Privacy Policy | Stonegate Group

1. INTRODUCTION

This Privacy Notice provides information on how we collect and processes your personal information when you:

use the MiXR App and participate in our loyalty programme;

visit any of our brands’ websites such as Be at One, Popworld and Slug & Lettuce (for a list of our brands please visit Managed Estate | Stonegate Group);

provide personal data through our websites when you contact us or provide feedback;

make a booking with one of our brands online;

visit or interact with our social media pages;

communicate with our customer service team;

participate in online promotions;

make a booking over the phone with our AI customer agent platform,

(together, “Digital Services“); and

when you visit, contact or call one of our managed pubs, bars and clubs (our “Venues”) (you can search for our Venues at the following link: Find your local | Stonegate Group).

2. WHO WE ARE AND OUR ROLE

Except as mentioned below, Stonegate Pub Company Limited (Stonegate, we, our, or us) is the controller of your personal information. This means that Stonegate decides why and how your personal information is processed. Please see the section at the end of this Privacy Notice for our contact and legal information.

In some circumstances, the organisation receiving your information will be separately responsible to you and use your personal information in the ways described in its privacy notice (and not ours). For example:

Payments
If you link your payment card to your loyalty programme account through a third party banking app, the relevant bank that issues that payment card and card scheme (e.g. American Express, Mastercard or Visa) will be processing your personal information in accordance with its privacy notices as separate controllers. Please see the relevant website of the bank or scheme for the relevant privacy notice.

Venue Wi-Fi

We may make Wi-Fi services available in our Venues and where we do, these are provided by our third party service providers. These Wi-Fi providers will usually be a separate controller of the personal information they collect during the course of the provision of those services. Please review the privacy notice of the relevant Wi-Fi provider which is provided when you register for Wi-Fi at the Venue to understand how they use your personal information.

This Privacy Notice was last updated on 20th October 2026.

3. PERSONAL INFORMATION WE COLLECT ABOUT YOU

Personal information you provide to us when using our Digital Services

When you use our Digital Services, we collect and use information about you in the course of providing you our services and with consumer support. We may collect, use, store and transfer different kinds of personal information about you which we have grouped together as follows:

“Identity Data” includes your, first name, last name, login credentials, title, date of birth and gender.

“Contact Data” includes your postal address, e-mail address and telephone number(s).

“Booking Data” includes details of your venue bookings.

“Communications Data” includes emails you send to our customer services team, calls you make to our or our AI customer agent platform, correspondence or messages (chat or social media messages or comments) that you send to us, communications about complaints and the content of the reviews or testimonials you leave about us.

“Financial Data” includes your payments card details.

“Transaction Data” includes details about your orders, requests and transaction information, including information about your purchases, such as prices and product information, refunds, and promotions and gifts.

“Profile Data” includes information about: your interests, insights, habits, and preferences, interactions with us and other food and beverage organisations, your status as a student and other information you provide to us when completing surveys while using our Digital Services (such as the football team you support).

“Marketing Data” includes details of your marketing and in-app communication preferences; details when you enter a competition, promotion, or prize draw, including any personal information contained in the entry itself.

“Loyalty Data” includes details relating to your participation in our loyalty programme including the period of your participation, the number of points and other benefits you have earned, details of when you have earned them, the points and other rewards you have redeemed and when you have redeemed them and your favourite Venues.

“Event Data” includes additional details that you provide at one of our events, including images and information provided in surveys.

“Preferences Data” includes your dietary preferences and allergy information.

“Social Media Data” includes your interactions with us and our Venues on social media platforms, your social media handle, comments and ‘likes’ and the time and date of those activities.

“Location Data” includes GPS, the Internet protocol (IP) address used to connect your computer or device to the Internet and other sensor data from your device.

“Technical Data” includes technical information, including anonymous data collected by the hosting server for statistical purposes, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform as well as mobile identifiers cookie, tracking pixel and beacon identification information. Please see our Cookie Notice for further information.

