Zapote · Shoreditch

Privacy Policy

Last updated: 10 July 2026

This Privacy Policy explains how Zapote collects, uses and protects personal information when you contact us, make an enquiry, book a table, enquire about private events, submit a form through Facebook or Instagram, visit our website, or otherwise interact with us.

1. Who we are

Zapote is a contemporary Mexican restaurant and bar based at:

Zapote
70 Leonard Street
London
EC2A 4QX
United Kingdom

Website: https://zapote.co.uk
Instagram: @zapoteshoreditch
Email: info@zapote.co.uk

For the purposes of UK data protection law, Zapote is the data controller of the personal information we collect and use.

2. Information we collect

We may collect the following personal information:

Name
Email address
Phone number
Company name
Event enquiry details
Preferred booking date or event date
Number of guests
Type of event or booking
Dietary requirements or accessibility needs, where voluntarily provided
Messages or notes you send to us
Information submitted through Meta/Facebook/Instagram lead forms
Website usage information, where cookies or analytics are used

We only collect information that is relevant to your enquiry, booking or interaction with us.

3. How we collect your information

We may collect personal information when you:

Submit an enquiry form on our website
Complete a Facebook or Instagram lead form
Contact us by email, phone, direct message or social media
Make a reservation or event enquiry
Attend an event at Zapote
Sign up to receive updates from us
Interact with our website or social media pages

4. How we use your information

We use your personal information to:

Respond to your enquiries
Manage restaurant reservations
Respond to private event and catering enquiries
Provide quotes, menus or event information
Confirm bookings and event details
Contact you about your enquiry or booking
Provide customer service
Improve our services and guest experience
Send marketing communications where you have consented or where legally permitted
Keep appropriate business records
Comply with legal obligations

5. Lawful basis for using your information

We rely on different lawful bases depending on how we use your data:

Contract or pre-contract steps: when responding to booking or event enquiries and preparing quotes or reservations.
Legitimate interests: to manage our business, respond to enquiries, improve our services, and follow up on relevant business enquiries.
Consent: where you have opted in to receive marketing communications.
Legal obligation: where we need to keep records for tax, accounting or legal purposes.

6. Marketing communications

We may contact you with updates about Zapote, events, menus, offers or relevant news where you have opted in or where we are legally permitted to do so.

You can unsubscribe or ask us to stop sending marketing communications at any time by contacting us at:

[insert email address]

7. Meta, Facebook and Instagram lead forms

If you submit your details through a Facebook or Instagram lead form, the information you provide will be shared with Zapote so that we can respond to your enquiry.

Meta may also process your personal information in accordance with its own privacy policies and terms. We recommend reviewing Meta’s privacy information if you submit details through Facebook or Instagram.

8. Sharing your information

We do not sell your personal information.

We may share your information with trusted service providers where necessary, including:

Booking and reservation platforms
Email and communication providers
Website hosting or analytics providers
Marketing and advertising platforms
Payment processors, where relevant
Professional advisers, where necessary
Authorities or regulators, where legally required

We only share information where necessary and take reasonable steps to ensure it is handled securely.

9. How long we keep your information

We keep personal information only for as long as reasonably necessary.

As a guide:

Event and booking enquiries may be kept for up to 24 months after the enquiry or event, unless we need to retain them longer for business, legal or accounting purposes.
Marketing contact details are kept until you unsubscribe or ask us to remove them.
Financial or transaction records may be kept for up to 6 years where required for accounting or tax purposes.

10. How we protect your information

We take reasonable steps to protect personal information from unauthorised access, loss, misuse or disclosure.

Access to personal information is limited to people who need it for business purposes, such as responding to enquiries, managing bookings, or handling events.

11. Your rights

Under UK data protection law, you may have the right to:

Access the personal information we hold about you
Ask us to correct inaccurate information
Ask us to delete your information
Object to how we use your information
Ask us to restrict how we use your information
Ask for a copy of your information in a portable format
Withdraw consent where we rely on consent

To exercise your rights, please contact us at:

[insert email address]

12. Cookies and website analytics

Our website may use cookies or similar technologies to improve website functionality, understand visitor behaviour, and support marketing activity.

Where required, we will ask for your consent before using non-essential cookies.

13. International transfers

Some of our service providers, including technology, advertising or analytics platforms, may process personal information outside the United Kingdom. Where this happens, we take reasonable steps to ensure appropriate safeguards are in place.

14. Complaints

If you have any concerns about how we use your personal information, please contact us first so we can try to resolve the issue.

You also have the right to complain to the UK Information Commissioner’s Office:

Website: https://ico.org.uk
Phone: 0303 123 1113

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The latest version will be published on our website with the updated date shown at the top.