Privacy Policy
How we collect, use and protect your personal information
Last updated: 26 August 2026
1. Who we are
This website is operated by George and Dragon Quainton Ltd (“we”, “us”, “our”), trading as The George & Dragon, a company registered in England and Wales with company number 15101953, whose registered office is at 32 The Green, Quainton, Aylesbury, HP22 4AR.
We are the “data controller” for the personal information described in this notice. That means we decide how and why it is used. We are registered with the Information Commissioner’s Office under registration number ZB730216.
If you have any question about this notice or about how we handle your information, contact us at pub@georgeanddragonquainton.co.uk or by post at the address above.
2. What we collect, why, and our lawful basis
Table bookings
When you book a table we collect your name, email address, telephone number, party size, requested date and time, and anything you enter in the notes or special requests field.
We use this to hold and manage your reservation, to contact you about it, and to send you a confirmation and a reminder shortly before your visit. Our lawful basis is performance of a contract (or steps taken at your request before entering into one). Where we send a reminder, we rely on our legitimate interests in making sure tables are honoured and reducing no-shows.
Allergen and dietary information
If you tell us about a food allergy or intolerance, that is information about your health. UK data protection law treats it as a special category of personal data with extra protection. We only record it where you have given us your explicit consent, which you give by ticking the box on the booking form. You may withdraw that consent at any time by contacting us, and we will delete it.
We use this information solely to prepare for your visit and to inform our kitchen and service team. We do not use it for marketing or profiling, and we do not share it outside our own staff.
Important: telling us in advance helps us prepare, but it does not replace speaking to a member of staff when you arrive. Please always confirm your allergy with your server before ordering, so we can advise you accurately about the dishes available on the day.
Contact form and enquiries
When you contact us we collect your name, email address and the content of your message, together with any reply we send. We use this to answer you and to keep a record of the correspondence. Our lawful basis is our legitimate interests in responding to enquiries about our business.
Newsletter
If you subscribe we collect your email address and use it to send you news and offers. Our lawful basis is your consent. Every newsletter contains an unsubscribe link, and you can withdraw consent at any time.
Notes we keep about guests
We may record notes to help us look after you better on future visits — for example a seating preference, a dietary requirement, or a note that a previous booking was not honoured. Our lawful basis is our legitimate interests in running the business and providing a consistent service, except for allergy and dietary information, which we hold on the basis of your explicit consent as described above.
Where a guest has repeatedly failed to attend confirmed bookings, or where there has been an incident, we may record their email address so that future bookings are reviewed manually. You can ask us about any such record at any time.
Security and anti-spam
To protect our forms from automated abuse we record the IP address from which a submission is made and apply rate limiting. We also use Google reCAPTCHA (see section 4). Our lawful basis is our legitimate interests in keeping the website secure and usable.
Mobile application
Our staff mobile application stores a device token so that push notifications can be delivered. This applies to our own team, not to guests.
3. How long we keep it
| Information | Retention period |
|---|---|
| Booking records | 24 months after the booking date |
| Allergen and dietary information given when booking | Deleted 30 days after your visit |
| Contact form messages and replies | 12 months |
| Newsletter subscription | Until you unsubscribe |
| Guest notes and no-show records | 24 months |
| Email delivery logs | 6 months |
| Website session data | 120 minutes of inactivity |
Allergen information you give when booking is used only to prepare for that visit. Once the visit has passed the reason for holding it is gone, so it is deleted automatically 30 days afterwards — the short window exists only so we can answer a question or complaint about the meal. The booking record itself is kept, but with the allergy details removed.
If you are a regular and would like us to remember your requirements between visits, ask a member of staff and we will record it separately, with your agreement.
4. Who we share it with
We do not sell your personal information. We share it only with the following:
- Our hosting and email provider — our website and email are hosted in the United Kingdom by our hosting supplier, who processes data on our instructions.
- Google reCAPTCHA — used to tell real visitors from automated abuse. Google receives technical information about your visit. See Google’s privacy policy.
- Google Analytics / Google Tag Manager — used to understand how the site is used. These only run if you accept analytics cookies. See our Cookie Policy.
- Google Fonts — used for typography. Your browser requests font files from Google, which discloses your IP address to them.
- Instagram (Meta) — where an Instagram feed is displayed, content is retrieved from Meta.
- Firebase Cloud Messaging (Google) — used to deliver push notifications to our staff application.
Some of these providers are based outside the UK. Where personal data is transferred internationally, it is protected by the UK’s approved safeguards, such as the International Data Transfer Agreement or Addendum, or by adequacy regulations.
5. Cookies
We use cookies and similar technologies. Non-essential cookies are only set if you agree to them. You can change your choice at any time. Full details are in our Cookie Policy.
6. Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct information that is wrong or incomplete;
- ask us to delete information, in certain circumstances;
- ask us to restrict how we use it, in certain circumstances;
- object to us using it where we rely on legitimate interests;
- ask us to transfer it to another organisation, in certain circumstances; and
- withdraw your consent at any time, where we rely on consent.
To exercise any of these, contact us using the details in section 1. We will respond within one month. There is normally no charge.
If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk, or by calling 0303 123 1113. We would appreciate the chance to put things right first.
7. Keeping your information secure
We take appropriate technical and organisational measures to protect your information, including encrypted connections, access controls limiting who can view booking and guest records, and audit logging of emails we send. No system is completely secure, but we take these obligations seriously.
8. Children
Our website is not directed at children, and we do not knowingly collect information from children other than as part of a booking made by an adult (for example, the number of people in a party). If you believe we hold information about a child that we should not, please contact us.
9. Changes to this notice
We may update this notice from time to time. The date at the top shows when it was last changed. Where changes are significant we will make that clear on the website.