Skip to content
Jolene

Privacy Policy

Last updated: 9 October 2026

We respect your privacy and are committed to protecting your personal information. This Privacy Policy explains how we collect, use, store and share personal information when you visit our websites, use our online shop, make a reservation, visit one of our bakeries, cafes or restaurants, contact us, or otherwise interact with us. It also explains how relevant guest information may, where appropriate and lawful, be shared between our affiliated hospitality businesses.

1. Who We Are

Jolene is operated by Bread Brut Limited. For the purposes of UK data protection law, Bread Brut Limited is the data controller responsible for personal information collected and processed in connection with Jolene, unless stated otherwise.

Bread Brut Limited operates alongside affiliated hospitality businesses under common ownership or management, including Primeur and Westerns Laundry, which are operated by Food Brut Limited. Where appropriate and lawful, relevant guest information may be shared between Bread Brut Limited, Food Brut Limited and our other affiliated hospitality businesses for the purposes described in this Privacy Policy.

Where two or more group companies jointly determine the purposes and means of a particular processing activity, those companies may act as joint controllers in respect of that processing.

2. Information We Collect

Depending on how you interact with us, we may collect the following types of personal information:

  • your name, postal address, email address, telephone number and other contact details;
  • reservation details, booking history, dates and details of visits to our venues, and information about other members of your party where provided to us;
  • preferences, requests, dietary requirements, allergies or accessibility requirements that you choose to provide;
  • information relating to events, enquiries, correspondence, feedback and complaints;
  • factual records relating to previous visits or interactions with our businesses and, where reasonably necessary, factual information concerning incidents, behaviour or circumstances relevant to the safety, wellbeing or appropriate management of our guests, employees, venues or businesses;
  • online-shop order information, including billing and shipping addresses, payment confirmation, contact details, purchases, returns and exchanges;
  • account information where an online account is offered, including username and information used for account security;
  • payment or reservation-guarantee information processed through our payment or booking providers;
  • information you provide when applying for employment with us; and
  • technical and usage information generated when you use our websites or online services, including IP address, browser and device information, network information, interactions with our services, and cookie or similar-technology data.

We aim to ensure that information recorded about guests is relevant, factual, proportionate and limited to what is reasonably required for legitimate business purposes. You may choose not to provide certain information, but this may prevent us from providing some services or features.

3. How We Collect Information

We collect information directly from you when, for example, you make a reservation, place an online order, create an account, visit a venue, contact us, provide feedback, make an enquiry or apply for a role.

We may collect technical and usage information automatically through cookies, pixels, web beacons and similar technologies when you use our websites, open or click emails, or interact with our online services or advertising.

We may also receive information from third parties that support our services, including OpenTable (our reservation platform), Shopify (which powers our online shop), payment processors, fulfilment or delivery providers, analytics providers, marketing partners and other technology or service providers.

4. How We Use Your Information

We may use personal information to:

  • make and administer reservations and communicate with you about reservations or enquiries;
  • provide our bakery, cafe, restaurant and hospitality services and respond to preferences and requirements you have communicated to us;
  • process online-shop purchases, payments, deliveries, returns and exchanges, manage customer accounts and send service or transaction notifications;
  • manage dietary requirements, allergies and accessibility requirements;
  • recognise returning guests and provide continuity of service;
  • provide customer support, respond to feedback and complaints, and investigate or manage disputes;
  • maintain appropriate records of significant guest interactions;
  • protect the safety and wellbeing of guests and employees, prevent or respond to abusive, threatening, fraudulent, illegal or otherwise inappropriate behaviour, and protect our businesses, property, websites and systems;
  • administer, analyse, maintain and improve our websites, booking systems, online shop and other services;
  • comply with legal and regulatory obligations and establish, exercise or defend legal claims; and
  • manage and operate our affiliated hospitality businesses effectively.

Where permitted by law, we may use your contact information for marketing and promotional communications about our venues, events, products or services. Where consent is required, we will obtain it. You can unsubscribe from promotional emails at any time; we may still send non-promotional communications concerning reservations, accounts, orders or other transactions.