Information we collect about you from other sources to provide our Digital Services

We may also obtain the following Personal Information about you from the following sources:

Payment providers (such as Apple Pay, Google Pay, Visa, MasterCard and American Express)

Wi-Fi providers that service our Venues

Social media platforms

Reservation platforms (such as Design My Night and Fatsoma)

Our commercial partners

Personal information you provide to us when you visit or contact our Venues

When you visit our Venues, we may collect, use, store and transfer different kinds of personal information as follows:

Identity Data;

Contact Data;

Booking Data;

Communications Data;

Preferences Data;

“CCTV Data” which includes video footage;

“Age Verification Data” including your photo ID; and

“Pubwatch Data” which may include details of your past behaviour at third party venues.

4. HOW AND WHY WE USE YOUR PERSONAL INFORMATION

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose and complies with data protection law.

Data protection law requires us to have a valid reason to process your personal information for each of the different purposes for which we use that information. The law refers to each reason as a ‘lawful basis’.

The purposes for which we use your personal information and the lawful basis which we rely on to process it for each purpose:

in connection with your use of our Digital Services are set out in Part 1 of the Appendix at the end of this Privacy Notice; and

when you visit our Venues are set out in Part 2 of the Appendix at the end of this Privacy Notice.

Personalisation

We personalise the content we serve to you on our Digital Services as set out in Part 1 of the Appendix at the end of this Privacy Notice. For example, we may tailor the offers that you receive and the missions that you can complete on the MiXR app to reflect the products that are most likely to be of interest to you.

You can opt out of personalisation at any time by exercising your right to object as set out in “10. YOUR RIGHTS” below but it will result in you receiving less relevant content. This is because content and offers you receive will be generic rather than related to your interests.

5. MARKETING

We may collect your preferences to receive marketing information directly from us by phone, in our mobile applications, social media, email, or SMS in the following ways:

if you register for an account on our Digital Services, we will ask you if you would like to opt in to receive marketing information directly from us;

if you make a booking with us via the designmynight website and you opt in to receive marketing information; or

if you do not complete a purchase and you have opted-in to receive marketing information, we may send a reminder to you about your incomplete purchase or ask why you did not complete the purchase so that we may better refine the service we offer.

From time to time, we may ask you to refresh your marketing preferences by asking you to confirm that you consent to continue receiving marketing information from us.

You have the right to opt-out of our use of your personal information to provide marketing to you in any of the ways mentioned above at any time. Please allow up to 10 working days for your email preferences to take effect.

6. DISCLOSURE OF YOUR PERSONAL INFORMATION BY US

We may disclose your personal information to our third party service providers, agents and subcontractors (“Suppliers“) for the purposes set out above. Our Suppliers can be categorised as follows:

IT platform providers (such as our customer support platforms and the platforms that support our loyalty programmes);

IT service providers (such as data management and cloud service providers);

Marketing and analytics platform providers;

Payment providers;

AI customer agent platform providers; and

Wi-Fi service providers.

When sending your information to third parties, we only disclose to them any personal information that is necessary for them to provide their service and we have a contract in place that requires them to keep your information secure and not to use it other than in accordance with our specific instructions.

Pubwatch

When you visit our Venues, we may, under certain circumstances, disclose your personal information with National Pubwatch, and local Pubwatch schemes.

Other Disclosures

We may also disclose your personal information to other third parties as follows:

any third party who is restructuring, selling, or acquiring some or all of our business or assets or otherwise in the event of a merger, reorganisation, or similar event; and

if we are under, or consider that we have, a duty to disclose or share your information in order to comply with any legal or regulatory obligation or request, including by the police and other law enforcement bodies, tribunals, regulators, local or central government or related agencies.

Sharing with commercial partners

We continually try to improve the relevance of our marketing communications and gain better insights into our customer base.

To do this, we work with commercial partners to match personal information we hold about you with personal information they hold about you, where you are a customer of both.

We then obtain aggregated insights about the type, category and volume of purchases that relate to each of us. This helps us understand the ways in which Stonegate customers overlap with the commercial partners’ customers, i.e. to see where you have bought similar products to those offered in our Venues and via our Digital Services

These insights then help us to decide whether further marketing collaborations between Stonegate and the commercial partner would be beneficial and, in particular, whether such collaborations will help us provide better personalised marketing and advertising to you.

