Legal
Privacy Policy
Who we are
This website and the venue it represents are operated by Bow Studio Limited, a company registered in Scotland under number SC791882, with its registered office at 65 Bath Street, Suite 2/7, Second Floor, Glasgow, G2 2BX. We trade as Bow Hospitality.
Bow Studio Limited is the data controller for the personal information described on this page. Our registration with the Information Commissioner's Office is being completed, and this page will show the registration number as soon as it is issued.
For anything to do with your personal information, email privacy@bowhospitality.co.uk. You can raise it with us at The Scallion directly if that is easier, but requests sent to that address are the ones we log and track, and that is the route we recommend.
What this covers
This policy covers this website and the way we handle your information when you book, contact us, use our guest wifi, or visit us.
It does not cover other companies. When you follow a link away from this site, that company's own privacy policy applies from the moment you arrive. Recruitment is handled separately and is not covered here.
When you use a form on this site
Our forms ask for your name, email address and phone number, and depending on the form, the date and time you want, how many people are coming, and anything you choose to tell us.
We use this only to reply to you and to arrange your booking or event. Our legal basis is that we are taking steps at your request before entering into a contract, together with our legitimate interest in answering enquiries about our business.
Submissions are received and stored by Netlify, who host this website, and are forwarded to manager@thescallion.co.uk in Microsoft 365.
When you book a table
We take bookings through OpenTable. When you use the booking form here, the date, time and party size you have chosen are passed to OpenTable, and you complete the booking on their website.
This is worth being clear about: OpenTable is not simply working on our behalf. For most of what it does, OpenTable decides its own purposes and is its own data controller. It keeps a record of your dining history across every restaurant on its network, uses it to make recommendations and to target advertising, and holds your information under its own policy and its own retention periods, not ours. If you would rather not go through OpenTable, phone us and we will take the booking ourselves.
OpenTable passes us your name, the date and time, your party size, your phone number and any notes or special requests you added. We use that to hold and serve your table.
Allergies, dietary needs and access requirements
If you tell us about a food allergy, a dietary requirement or an access need, we write it down so that we can look after you safely on the night. Some of this is health information, and we hold it only because you have chosen to give it to us for that purpose. We do not use it for anything else, we do not build a profile from it, and it is discarded with the rest of the booking.
Analytics
We would like to understand how this site is used - which pages people read, how they found us, whether anything is broken. We use Google Analytics 4 for this, with IP anonymisation switched on.
Nothing analytics-related runs unless you accept it. If you reject the cookie banner, ignore it, or browse with JavaScript off, no analytics script is loaded and no analytics cookie is set. Our legal basis is your consent, and the cookie policy explains how to change your mind at any time.
Guest wifi
We offer free guest wifi, and it asks nothing of you. There is no sign-in page, no form, and no email address or phone number to hand over. We do not collect your details when you connect, we do not add you to any marketing list, and connecting does not sign you up to anything.
As on any network, the equipment itself handles the technical business of connecting devices. We do not gather that into records about individuals, and we do not use it for any purpose beyond keeping the network working.
CCTV
We operate CCTV for the safety of guests and staff and for the prevention and detection of crime, which is our legitimate interest. Signs are displayed where cameras are in use.
Recordings are kept for 31 days and are then automatically overwritten, unless a recording has been kept back because of a specific incident. We share recordings only with the police, our insurers, or others where we have a proper legal reason, and we do not publish them.
You can ask for a copy of footage of yourself. Ask quickly - after 31 days it is gone - and tell us the date, the approximate time and the venue so we can find it.
Server logs
Like every website, ours produces server logs. Our host records the IP address requesting each page, the browser used, the pages served and the time. We use this to keep the site running and secure, which is our legitimate interest. Netlify holds these under its own retention policy.
Who we share your information with
We do not sell your personal information. We do not run advertising or profiling trackers on this website.
| Who | What they do | Their role | Where |
|---|---|---|---|
| Netlify | Hosts this website and receives form submissions | Processor, acting on our instructions | United States and Europe |
| Microsoft | Microsoft 365 carries our mailboxes | Processor, acting on our instructions | United Kingdom |
| OpenTable | Takes and manages our bookings | Its own controller for most of what it does | United States and Europe |
| Google Analytics 4, only after you accept | Processor for analytics | United States and Europe | |
| Our voucher provider | Sells and redeems gift vouchers and takes the payment | Its own controller | — |
We never see or hold your card details. Voucher payments are taken by the voucher provider on their own site.
We will also disclose information where the law requires it, or where it is necessary to protect the safety of our guests and staff.
Information leaving the UK
Our mailboxes are in Microsoft 365, and Microsoft stores mailbox content at rest in the United Kingdom for tenants registered here. Netlify, Google and OpenTable process some information outside the UK. Where that happens the transfer is covered by safeguards approved for use in the UK - the UK Addendum to the Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework.
How long we keep things
| What | How long |
|---|---|
| Enquiries and form submissions | 12 months from your last contact, then deleted |
| Bookings held by OpenTable | Under OpenTable's own policy, not ours |
| Analytics | No longer than 14 months |
| Guest wifi | No sign-in details are collected, so there is nothing to keep |
| CCTV | 31 days, then automatically overwritten |
| Server logs | Under our host's retention policy |
If we are dealing with a complaint, an insurance claim or a legal matter, we keep what we need for as long as that matter is live.
Your rights
You can ask us for a copy of the personal information we hold about you, have it corrected if it is wrong, or have it deleted. You can ask us to restrict how we use it, object to our using it on the basis of legitimate interests, and ask for a copy in a portable format. Where we rely on your consent, you can withdraw it at any time.
Email privacy@bowhospitality.co.uk and we will respond within one month. There is no charge.
Because OpenTable holds your booking history under its own policy, a request to us covers what we hold, not what OpenTable holds. For that, contact OpenTable directly.
If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can put it right.
Children
We are family-friendly, but this website is not aimed at children and we do not knowingly collect children's personal information through it. If you think a child has sent us their details, tell us and we will delete them.
Changes
If we change how we handle your information we will update this page and change the date below. If the change is significant we will say so on the site.
Last updated: 28 September 2026