5. Guest Profiles and Notes

Our reservation and guest-management systems may allow us to maintain a guest profile and record relevant information concerning previous reservations, visits and interactions. This may include preferences communicated by you, relevant reservation history, previous correspondence, complaints or feedback, and factual notes concerning significant interactions or incidents.

Guest notes are intended to help us provide continuity of service and appropriately manage our relationships with guests. Employees are expected to record guest information in a factual, necessary, relevant and professional manner. Guest profiles should not be used to record irrelevant, excessive, discriminatory, offensive or unnecessarily subjective information.

6. Sharing Information Across Our Affiliated Businesses

We operate alongside affiliated restaurants, bakeries, cafes and other hospitality businesses under common ownership or management. Where reasonably necessary, relevant guest information may be made available to authorised employees and managers of these affiliated businesses in order to manage reservations and guest relationships; recognise returning guests; provide continuity of service; respond appropriately to previous communications, requests or commitments; manage dietary, allergy or accessibility information where appropriate and lawful; investigate and respond to feedback, complaints or disputes; maintain appropriate records of significant guest interactions; protect the safety and wellbeing of guests and employees; prevent or respond to abusive, threatening, fraudulent or otherwise inappropriate behaviour; protect our businesses and property; and operate our affiliated hospitality businesses effectively.

For example, information concerning a relevant interaction at one venue may, where appropriate, be accessible to an authorised manager at another affiliated venue. Information is not intended to be accessed simply because it is technically available. Employees and managers should access and use guest information only where there is a legitimate business reason for doing so.

7. Our Lawful Bases for Processing

Under UK data-protection law, we must have a lawful basis for processing personal information. Depending on the circumstances, we may process your information because it is necessary to provide a service or fulfil a contract with you; because it is necessary for our legitimate interests or those of a third party; because you have provided consent; or because we have a legal obligation.

Our legitimate interests may include operating our hospitality and online retail businesses effectively, maintaining appropriate guest and customer records, providing continuity of service, managing guest and customer relationships and complaints, improving our services, preventing fraud and protecting our guests, customers, employees, businesses, property and systems. When relying on legitimate interests, we consider the necessity and proportionality of the processing and its potential impact upon your rights and interests.

8. Allergies, Health Information and Other Special Category Data

Information concerning health may constitute special category personal data under UK data-protection law. You may choose to provide information concerning allergies, dietary requirements, accessibility requirements or other health-related matters when making a reservation or communicating with us.

We will only process special category personal data where we have both an appropriate lawful basis and an applicable legal condition permitting that processing. We aim to limit this information to what is reasonably necessary for the relevant purpose. Providing information about an allergy or dietary requirement does not alter the allergy and cross-contamination information provided separately by the relevant venue.

9. Online Shop, Payments and Service Providers

We use third-party providers to operate our websites, online shop, reservation systems, payment systems, communications, analytics, cloud storage, fulfilment, shipping, customer support and other business services. Shopify powers our online shop and may process information connected with customer accounts, orders, checkout, payments, fraud prevention, fulfilment and the operation of the shop. OpenTable provides our reservation and guest-management technology and may process reservation details, guest profiles, booking history, preferences, communications and other information connected with reservations and visits.

Payment processors may collect payment information, such as card or bank details and billing information, in order to process payments. We generally receive payment confirmation and transaction information rather than full payment-card details.

These providers may process personal information on our behalf or, in some circumstances, as separate or independent data controllers. Their own privacy notices may therefore also apply when you interact with their services. Where appropriate, we require providers processing information on our behalf to protect personal information and process it in accordance with applicable data-protection requirements.

10. Cookies and Similar Technologies

Like many websites, our websites use cookies and similar technologies. These technologies may be used to make our websites and online shop work, remember actions and preferences, understand how visitors use our services, run analytics, improve and optimise our services and, where applicable, support marketing or advertising.

Where required, we will request your consent before placing non-essential cookies on your device. You can manage cookie preferences through controls available on the website or through your browser settings. Blocking or removing cookies may affect the availability or correct operation of some website features.

Where Shopify powers our online shop, Shopify and related technologies may use cookies and similar technologies in connection with browsing, customer accounts, checkout, payments, fraud prevention, analytics and other shop functionality. Our reservation services may also use cookies or similar technologies where you interact with OpenTable functionality. Where consent is legally required for non-essential technologies, we will seek that consent through the relevant website controls.