For the sharing and matching of your information, Stonegate and the commercial partner are each a controller of your personal information. And therefore both are responsible.

Where we share and process your personal information with our commercial partners for these purposes, we do so as a joint controller with each commercial partner. Please see the table of our current commercial partners.

Commercial Partner Name

Data Types Shared

Privacy Notice Link

Asda Stores Limited

Contact Data

Transaction Data

Core Customer Privacy Notice – ASDA Groceries

7. INTERNATIONAL TRANSFERS

Where we transfer your information outside of the UK and EU, we will take steps to ensure that appropriate safeguarding measures are taken with the aim of ensuring that your privacy rights continue to be protected as outlined in this Privacy Notice. These steps include:

relying on decisions issued by the relevant UK Secretary of State (or other relevant person) declaring that a country or a company certifying to an international framework is adequately protective of personal information to a degree that allows us to safely transfer your personal information to that country or company;

imposing contractual obligations on the recipient of your personal information using standard clauses issued by the UK Information Commissioner’s Office (or other relevant body); or

relying on ‘binding corporate rules’ put in place by recipients of your personal information that have been approved by relevant data protection authorities.

Please contact us for more information about the protections that we put in place and to obtain a copy of the relevant documents.

8. THE PERIOD FOR WHICH WE KEEP YOUR PERSONAL INFORMATION

If we collect your personal information, the length of time for which we retain it is determined by a number of factors including the purpose for which we use that information and our obligations under other laws. We do not retain personal information for longer than is necessary.

We will always retain your personal information for the period that you have an active account with our Digital Services. If you do not hold an account, we retain your personal information for 2 years from the date we collect it or, where applicable, the date you are unsubscribed from our marketing lists, if later.

Your account will become ‘inactive’ if you do not engage with us for more than 2 years, for example, if you do not log into your account, make a purchase with us, engage with our direct marketing campaigns, earn loyalty points or redeem any vouchers.

After that 2 year period ends (or at any point you choose to delete your account with our Digital Services using the relevant settings), we will anonymise the records we hold about you so that we no longer hold your personal information.

The only exceptions to these periods are where:

the law requires us to hold your personal information for a longer period, or delete it sooner;

you exercise your right to have the information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required by law (see section 10 (Your Rights) below);

you require us to retain your personal information for a period longer than our stated retention period; or

we bring or defend a legal claim or other proceedings which involve you during the period we retain your personal information, in which case we will retain your personal information until those proceedings have concluded and no further appeals are possible.

9. LINKS TO OTHER SITES

Our Digital Services may contain links to websites run by other organisations which we do not control. This Privacy Notice does not apply to those other websites‚ so we encourage you to read their privacy notices. We are not responsible for the privacy notices and practices of other websites (even if you access them using links that we provide) and we provide links to those websites solely for your information and convenience. We specifically disclaim responsibility for their content, privacy practices and terms of use, and we make no endorsements, representations or promises about their accuracy, content or thoroughness. Your disclosure of personal information to third party websites is at your own risk.

In addition, if you linked to our Digital Services from a third party website, we cannot be responsible for the privacy notices and practices of the owners and operators of that third party website and recommend that you check the policy of that third party website.

10. AUTOMATED DECISION MAKING

We do not envisage that any decisions that have a legal or significant effect on you will be taken about you using purely automated means, however, we will update this Privacy Notice and inform you if this position changes.

11. YOUR RIGHTS

You have a number of rights in relation to your personal information under data protection law. In relation to you exercising certain rights, we may ask you for information to confirm your identity and, where applicable, to help us to search for your personal information. We may contact you to ask you for further information in relation to your request to speed up our response. We try to respond to all legitimate requests within one month from either:

the date that we have confirmed your identity; or

where we do not need to do this because we already have this information, from the date we received your request.

Occasionally it could take us longer than a month if your request is particularly complex. In this case, we will notify you and keep you updated.

You have the right to:

Request access to your personal information (commonly known as a “subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.

