Privacy Policy

Avora ("we", "us", "our") is a lounge and cafe at Avora, Kings Walk, Grays, Essex, RM17 6HR. We operate this website and are the data controller for the personal data described below.

You can reach us at avoralounge@gmail.com or on +44 (0) 1375 511495. Use either for any question about this policy or about your data.

Contact form — your name, email address, subject and message. We use this only to read and reply to your enquiry. The form does not store your message in this website's database: it is sent straight to our inbox as an email.

Enquiries by email or phone — if you contact us directly, we hold whatever you choose to tell us, for as long as we need it to deal with your enquiry.

Reservations — we take bookings by phone and email. There is no online booking form or third-party booking widget on this site, so no reservation data is collected here.

Technical logs — like any website, our hosting provider records requests made to the server, including IP address, the page requested, and the time. These are used to keep the site running and to investigate abuse or faults. We do not use them to build a profile of you.

We do not collect special category data, we do not use your data for advertising, and we make no automated decisions about you.

This website sets no cookies on your device when you browse it. There is no analytics, no advertising, no social media tracking, and no third-party embeds loading in the background. Our fonts are served from our own domain rather than from a font provider, so browsing here does not tell anyone else that you visited.

We use one small piece of local storage in your browser: if we show an announcement and you dismiss it, we remember that so it does not reappear on every page. It holds no personal data, it is never sent to our server, and clearing your browser data removes it.

Staff signing in to the site's admin area receive a session cookie. It is strictly necessary to keep them signed in, is set only after signing in, and is never set for public visitors.

Under the UK GDPR we rely on:

• Legitimate interests — to answer enquiries you send us, and to keep the website secure and working. We think you would expect this when you contact a business.
• Contract — where we need your details to arrange something you have asked for, such as a booking or private hire.
• Legal obligation — where we must keep records, for example for tax or accounting.

We do not rely on consent for cookies, because we do not set any that would require it.

We do not sell, rent or trade your personal data, and we do not share it for anyone else's marketing. We use a small number of service providers who process data on our instructions:

• Resend — delivers contact form submissions to our inbox as email.
• Supabase — stores the website's own content, such as the menu, events and images. Visitor enquiries are not stored here.
• Our website hosting provider — serves the site and keeps the technical logs described above.

Some of these providers operate outside the UK. Where personal data is transferred abroad, it is protected by the safeguards required under UK data protection law, such as the International Data Transfer Agreement or an adequacy decision.

We may also disclose data where the law requires it, or to establish or defend legal claims.

We keep enquiry emails only as long as we need them to deal with your enquiry and for a reasonable period afterwards in case you get back in touch — normally up to 12 months — then we delete them.

Records we must keep by law, such as those relating to bookings we have invoiced, are kept for as long as that law requires, typically six years.

Server logs are short-lived and are rotated by our hosting provider.

The site is served over HTTPS. The admin area is password protected, sign-in sessions are cryptographically signed, and access to the underlying database is restricted. Contact form submissions reach us over an encrypted connection to our email provider.

No system is perfectly secure, but if a breach affects your rights we will tell you and the ICO as the law requires.

Under the UK GDPR you have the right to:

• ask what personal data we hold about you, and get a copy
• have inaccurate data corrected
• ask us to delete data we no longer need
• ask us to restrict how we use it while a concern is resolved
• object to processing we carry out under legitimate interests
• ask for data you gave us in a portable format, where that applies

Email avoralounge@gmail.com and we will respond within one month. Exercising these rights is free.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. We would appreciate the chance to put things right first.

This website is intended for adults and we do not knowingly collect data from children. If you believe a child has sent us personal data, contact us and we will delete it.

If we change how we handle personal data — for example by adding online booking or analytics — we will update this page and change the date at the top. This version was published on 6 October 2026.

See also our accessibility statement, or get in touch.