Updated 6 September 2026
Privacy & cookies
Who is responsible
Laher Catering (Bradford) Ltd, trading as Esto’s Bradford, is responsible for the personal information used to handle your orders (the data controller).
Registered in England and Wales. Company number: 17215452. Registered office: 66 Paul Street, London, England, United Kingdom, EC2A 4NA. The registered office is separate from the restaurant collection address.
For privacy questions or requests, email orders@estosbradford.co.uk or write to the registered office above.
Information we use
We use the name, telephone number, email address, chosen food and options, notes and collection choice you provide, together with your order reference, time, totals and payment status. If you choose car park collection, we also use the vehicle details you provide to identify your car.
Required details let us process and hand over your order, send confirmation and contact you about problems. Without them, online checkout may not be possible. Use order notes for ordinary food preferences. Discuss allergies with staff before ordering rather than entering medical history online.
Stripe handles online card entry and payment processing on its checkout. Our ordering application receives payment references and status, rather than your full card number or security code.
Why we use it
Processing your order, taking payment and sending order confirmations rely on performing our contract with you, including steps you request before ordering. We use necessary financial records to meet legal accounting obligations. Resolving complaints, preventing abuse and protecting the website rely on our legitimate interests where those interests are not overridden by your rights.
If you separately opt in at checkout, we keep your name, email address and a record of your consent to receive offers and news by email. A separate optional choice allows a one-off Google review request after your order is placed and confirmed. These uses rely on your consent; they are not required to order, and we do not automatically subscribe existing customers. Staff can export opted-in email contacts for marketing. We do not use your telephone number for promotional texts or calls.
Your email choices
You can withdraw consent using the unsubscribe link in an optional email or by contacting orders@estosbradford.co.uk. Withdrawing consent does not affect earlier lawful use or essential order confirmations. Google review requests, when enabled, are scheduled through Resend after your order is placed and confirmed; reviews are voluntary and all honest feedback is welcome. Clicking a review link takes you to Google, which handles your activity under its own privacy notice.
We retain subscription details while you choose to receive optional emails, subject to periodic review. We keep necessary consent and suppression records to demonstrate your choices and prevent unwanted messages. An unsubscribe does not automatically delete order records that are still needed for another stated purpose.
Who receives it
Restaurant staff receive the information needed to prepare and hand over orders. Order details appear in the staff system, customer and staff confirmation emails, and printed kitchen tickets. The restaurant’s order receiver on its terminal handles printing.
We use OpenAI Sites and its hosting infrastructure to operate the website and store orders, Stripe for payments, Resend for sending emails, and the Microsoft 365 mailbox supplied through GoDaddy. Mintfield Commerce may access relevant information when providing authorised website support. Necessary records may also be shared with professional advisers or authorities where required by law.
Processing outside the UK
Our providers operate internationally, and information may be processed outside the UK, including in the United States. OpenAI Sites does not offer a UK-only data residency setting. Provider terms describe the transfer protections that apply to their services, including standard contractual clauses and the UK addendum where applicable. You can contact us for further information about relevant safeguards.
See the provider information linked below for their processing arrangements and safeguards. Stripe also uses information for its own payment security and regulatory purposes as explained in its privacy notice.
How long information is kept
Retention depends on why a record is still needed: fulfilling and reconciling the order, dealing with a query, refund or dispute, or meeting an accounting or other legal obligation. Information that is no longer needed is to be deleted or anonymised; retaining necessary financial records does not require keeping all customer contact details or food notes.
Contact details and notes are reviewed in light of those purposes and any request you make to access or remove them. Where we need to retain particular records, for example for an unresolved dispute or legal obligation, we consider that need individually. Contact us using the address above to request a review.
The application clears vehicle details from active order and checkout records when an order is marked collected, cancelled or fully refunded. Cleanup also removes active vehicle details older than 24 hours when the staff administration service is used. Email and printed copies are separate and must be removed separately by staff. Provider logs and backups follow the applicable provider retention arrangements; clearing an active record does not mean every copy is immediately erased.
Cookies, browser storage and traffic information
The ordering page temporarily stores your basket in browser session storage when sending you to Stripe so it can be restored if payment is cancelled. That copy is removed after successful confirmation. Staff sign-in uses an essential session cookie lasting up to 12 hours. We use security records to limit repeated requests; expired application rate-limit records are removed during cleanup.
OpenAI Sites automatically records website traffic and provides visitor and page-view counts. Hosting and payment services also process technical information needed to deliver and secure their services. Their own notices explain their cookies and other processing. We have not added advertising pixels or a separate advertising tracker to this website.
Your rights
Depending on the circumstances, you can ask to access or correct your information, request deletion or restriction, object to processing based on legitimate interests, or request a portable copy. These rights have conditions and may be affected by records we must keep. Contact orders@estosbradford.co.uk to make a request.
You can also complain to the Information Commissioner’s Office. We will update this notice when our practices change and show the revision date on this page.