Please note that where you exercise your right of access we are required to carry out a reasonable and proportionate search for your personal information when responding to your request. Where you exercise your right of access, exemptions (such as where disclosing your information would reveal legally privileged information or third-party personal data) may apply, meaning that you may not always receive all the personal information that we process about you. We consider and apply exemptions on a case-by-case basis.

In respect of CCTV Data, we are unable to provide you with footage of other individuals as it is third-party personal data. Please be advised that any footage you may receive in response to an access request involving CCTV Data will be redacted to blur the identity of third-party individuals.

Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Request erasure of your personal information in certain circumstances. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.

Request the transfer of your personal information to you or to a third party. We will provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Request restriction of processing of your personal information.

Withdraw consent at any time where we are relying on consent to process your personal information. This will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances. Please note that where you exercise your right of access, we are required by law to carry out a reasonable and proportionate search for your personal information. When responding to your request, exemptions (such as where disclosing your information would reveal legally privileged information or third-party personal data) may apply, meaning that you may not always receive all the personal information that we process about you. We consider and apply exemptions on a case-by-case basis.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex. In this case, we will notify you and keep you updated.

12. COMPLAINTS

You also have the right to complain to us about how we handle your personal information or other people’s information. Where you make a complaint, we will acknowledge your complaint within 30 days and respond to it without undue delay.

In addition to your right to complain to us, you have the right to complain to the UK data protection regulation, the Information Commissioner’s Office (ICO), if you are concerned about the way we have processed your personal information.

We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

Please visit the ICO’s website for further details.

13. CHANGES TO THIS PRIVACY NOTICE

We may review this Privacy Notice from time to time and any changes will be notified to you. We recommend you regularly check for changes and review this Privacy Notice whenever you visit or use any of our Digital Services.

14. CONTACT US

Please direct any queries about this Privacy Notice or about the way we process your personal information to our Privacy Manager using our contact details below.

Our email address for data protection queries is c.datarequest@stonegatepubs.com or alternatively you can contact us using the web forms on our Digital Services.

15. LEGAL INFORMATION

We are Stonegate Pub Company Limited.

We are a limited company incorporated in the Cayman Islands with UK company registration number FC029833 (and UK establishment number BR014816) and our registered office address is Conyers Trust Company (Cayman) Limited, Cricket Square, PO BOX 2681, Grand Cayman, Ky1-1111, Cayman Islands.

Our main trading address is 3 Monkspath Hall Road, Solihull, West Midlands B90 4SJ.

APPENDIX -PROCESSING PURPOSES

APPENDIX -PROCESSING PURPOSES

PART A – WHEN YOU USE OUR DIGITAL SERVICES

We process your personal information when you use our Digital Services to:

Purpose	Data Types	Legal Basis
Manage your bookings and reservations.	Identity Data Contact Data Financial Data Booking Data	Contract – pre contractual steps to perform our contract with you.
Process your payments.	Identity Data Contact Data Financial Data Transactions Data	Contract – necessary to perform our contract with you.
Manage our loyalty programme offered through the MiXR App.	Identity Data Contact Data Financial Data Profile Data Loyalty Data	Legitimate Interests – necessary to provide you with loyalty benefits and rewards.
Respond to your customer service requests and enquiries.	Identity Data Contact Data Booking Data Communications Data	Legitimate Interests – necessary to respond to you and process your requests and enquiries.
Inform you of updates to our terms and conditions and notices.	Identity Data Contact Data Communications Data	Legitimate Interests – necessary to provide you with information about our products and services.
Contact you with marketing information by phone, by email and by SMS, where you opt in to us doing so.	Identity Data Contact Data Marketing Data Profile Data	Consent – where you have given your consent for us to do so.
Tailor communications (including recommendations) to you based on your location, interests, previous bookings and insights we have obtained about you.	Identity Data Contact Data Booking Data Marketing Data Profile Data Transaction Data	Legitimate Interests – necessary to personalise our services, products and content suggestions for you.

