Privacy

Restaurant Versus is an independent project run from London, and is the data controller for everything described here. It decides what is collected and why, then answers for it.

Data protection questions and requests go to hello@restaurantversus.com, which is a real address that is read. Ask for a copy of your data, a correction, or deletion, and we'll deal with it within one month.

You don't need an account to browse or to nominate a restaurant. When you nominate or vote we set one cookie holding a random identifier for your device. It exists solely to stop the same device nominating or voting twice, and it contains nothing about you.

We store which restaurants that identifier picked, and the time. We do not store your name, and we do not build a profile of you.

Lawful basis:legitimate interests, running a vote that isn't trivially riggable. The device token is the least identifying way we found to do it.

We store:

• Your email address, so you can sign in and be told when a round opens.
• Your password, hashed with scrypt. We never store it in a readable form and cannot see what it is.
• Which matchups you voted on, and which side you chose.

Lawful basis: contract. You asked for an account and these are the things an account needs to work.

If you ask to be told when a bracket opens, we store that address against that bracket and use it for nothing else. No marketing, nothing passed to anyone. You can unsubscribe at any time, and every message we send carries a one-click link to do it.

Lawful basis: consent, which you can withdraw as easily as you gave it.

We never store your IP address. When you vote or sign up we store a salted one-way hash of it, which we use only to stop one person creating many accounts or automating votes. It cannot be turned back into an address.

Four cookies keep the site working and are set without asking, because the site can't do its job without them. Page-view measurement is optional and stays off unless you say yes. The full list, with what each one does and how long it lasts, is on the cookies page.

These are the only companies that hold or handle any of it on our behalf. Each is bound by a contract to process it only on our instructions.

Where a processor is outside the UK, the transfer relies on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

Typefaces and the restaurant directory are downloaded when the site is built and served from our own domain afterwards, so your browser never contacts Google or OpenStreetMap and neither of them sees your visit. The one exception is restaurant photographs, which may load from the address they were supplied from. See the cookies page.

• We don't sell or share your data with anyone.
• We don't use advertising cookies, and nothing we use follows you to other websites.
• We don't send marketing email. The only emails are about rounds you asked to hear about.
• We don't make automated decisions about you, and we don't profile you.

Vote totals are kept indefinitely. They are the record of who won and deleting them would erase the results. The link between a vote and a person is not needed once a bracket has finished, so a daily job clears it at that point: the account reference and the stored IP hash go, and the totals stay intact.

Failed admin sign-in attempts are deleted after a day. Expired sessions are deleted as they expire.

Delete your account and we remove your email, your password hash, your sessions and your email subscriptions immediately. Votes you cast stay in the totals, unattached to you.

Under UK GDPR you can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or stop using it, and object to processing based on legitimate interests.

If you have an account you don't have to ask: your account page will download everything we hold as a file, or delete it, straight away. Otherwise email hello@restaurantversus.comand we'll deal with it within one month.

If you think we've handled your data badly you can complain to the Information Commissioner's Office at ico.org.uk, or call their helpline on 0303 123 1113.

This site isn't aimed at children and we don't knowingly hold data about anyone under 13. If you think we have, email us and we'll delete it.

Our news pages name people: chefs, owners, the person behind a residency. That is what the story is. We did not get those names from them. They come from what has already been published: press announcements, the venue's own social accounts, and other outlets, each credited on the article.

Lawful basis:legitimate interests, reporting on London's restaurant trade, which cannot be done without naming who is cooking and where. We publish only what is already public and professional: what someone does, where they do it, and when. We do not publish home addresses, personal contact details, or anything about someone's private life.

If you are named in a story and want it corrected, your name removed, or you object to it being there at all, email hello@restaurantversus.com. Tell us which article. We will correct a factual error as soon as we have checked it, and we will consider any objection on its merits rather than waiting to be made to.

Restaurant names and addresses come from OpenStreetMap and the Food Standards Agency's public register, both published as open data. If you run a restaurant listed here and want it removed, email hello@restaurantversus.comand we'll take it down.