Privacy policy

Last updated: 7 October 2026

Who we are

TapChat Limited ("TapChat", "we", "us") provides WhatsApp guest messaging for restaurants and other hospitality venues. We're registered in England and Wales, company number 16814576.

Registered office: 7 Haddington Close, Wendover, Aylesbury, HP22 5QA
ICO registration number: to be added on registration

You can contact us, including our data protection lead, at hello@gettapchat.co.uk.

This policy has two parts:

Part 1 applies if you message, call or tap a card at a venue that uses TapChat.
Part 2 applies if you visit gettapchat.co.uk, send us an enquiry or book a walkthrough.

Part 1. Guests of venues that use TapChat

Our role

When you deal with a venue through TapChat, the venue is the data controller and TapChat is its data processor. The venue decides what data is collected and why. We process it on the venue's behalf, under a written agreement, to deliver the service.

Messages travel over the WhatsApp Business Platform, run by Meta. Meta processes them for the venue as a data processor, under WhatsApp's Business Data Processing Terms. The venue's WhatsApp number is connected to that platform through a Meta-approved business solution provider, which works for us under a written agreement.

The venue's own privacy notice also applies, and the venue is your first point of contact. If you contact us instead, we'll pass your request to the venue and help it respond.

What we process

When you interact with a venue through TapChat, we may process:

your name, as shown on your WhatsApp profile or as you give it
your mobile number
your messages with the venue, including those answered by its assistant
if you call the venue and nobody answers: the number you called from and the time of the call
how you reached the venue (for example a table card, a missed call, an ad or social media)
booking requests and preferences, such as party size, birthday month and the events you'd like to hear about
your answers to check-ins, your feedback, and whether you were sent a review link
reward codes issued to you and whether they were used
your marketing choices: whether you've said yes or asked to stop, and when

We do not collect payment card details.

Allergies and health. If you choose to tell a venue about an allergy, dietary need or health matter, we use it only to pass it to the venue's team so they can look after you on your visit. We rely on your explicit consent, which you give by sharing it, and you can ask for it to be deleted at any time. We never use it for marketing, and the assistant doesn't give allergy advice. Please share only what the venue needs to know.

Why we process it

On the venue's instructions, we use your data to:

reply to your messages and booking questions
follow up a missed call with a WhatsApp message, so you can get an answer or book
send a check-in after your visit and an invitation to leave a review
pass feedback and requests to the right person in the venue's team
send event invitations, offers and other updates, but only if you've chosen to receive them
issue and check reward codes
report to the venue on how its guest messaging is working

Automated replies

Some replies come from an automated assistant. It answers from the venue's own information, such as menus and opening times, and it says it is an assistant if you ask. It hands sensitive matters, including complaints and allergies, to a member of the venue's team. It does not make decisions about you that have legal or similarly significant effects.

Lawful basis

The venue, as controller, decides the lawful basis for each use. Typically:

Replying to your messages and calls, missed-call follow-ups and post-visit check-ins: the venue's legitimate interests in answering guests and looking after their visits.
Marketing messages: your consent.
Allergy or health information you choose to share: your explicit consent (UK GDPR Article 9(2)(a)). It is passed to the venue's team for your visit and used for nothing else.

Who else processes your data

We use a small number of service providers to deliver the service:

Meta Platforms Ireland Limited, which runs the WhatsApp Business Platform and processes messages as a data processor
a Meta-approved WhatsApp business solution provider, which connects the venue's number to the platform and holds messages and guest records
a telephone provider, which handles the divert when a call goes unanswered
automation and spreadsheet tools, used for routing and reporting
an AI provider, which powers the assistant
Google Workspace, for email and documents

Each provider acts on instructions, under a written agreement, and receives only what it needs. We do not sell your data.

International transfers

Some providers process data outside the UK, including in the United States. Where they do, we rely on one of the following:

UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework for certified US companies
the ICO's International Data Transfer Agreement or Addendum

How long we keep it

While a venue uses TapChat, we keep your data for as long as the venue needs it to run its guest messaging.
Records of missed calls are kept for 12 months.
If you ask to be removed, we delete your data within 30 days.
When a venue stops using TapChat, we return your data to the venue or delete it, as the venue instructs, within 30 days.

Anonymised figures

We may combine figures from venues into anonymised statistics, for example how many messages were read, to describe and improve our service. These figures don't identify you.

Security

Access to guest data is limited to the people who need it to deliver the service. Our providers are bound by confidentiality and security obligations.

Opting out

Reply STOP, or tap the opt-out button in any message, to stop marketing messages from a venue. We stop them straight away, and always within 48 hours. You'll still get replies to anything you ask.

Part 2. Website visitors and enquiries

For this part, TapChat Limited is the data controller.

This website

This site is hosted by Wix (Wix.com Ltd). When you visit, Wix processes technical data such as your IP address, browser, device and the pages you view. It does this to deliver the site and keep it secure.

Lawful basis: our legitimate interests in running a secure website.

The enquiry form

What we collect: your name, email, venue or group name and number of venues, plus anything optional you add: phone number, role, booking system, what you'd like to fix and your message.
Why: to reply, to arrange and prepare your walkthrough, and to follow up about TapChat.
Lawful basis: our legitimate interests in answering business enquiries, and steps you ask us to take before any contract.
Where it goes: submissions are stored in Wix, and a copy is sent to our Google Workspace email.

Booking a walkthrough

Walkthroughs last 30 minutes and are booked through Google Calendar. When you book, Google processes your name, your email, the time you choose and any notes you add. It sends confirmations and adds a video call link. Lawful basis: as for the enquiry form. Google's own privacy policy applies to its processing.

Emails from us

We'll reply to your enquiry and may follow up about it. We'll only send you news about TapChat if you're happy to receive it, and every such email lets you stop.

Cookies and analytics

We use essential cookies to run the site.
We use analytics cookies (Google Analytics 4) only if you accept them in the cookie banner.

You can change your choice at any time using "Cookie settings" in the footer. Analytics data is used in aggregate, to see which pages help visitors. See our cookie policy at gettapchat.co.uk/cookies.

Who we share it with

Wix and Google, as our service providers
our professional advisers, such as our accountant, under confidentiality
public authorities, where the law requires it

We do not sell your data.

International transfers

Wix is based in Israel, which the UK recognises as adequate, and uses providers in other countries, including the US.
Google processes data in the US.

Where data leaves the UK, we rely on the safeguards described in Part 1.

How long we keep it

Enquiries and walkthrough bookings that don't lead to working together: 24 months from our last contact.
If you become a client: for the length of the contract and six years after it ends, for tax and legal reasons.
Analytics data: 14 months.

Your rights (both parts)

Under UK data protection law you can ask to:

get a copy of your data
correct it
delete it
restrict or object to how it's used, including objecting to marketing at any time
receive it in a portable format, where that applies
withdraw your consent at any time, where we rely on consent

For Part 1, the venue is the controller. You can ask the venue or us, and we'll pass your request on and help. For Part 2, contact us directly.

We'll respond within one month, and there's normally no fee.

Complaints

Please tell us first at hello@gettapchat.co.uk. We'll acknowledge your complaint within 30 days and try to put it right.

You can also complain to the Information Commissioner's Office:

online: ico.org.uk/make-a-complaint
by phone: 0303 123 1113
by post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

Children

WhatsApp requires users in the UK to be at least 13. We don't knowingly process data about children under 13, and this website is intended for businesses.

Changes to this policy

We may update this policy from time to time. The latest version will always be at gettapchat.co.uk/privacy, with the date at the top.