirror: the privacy of the team. Staff names appear on bookings, notes and reports, and staff see guests' details every day. A venue that handles guest data carefully usually handles staff data carefully too, and the two habits reinforce each other.

Make sure staff know what they may and may not do with guest details: no looking up guests out of curiosity, no sharing details with friends, no taking lists home. Explain it as part of their first week, alongside the reasons.

A team that understands why privacy matters protects it without being told every time.

Many venues use cameras for security, and guests increasingly take photos and videos of their meals and the room. Both raise privacy questions. Security cameras should cover what is needed, with clear notices, and recordings should be kept only as long as necessary and seen only by those who need to.

Be careful with photos of guests. Ask before posting a photo of a guest on social media, even a flattering one, and never post photos of guests who have not agreed. A guest who finds themselves on a venue's feed without being asked may not come back.

Children's details deserve extra care. A booking that includes a child's name, a birthday for a child or an allergy for a child should be handled with the same care as an adult's, and often more.

Collect only what the booking needs, record allergies precisely and never use a child's details for marketing. Parents trust the venue with their children's safety, and with their children's information.

Mistakes happen: an email sent to the wrong list, a device lost with guest details on it, a note seen by someone who should not have seen it. When they do, act quickly. Find out what happened, limit the damage, tell the people affected where it is right to do so and take advice on whether the rules require you to report it.

Learn from it. Most privacy mistakes come from a gap in the routine that can be closed: an access level too wide, a list sent without checking, a device without a lock.

In a group, guest data may be shared across venues, so a guest recognised at one is welcomed at another. That is valuable, but guests should know which business holds their data and how it is shared.

Agree as a group what is shared, who can see it at each venue and how marketing is sent, so a guest does not receive four emails from four venues in the same week. Treat privacy as a group policy, not something each venue decides alone.

The reward for good privacy is trust. Guests who trust a venue share more: their allergies, their preferences, their occasions, their email address. That information lets the venue look after them better, which earns more trust.

A venue that is careless with privacy loses that cycle. Guests share less, and the venue knows less about the people it most wants to keep.

Not all guest data lives in systems. Printed booking sheets, the reservations diary, notes stuck to the pass and lists left by the host stand all carry names, phone numbers and sometimes allergies. They are easy to forget, and easy for anyone passing to read.

Keep printed lists to what the shift needs, store them out of the guests' sight and shred them at the end of the night rather than putting them in the recycling. Position screens at the host stand and the till so guests cannot read them from where they stand, and lock them when nobody is there.

A guest who glances at the host stand and sees another guest's phone number written on a sheet will wonder what others can see about them.

Venues regularly get calls asking whether someone is booked tonight, what time a guest arrived or who they were with. Some callers are planning a surprise. Others are not, and the venue cannot tell which is which over the phone.

The safe rule is simple: never confirm whether a guest is booked, dining or expected, and never give out their details. Offer to take a message and pass it on, or ask the caller to contact the guest directly. A surprise can still be arranged through the guest's companion, who often made the booking.

Train everyone who answers the phone or greets at the door in this rule. It protects guests from people they may not want to see, and it protects the venue from being the place that gave them away.

Some of the most common privacy gaps are on staff members' own phones: a photo of the booking sheet sent to a group chat, a guest's number saved to message them about a lost umbrella, a list of VIPs shared with a new starter. Each is well meant, and each puts guest data somewhere the venue cannot protect or delete.

Agree a simple rule: guest details stay in the venue's systems. Contact guests from the venue's own phone or email, share the evening's notes at the briefing rather than in a chat, and remove any guest details from personal devices when someone leaves.

It is not about distrusting the team. It is about knowing where guest data is, so that you can protect it and answer a guest who asks.

An invented brasserie realises its guest records have grown without any rules. Every member of staff can see every guest's full history, notes include comments on guests' appearance and moods, and guests who booked once years ago receive the monthly newsletter.

The brasserie limits full profiles to managers, gives hosts only what they need to take bookings, removes inappropriate notes and writes a short guide for the team. It sends marketing only to guests with recorded consent, removes guests who have not visited or engaged for years, and writes a plain privacy notice for its booking page.

When a regular asks to see what the brasserie holds about her, the manager sends it the same week, without hesitation. She replies to say she is glad they remember her table.

In servearound, who sees what follows each person's role: taking a booking needs only a guest's name and number, so the staff who book tables can find and add guests, while the full profile, with spend, history, notes and feedback, is for the roles you give it to. Notes from the team are recorded with their author and date, and a guest can be removed from the guest list from their profile. servearound has no setting that clears old data on a schedule, so how long you keep guests is a routine you run yourself.

Campaigns go only to guests who opted in, guests imported from a spreadsheet are not signed up to marketing emails, and allergens can be used to leave guests out of a campaign but never to single them out. Guests giving feedback can choose to stay anonymous, in which case they are never identified to you. See Guest CRM.

What you store about guests, who can see it, how long you keep it, what you use it for and what guests can ask of you.

Use what guests shared, for the purpose they shared it, and use it discreetly.

Names, contact details, visits, allergies, preferences they shared, useful notes and marketing consent.

Each role only what it needs: hosts for bookings, managers for history, marketing for consent and segments.

As long as you need it for a clear purpose. Review dormant profiles and old notes from time to time.

Only with their consent for marketing. A booking alone is not consent to a newsletter.

Usually to see their data, correct it, stop marketing and, in many cases, have it deleted.

No. Take advice on the data protection rules where you trade.

Guest privacy lets a restaurant remember its guests without watching them. Keep the data that helps you serve guests and reach those who want to hear from you, leave out opinions and personal guesses, and treat allergies as the sensitive health information they are.

Limit who can see full profiles, protect the accounts, decide how long you keep data, send marketing only with recorded consent, know how you would answer a guest's request to see or delete their data, use what you know discreetly in the room and in campaigns, and tell guests plainly what you keep and why.