11. Other Circumstances in Which We May Share Information

In addition to affiliated businesses and service providers, we may disclose personal information where reasonably necessary to professional advisers such as lawyers, accountants or insurers; business and marketing partners where lawful; law-enforcement agencies, courts, regulators or other public authorities; to establish, exercise or defend legal claims; to investigate or prevent fraud or other unlawful activity; to protect the rights, property or safety of our guests, customers, employees or businesses; where you direct or consent to a disclosure; or as part of a sale, merger, restructuring or transfer of a business or its assets.

We do not sell guest or customer personal information to third parties.

12. Third-Party Websites and Links

Our websites may contain links to websites or online platforms operated by third parties. If you follow a link to a service that is not controlled by us, you should review its privacy and security information. We are not responsible for the privacy or security practices of third-party sites or platforms. Information you choose to post in public or semi-public areas, including third-party social networks, may be visible to others.

13. Children's Data

Our websites and online services are not intended for children, and we do not knowingly collect personal information from children through those services. If you are a parent or guardian and believe a child has provided personal information to us, please contact us so that we can consider the appropriate action, including deletion where required.

14. How Long We Keep Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including satisfying legal, accounting, operational and reporting requirements, maintaining accounts, providing services, resolving disputes and enforcing applicable contracts or policies.

Different types of information may be retained for different periods. When determining an appropriate retention period, we consider the nature and sensitivity of the information, why it is required, the potential risks associated with retaining it and applicable legal requirements. Information that is no longer reasonably required should be deleted or anonymised in accordance with our retention practices.

15. Security and Access

We take reasonable organisational and technical measures to protect personal information against unauthorised access, alteration, disclosure, loss or misuse. Access to reservation information, guest profiles, guest notes, customer information and business systems is restricted to employees, managers, service providers and other authorised persons who require access for legitimate business purposes.

Employees are expected to treat personal information confidentially and use it only for appropriate business purposes. No security system is completely secure, and information sent over insecure channels may be at risk; please avoid sending sensitive or confidential information through insecure means.

16. International Transfers

Some of the technology and service providers we use, including providers supporting our online shop, reservations, payments, fulfilment, analytics and communications, may process personal information outside the United Kingdom. This is particularly relevant where we provide online-shop services to customers in other countries or use international technology infrastructure. Where personal information is transferred internationally, we will use an appropriate lawful transfer mechanism where required, which may include adequacy regulations or recognised contractual safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or other legally recognised safeguards applicable to the transfer.

If you place an order from outside the United Kingdom, your information may need to be shared with payment providers, carriers, fulfilment partners, customs or tax authorities and other service providers as necessary to process the transaction, deliver your order, comply with import/export, customs, tax or other legal requirements, prevent fraud and handle returns or customer-service enquiries. Depending on where you live, local privacy laws may give you additional rights. Where those laws apply to our processing, we will respect the rights and protections they require.

17. Your Data Protection Rights

Depending on the circumstances, you may have the right to request access to personal information we hold about you; request correction of inaccurate or incomplete information; request deletion; request restriction of processing; object to processing based on our legitimate interests; withdraw consent where processing is based on consent; and request transfer of certain information to you or another organisation.

These rights are subject to the conditions, limitations and exemptions contained in applicable data-protection law. We may need to verify your identity before responding to a request. Where permitted, an authorised representative may make a request on your behalf, subject to appropriate evidence of authority and identity verification.

18. Complaints

If you have concerns about how we have handled your personal information, please contact us in the first instance so that we can investigate. You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's data-protection regulator.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our businesses, systems, practices, legal obligations or the way we process personal information. The most recent version will be published on our website and the “last updated” date above will be amended accordingly.

20. Contact Us

For questions about this Privacy Policy, the personal information we hold about you, or to exercise your data-protection rights, please contact Jolene at goods@jolenebakery.live or using the contact details published on our website. You may also write to us at 263 Well Street, London, E9 6RG, United Kingdom.

Where your request concerns information that may be held across our affiliated businesses, we may coordinate internally to identify and respond to the relevant information.