Privacy policy
How Blend Family Ltd looks after your information when you visit The Elephant Exchange or use this website.
Last updated 29 October 2026
The short version
- The Elephant Exchange is run by Blend Family Ltd, and we’re responsible for your information.
- We only collect what we need to take your booking, answer your questions, send the news you’ve signed up for and keep everyone safe.
- We never sell your information.
- You can unsubscribe at any time, ask for a copy of your information, or ask us to delete it (unless the law says we have to keep it). Just email info@blend.family.
1. Who we are
The Elephant Exchange is a food hall in Elephant & Castle, London, run by Blend Family Ltd, a company registered in England and Wales (company number 14668009). Our registered office is Bank House, 6–8 Church Street, Adlington, Chorley, Lancashire, PR7 4EX, and our head office is The Milestone, 84 Green Lane, Sheffield, S3 8SE.
Blend Family Ltd is the “controller” of your personal information. That means we decide how and why it’s used, and we’re responsible for looking after it under UK data protection law: the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).
This policy covers our website, theelephantexchange.co.uk, and our venue. Our Food Partners are independent businesses. If you deal with one of them directly, they may handle some of your information themselves, under their own privacy policies.
You can reach our data protection contact at info@blend.family, or by post at our head office.
2. What we collect
Depending on how you deal with us, we may collect:
- Contact details: your name, email address and phone number.
- Booking details: the date, time and size of your booking, and anything you tell us so we can look after you, such as dietary or access needs.
- Payment details: if a booking needs a deposit or payment, it’s taken by our booking or payment provider. We don’t see or keep your full card number.
- Messages and enquiries: what you send us by email, through our forms or on social media.
- Food Partner applications: your contact and business details, your menu and your experience.
- Competitions and surveys: your entry or answers, and your contact details.
- Website use: your IP address, device and browser type, and the pages you visit. We only collect this through analytics cookies if you agree to them (see Cookies).
- Guest Wi-Fi: if you use our free guest Wi-Fi, we and our Wi-Fi provider may collect technical details about your device (such as its MAC address and connection times) and, if you sign in, your name and email address.
- CCTV: images of you if you visit the venue, where CCTV runs for the safety of guests and staff.
- Photos and video: we sometimes take photos or film at the venue and at events for our website, social media and newsletters.
- Accident and lost property reports: your contact details and what happened, which may include information about an injury.
Most of this comes straight from you. Some may come from others, such as our booking provider when you book through them, or a social media platform when you tag or message us.
Information about your health (such as an allergy or an injury) is “special category” data, which the law protects more strictly. We only use it to look after you, or where the law requires it.
3. How we use it, and why
The law says we need a valid reason, known as a lawful basis, for each way we use your information. Here’s what we do and the basis we rely on.
| What we do | Our lawful basis |
|---|---|
| Take and manage your bookings and any deposits | Contract: we need it to provide what you’ve booked |
| Reply to your enquiries and messages | Legitimate interests: answering the people who get in touch with us (or contract, if it’s about a booking) |
| Send you news, offers and event invitations by email | Consent: you can unsubscribe at any time using the link in every email |
| Take care of dietary or access needs you tell us about | Your explicit consent, which you give when you tell us |
| Run competitions and prize draws | Contract: the competition’s terms |
| Consider applications to become a Food Partner | Legitimate interests, and steps you’ve asked us to take before entering a contract |
| Understand how our website is used, so we can improve it | Consent: given through our cookie banner |
| Run CCTV | Legitimate interests: keeping guests, staff and the building safe, and preventing and detecting crime |
| Take photos and film at the venue and at events, and share them to promote The Elephant Exchange, our Food Partners and our events | Legitimate interests: promoting our business (see below) |
| Record accidents and incidents, and deal with any claims | Legal obligation (health and safety law) and legitimate interests (dealing with claims) |
| Return lost property | Legitimate interests: reuniting you with your things |
| Run our guest Wi-Fi | Legitimate interests: providing a secure network (and consent, if you agree to hear from us when you sign in) |
| Tell you about important changes, such as updates to this policy | Legitimate interests, or legal obligation |
| Keep financial and business records | Legal obligation |
Where we rely on legitimate interests, we’ve weighed our interests against yours, and you can object at any time (see Your rights). If you’d rather not appear in our photos or videos, tell our team on the day or email us, and we’ll leave you out or take the image down. We won’t share a photo that clearly shows a child without a parent or carer’s permission.
We don’t use your information to make decisions about you by purely automated means, and we don’t profile you in ways that have legal or similarly significant effects.
5. Transfers outside the UK
Some of our providers, such as Google, store or access information outside the UK, including in the United States. When that happens, we make sure your information is protected to UK standards, either because the UK government has approved the country or arrangement (such as the UK Extension to the EU–US Data Privacy Framework), or by using the legal agreements approved by the Information Commissioner’s Office (ICO).
6. How long we keep it
We keep your information only for as long as we need it, then delete it or make it anonymous.
| Information | How long we keep it |
|---|---|
| CCTV footage | 30 days, unless we need it for longer to deal with an incident |
| Email sign-ups | Until you unsubscribe, or 2 years after you last open one of our emails |
| Bookings and enquiries | 2 years after we were last in touch |
| Payments and financial records | 6 years, as the law requires |
| Accident and incident reports | 3 years, or until a child involved turns 21 if that’s later (the time limits for making a claim) |
| Food Partner applications | 12 months if your application isn’t successful |
| Competition entries | 6 months after the winner is chosen |
| Guest Wi-Fi records | 12 months |
| Website analytics | 14 months |
Photos and videos we’ve published may stay on our website and social media, but we’ll take down any that include your likeness if you ask.
7. Keeping it safe
We use appropriate technical and organisational measures to protect your information, including secure systems, restricted access for staff who need it, and careful choice of the providers we work with. If something ever goes wrong that puts your information at risk, we’ll tell you and the ICO when the law requires it.
8. Your rights
Under UK data protection law, you have the right to:
- Access your information and get a copy of it.
- Correct anything that’s wrong or incomplete.
- Delete your information, in some circumstances.
- Restrict how we use it, in some circumstances.
- Object to how we use it where we rely on legitimate interests, and to direct marketing at any time.
- Move information you’ve given us to another organisation (data portability), in some circumstances.
- Withdraw your consent at any time, where we rely on it. This doesn’t affect anything we did before you withdrew it.
To use any of these rights, email info@blend.family. It’s usually free, and we’ll reply within one month. We may need to check who you are first, and we’ll let you know if a complex request needs longer.
9. Children
Our website isn’t aimed at children, and we don’t knowingly collect information online from anyone under 13. Children are very welcome at The Elephant Exchange, so they may appear on our CCTV, and we’ll usually collect any other information about them (for example in an accident report) from a parent or carer.
10. Cookies
Our website uses cookies. Some are needed for it to work; others, such as analytics cookies, are only used if you agree. You can change your choice at any time. Our cookie policy explains which cookies we use and why.
11. Complaints
If you’re unhappy with how we’ve handled your information, please tell us first so we can put it right. Email info@blend.family (with “Data protection complaint” in the subject line if you can), or write to us at our head office (see Contact us). We’ll acknowledge your complaint within 30 days, keep you updated, and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator:
- Online: ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
12. Changes to this policy
We’ll update this policy when the way we use your information changes, or when the law does. The date at the top shows when it last changed. If we make important changes, we’ll make them clear here and, where we can, let you know directly.
13. Contact us
For anything to do with this policy or your information, contact our data protection contact:
Blend Family Ltd (head office)The Milestone, 84 Green Lane
Sheffield, S3 8SE
info@blend.family