The Nutmeg Group

Legal

Privacy notice

Last updated 28/09/2026

This explains what we do with the information you give us when you join the membership, use a voucher at a restaurant, or send us a message.

1. Who we are

The Nutmeg Group is five restaurants in Bristol, each run by its own company. The membership is one scheme shared by all five, with one record of you, so the five companies are joint controllers of the information described here:

  • NUTMEG (CLIFTON) LTD, which runs Nutmeg — registered in England and Wales, company number 10323759, registered office 10 The Mall, Bristol, BS8 4DR
  • KATTUMARAM LTD, which runs Nadu — registered in England and Wales, company number 12482169, registered office 77–79 Stokes Croft, Bristol, BS1 3RD
  • KAL DOSA (PVT) LTD, which runs Kal Dosa — registered in England and Wales, company number 14534564, registered office 77–79 Stokes Croft, St Pauls, Bristol, BS1 3RD
  • NSK (PVT) LTD, which runs Nutmeg Street Kitchen — registered in England and Wales, company number 15966599, registered office 25 St Augustine's Parade, Bristol, BS1 4UL
  • BOMBIL (PVT) LTD, which runs Bombil — registered in England and Wales, company number 15969243, registered office 31 East Street, Bedminster, Bristol, BS3 4HH

In this notice, "we" means those five companies together.

How the five share responsibility

The five companies have agreed between them how they look after your information. They decide together what the membership collects and why; they use one shared set of systems, described in section 4; and they have agreed that one address handles everything to do with your information on behalf of all five: [email protected].

That includes asking for a copy of your information or asking us to delete it. You do not need to know which company to ask, and a request made there covers all five. You can also exercise your rights with any one of the companies directly, at its registered office above.

2. What we collect

When you join the membership:

  • Your first name, and your last name if you give one
  • Your email address, which is also how you sign in
  • Your phone number, if you give one — optional
  • Which of the five you visit most, if you tell us — optional
  • Whether you agreed to marketing emails, and when

As you use the membership:

  • The vouchers we have given you, and what each one is worth
  • A record of each voucher you use: which restaurant, and when

If you use the contact form or email us, we hold what you send us so we can reply.

3. Why we use it, and our lawful basis

  • Running your membership — giving you vouchers, applying them to your bill, showing you what you hold, keeping your account working, and emailing you when one of our restaurants gives you a voucher personally. This is necessary to provide the membership you asked for.
  • Marketing emails — news, and vouchers from our promotions, only if you ticked the box. That is consent, it is separate from joining, and you can withdraw it at any time without affecting your membership or any voucher you hold. Every one of these emails has an unsubscribe link.
  • Running the restaurants well — understanding how busy each restaurant is, how the scheme is being used, and preventing misuse of voucher codes. These are our legitimate interests, and we use figures rather than individual histories to do it.
  • Answering you — replying to a message you sent us.

4. Who can see it

Restaurant managers see the members who used a voucher at their own restaurant, shown only as a first name and a last initial. They cannot see your contact details, and they cannot see your visits to the other four restaurants.

Owners of the group can see membership and visit information across all five.

We use these providers to run the service, and they hold data on our behalf:

  • Supabase — the database and sign-in system that the membership runs on, hosted in London
  • Cloudflare — hosting for this website, the members' app and our photography
  • Resend — delivery of our emails: your sign-in links, emails about your vouchers, and the messages you send us through this website

Resend is based in the United States, so your email address and the emails we send you are handled there. That transfer is protected by the UK Extension to the EU–US Data Privacy Framework, which Resend is certified under, and by the UK Addendum to the standard contractual clauses in its data processing agreement with us.

We do not sell your information, and we do not share it for anyone else's advertising.

5. Cookies and measurement

The members' app stores what it needs to keep you signed in. We do not use tracking or advertising cookies on this website. Where we measure how many people visit the site we use Cloudflare Web Analytics, which is cookieless and does not identify individual visitors.

6. How long we keep it

We keep your membership information for as long as your membership is open, and we delete it when you ask us to. Ask by emailing [email protected].

7. Your rights

Under UK data protection law you can ask us to:

  • Give you a copy of the information we hold about you
  • Correct anything that is wrong
  • Delete it
  • Restrict or object to how we use it
  • Send it to you, or to someone else, in a portable form

You can withdraw consent to marketing emails at any time, and turn it back on just as easily, under Account in the members' app. The unsubscribe link in any email does the same, or you can write to us.

Email [email protected] to exercise any of these. We will respond within one month.

8. Complaints

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk.

9. Changes

If we change this notice, the updated version appears on this page with a new date at the top.

Questions about any of this? Email [email protected].