Privacy Policy

Who is responsible for your data

The data controller is Maison Noir Hospitality LLC, 118 Hudson Street, Suite 2, New York, NY 10013, United States. You can reach our privacy contact at [email protected] or by calling +1 (212) 555-0142 and asking for the privacy contact. Written requests can be posted to the address above marked "Privacy Request".

What we collect and why

We only ask for what we need to do the thing you asked us to do.

Information you give us directly

• Reservations. Name, email address, mobile number, party size, date and time, allergies and dietary requirements, occasion, and any notes you add. Allergy information is health related, and we collect it only because you have chosen to tell us so that we can cook safely for you.
• Noir at Home orders. Name, phone number, email address, delivery address where applicable, order contents and any allergy note.
• Events and catering enquiries. Name, company, email, phone, event details, guest count and budget range.
• Gift cards. Purchaser name and email, recipient name and email, amount, format and the message you write on the card.
• Contact form. Name, email, optional phone number, topic, and the content of your message.
• Cellar Club. Name, email, and a record of qualifying spend at our restaurants so we can credit points.
• Job applications. Whatever you choose to send us by email, including your work history.

Information collected automatically

• Server logs. IP address, user agent string, the pages you requested, the time of the request, and the referring page. These are generated by our hosting provider and are used for security and to diagnose faults.
• Cookies and similar technologies. Only as described in the next section and in our Cookie Policy.

We do not collect payment card numbers on this website. Reservations, orders and gift cards are all paid through a payment link or over the phone, and card data goes directly to our payment processor.

Cookies, tracking and consent

When you first visit this site you are shown a consent banner with three choices: Accept all, Reject optional, and Manage preferences. No analytics cookie, no advertising cookie and no third party tracking script is set before you make a choice. If you reject optional cookies, only strictly necessary storage is used: a record of your consent decision and the temporary contents of any form you are filling in.

You can change your decision at any time using the Cookie Preferences link in the footer of every page on this site. Withdrawing consent stops future collection in the categories you turn off.

The full list of cookies, their purposes and their lifetimes is in the Cookie Policy.

Third parties, including Google

We share personal information with the following categories of service provider, each only to the extent needed for the service they perform:

• Hosting and content delivery. Serves this website and produces the server logs described above.
• Reservation and ordering platform. Stores your booking and order details so our teams can service them.
• Payment processing. Handles card payments. We receive confirmation and the last four digits, never the full card number.
• Email delivery. Sends confirmations, gift card emails and the menu letter.
• Google. Where you have consented to analytics, we use Google Analytics to understand aggregate site usage. Where you have consented to advertising, Google and its partners may serve advertisements on this site.

Google's use of advertising cookies

Google, as a third party vendor, uses cookies to serve ads on this site. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and other sites on the internet. This includes Google's DoubleClick DART cookie and, where applicable, other identifiers used for ad selection, delivery, frequency capping and measurement.

You can opt out of personalised advertising by Google at Google Ads Settings. You can opt out of personalised advertising from many other participating vendors at aboutads.info and the Network Advertising Initiative opt out page. You can also read how Google uses information from sites that use its services. Third party vendors and ad networks may also serve ads on this site; you can visit their own sites to opt out of their cookies where they offer that option. Turning off the Advertising category in our banner prevents these cookies being set here in the first place.

We do not sell your personal information

We do not sell personal information for money, and we have not done so in the preceding twelve months. Under California law, allowing advertising cookies on a website can count as "sharing" personal information for cross context behavioural advertising. You can refuse that here at any time using Do Not Sell or Share My Personal Information, which opens the preference panel with advertising switched off.

How long we keep things

• Reservation records, including dietary notes, are kept for thirty six months so we can recognise a returning guest and remember an allergy.
• Order records are kept for twenty four months, and for seven years in the aggregate financial records we are legally required to retain.
• Contact form submissions are kept for twenty four months.
• Event enquiries are kept for thirty six months.
• Gift card records are kept until the card is fully redeemed, plus seven years.
• Job applications are kept for twelve months unless you ask us to delete them sooner.
• Server logs are kept for ninety days.
• Marketing consent records are kept for as long as you are subscribed, plus twenty four months as evidence of consent.

Retention periods are also summarised below.