Improve how we deliver advertising to you on social media platforms.	Identity Data Profile Data Social Media Data	Legitimate Interests – necessary to improve how we provide you with information about our products and services.
Measure the reach and effectiveness of our marketing communications.	Identity Data Contact Data Booking Data Profile Data Transaction Data Marketing Data	Legitimate Interests – necessary to improve our marketing campaigns.
Combine information collected from you on the MiXR app and from your interactions our brands’ other Digital Services to understand your preferences and provide you with personalised content.	Identity Data Booking Data Marketing Data Profile Data Transaction Data Loyalty Data	Legitimate Interests – necessary to develop insights about your buying habits to improve the relevance of the content we deliver to you.
Combine information collected using storage and access technologies (such as cookies) from your use of our Digital Services to understand your preferences and provide you with personalised content.	Identity Data Technical Data	Consent – where you have given your consent for us to do so.
Share your information with our commercial partners for insights and analysis where we may act as joint data controllers. Please see “Sharing with commercial partners” below for more information.	Contact Data Transaction Data	Legitimate Interests – necessary to develop insights about your buying habits to improve the relevance of our marketing campaigns and promotions.
Enable you to collect and redeem points in the MiXR App.	Identity Data Transaction Data Loyalty Data Technical Data	Legitimate Interests – necessary to administer our loyalty programme.

Enable you to participate in missions and games on the MiXR App.	Identity Data Transaction Data Loyalty Data Technical Data	Legitimate Interests – necessary to administer our loyalty programme.
Provide the Digital Services and our products, and for internal operations, including troubleshooting and testing.	Identity Data Marketing Data Technical Data	Legitimate Interests – necessary to help us deliver and improve our products and services.
Analyse your use of our Digital Services and/or engagement with our electronic communications.	Identity Data Marketing Data Technical Data	Legitimate Interests –necessary to evaluate and improve our products and services.
Carry out market analysis and research (including contacting you with user or customer surveys).	Identity Data Communications Data	Legitimate Interests –necessary to understand your use of our products and services.
Access location to identify which of our Venues are nearby and to personalise messaging.	Identity Data Contact Data Location Data	Consent –where you have given your consent for us to do so.
Use your name and image for publicity purposes.	Identity Data Event Data	Consent – where you have given your consent for us to do so.
Respect your dietary preferences.	Identity Data Preferences Data	Consent – where you have given your consent for us to do so.
Maintain network and information security.	Technical Data	Legitimate Interests – necessary to protect your information against loss or damage, theft or unauthorised access and protect our business.
Keep a record of the exercise of your rights or resolve any complaints relating to our processing of your personal information.	Identity Data Contact Data Communications Data	Legitimate Interests – necessary to ensure accurate information within our organisation and comply with our legal and regulatory obligations.
Respond or assist public authorities or the police and other criminal investigation bodies.	Identity Data Contact Data	Legitimate Interests – necessary to assist law enforcement authorities.

Anonymise audio call recordings, conversation transcripts or other records of your communications with us.

Communications Data

Legitimate Interests – necessary to train and improve our AI customer service agent tool.

Detection and prevention of fraud and other criminal activities.

Identity Data

Legitimate Interests – necessary to ensure the security of Digital Services.

To establish, bring or defend legal proceedings.

Identity Data

Contact Data

Transaction Data

Financial Data

Legitimate Interests – necessary to protect our business interests and enforce our legal rights.

PART B –WHEN YOU VISIT OUR VENUES

We process your personal information when you visit our Venues to:

Purpose	Data Types	Legal Basis
Manage your bookings and reservations.	Booking Data Contact Data Communications Data	Contract – pre contractual steps to perform our contract with you.
Verify your age where we are required to do so.	Age Verification Data	Legal Obligation – to comply with our licensing obligations.
Respect your dietary preferences.	Identity Data Preferences Data	Consent – where you have given your consent for us to do so.
Maintain the security of our staff, customers, Venues and assets.	CCTV Data Pubwatch Data	Legitimate Interests – necessary to ensure the security of our staff, customers, Venues and assets.
Respond or assist public authorities or the police and other criminal investigation bodies.	Contact Data CCTV Data	Legitimate Interests – necessary to assist law enforcement authorities.
Participate in Pubwatch schemes.	Contact Data Pubwatch Data	Legitimate Interests – necessary to ensure the security of our staff, customers, Venues and assets.