Children's privacy

This website is intended for adults. We do not knowingly collect personal information from anyone under thirteen years of age, in line with the Children's Online Privacy Protection Act. We do not direct any part of this site at children, we do not run advertising aimed at children, and we do not build profiles of children.

If you believe a child under thirteen has given us personal information through this website, email [email protected] and we will delete it promptly and confirm to you that we have done so. A parent or guardian making a reservation may of course include a child in the party size and note a child's allergy; that information is provided by the adult and is held under the adult's reservation record.

Your California privacy rights (CCPA and CPRA)

If you are a California resident, you have the right to:

• Know what personal information we have collected about you, the categories of source, our purpose for collecting it, and the categories of third party we disclose it to.
• Access a copy of that information in a portable format.
• Delete the personal information we hold, subject to exceptions such as records we must keep for tax or legal reasons.
• Correct inaccurate personal information.
• Opt out of the sale or sharing of your personal information for cross context behavioural advertising. Use the Do Not Sell or Share My Personal Information link, which is also in the footer of every page.
• Limit the use of sensitive personal information. The only sensitive category we hold is health related dietary information you volunteer, and we use it solely to prepare your food safely.
• Not be discriminated against for exercising any of these rights. Exercising them will never affect your ability to book a table, your Cellar Club status, or the price you pay.

To make a request, email [email protected] with the subject line "California Privacy Request", or write to the postal address above. We acknowledge requests within ten business days and respond substantively within forty five calendar days, extendable once by a further forty five days where necessary. We will verify your identity by matching the details you give us against our records, and for deletion requests we may ask for one additional piece of matching information. An authorised agent may act for you with written permission.

In the preceding twelve months we collected the categories of information listed at the top of this policy, disclosed them to the categories of service provider listed above for business purposes, and sold none of them.

Other US state privacy laws

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with comprehensive privacy statutes have broadly equivalent rights of access, correction, deletion, portability and opt out of targeted advertising. We handle all such requests through the same address and on the same timetable as California requests. Where a state provides a right to appeal a refused request, you may appeal by replying to our decision email within thirty days and it will be reviewed by a different person.

If you are in the European Union, the EEA, Switzerland or the United Kingdom

We are a United States business and this site is aimed at guests in the United States, but we do receive visitors from Europe and we treat their data accordingly. Where the General Data Protection Regulation or the UK GDPR applies to a visit, our legal bases are:

• Contract. Processing your reservation, order, gift card or event booking.
• Consent. Analytics cookies, advertising cookies, the menu letter, and the health related dietary information you volunteer, which we process on the basis of your explicit consent under Article 9(2)(a).
• Legitimate interests. Security logging and fraud prevention, balanced against your rights.
• Legal obligation. Financial and tax records.

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time without affecting the lawfulness of earlier processing. Requests go to [email protected] and are answered within one month. Personal data reaches the United States, where our servers and staff are located; we rely on your explicit consent or on the necessity of the transfer for the performance of your booking, and we use providers offering Standard Contractual Clauses where available. You also have the right to complain to your local supervisory authority.

Security

Access to guest data is limited to the staff who need it for their role, protected by individual accounts and multi factor authentication. Data is encrypted in transit using TLS and at rest by our platform providers. We review access quarterly and remove it the day someone leaves. No system is perfectly secure, and if a breach affecting your personal information occurs we will notify you and the relevant authorities as required by the applicable state or federal law.

Marketing emails

The menu letter goes out about six times a year and only to people who asked for it. Every email has a one click unsubscribe link, and unsubscribing takes effect immediately. We do not send transactional confirmations to unsubscribed guests as a way of marketing to them, and we never sell or rent our list.

Links to other sites

This site links to third party sites, including delivery marketplaces and the opt out pages listed above. We do not control them and this policy does not cover them. Read their policies before giving them information.

Changes to this policy

If we change this policy we will update the date at the top of the page. Where a change materially affects how we use information we already hold, we will say so on the home page for thirty days and, where the law requires it, ask for fresh consent.

How to contact us about data

Email [email protected], call +1 (212) 555-0142, or write to Privacy Request, Maison Noir Hospitality LLC, 118 Hudson Street, Suite 2, New York, NY 10013.