Privacy Policy

Last updated: 13 October 2026

1. Who we are

Flanagan’s Irish Pub is operated by New Town Bar Ventures Ltd, registered in Scotland under company number SC882458. We are the data controller responsible for the personal information we use as described in this policy.

Registered office: 30/5 Hardengreen Industrial Estate, Eskbank, EH22 3NX
Pub address: 47 Frederick Street, Edinburgh, EH2 1EP
Website: flanagansedinburgh.com
Privacy enquiries: info@flanagansedinburgh.com

This policy explains how we handle personal information under the UK GDPR and the Data Protection Act 2018. The Privacy and Electronic Communications Regulations also apply to our electronic marketing and relevant tracking technologies.

It covers our website, enquiries, newsletter and recruitment, and the CCTV, guest Wi-Fi and photography arrangements that apply when you visit our premises.

2. Enquiries and correspondence

When you contact us, we use your email address, name if provided, and the information in your message to respond and deal with your request.

Correspondence is stored in Gmail. Relevant information may also be held in Google Drive or Google Sheets. Access is limited to authorised people who need it for their work.

We rely on our legitimate interests in responding to enquiries, running the pub and resolving complaints. Where an enquiry involves taking steps towards a contract at your request, we may rely on that contractual basis instead.

You do not have to contact us, but without sufficient information or contact details we may be unable to help.

We do not currently accept bookings or take payments through the website. Please discuss food allergies and dietary requirements with staff when you visit, rather than submitting health information through the newsletter form.

3. Our newsletter

If you subscribe, we collect your email address through an embedded MailerLite form and use MailerLite to send news, events and offers from Flanagan’s.

MailerLite may also record technical and subscription information, such as your IP address, sign-up time and consent record.

We rely on your consent to send the newsletter. We do not automatically subscribe people who contact us with an enquiry. You can unsubscribe using the link in any newsletter or by emailing us. Withdrawing consent does not affect the lawfulness of earlier processing.

We do not use tracking pixels to monitor email opens. MailerLite records clicks on newsletter links, which may be associated with a subscriber’s email address. We use campaign-level reports to understand overall newsletter performance, rather than examining individual subscribers’ clicks or using those clicks to target them with personalised advertising.

We rely on our legitimate interests in understanding and improving our communications for campaign analysis, subject to your rights and reasonable expectations. Where the underlying tracking technology requires consent under the Privacy and Electronic Communications Regulations, we obtain that consent before using it.

You can contact us to object to analysis based on legitimate interests or withdraw consent where it applies.

4. Website information and cookies

Our website is hosted by Squarespace. Website hosting and security services process technical information such as IP addresses, browser and device details, page requests and security logs.

We rely on our legitimate interests in keeping the website available and secure for essential processing.

We do not currently use Meta Pixel, TikTok Pixel or Google Ads tracking. We do not upload customer email lists to advertising platforms or use newsletter clicks to retarget individual subscribers.

Please see our separate Cookie Policy for information about cookies and similar technologies used by the website, their purposes and durations, and your choices. You can access the policy and Cookie Preferences through the website footer.

Where optional technologies require consent, they must remain disabled unless you agree to their use. Strictly necessary technologies may operate without consent.

If we introduce additional analytics, advertising tools or embedded social content, we will update the relevant privacy and cookie information before enabling them and obtain consent where required.

If you follow a link to an external website or social platform, that organisation’s privacy policy applies to its own use of your information.

5. Job applications

We receive and review job applications through Indeed. We use the information you submit, including contact details, your CV, work history, qualifications and application correspondence, to assess your suitability and communicate with you about recruitment.

Our lawful bases are taking steps at your request before entering into an employment contract and our legitimate interests in managing recruitment. Where a specific legal check is required, we rely on the relevant legal obligation.

Any additional sensitive information or vetting required during recruitment will be explained separately.

Access to applications is limited to people involved in recruitment. Indeed also processes information under its own privacy policy. Its storage of an application does not mean we need to retain our access to it or any downloaded copy indefinitely.

6. CCTV

We operate CCTV inside and outside the premises to protect customers, staff and property, prevent and investigate incidents, and support the prevention and detection of crime.

Our cameras record video only, with no sound recording. We rely on our legitimate interests in safety and security.

Recordings are stored on a hard drive. Access is restricted to authorised management and security staff.

CCTV footage is deleted after 28 days. Within that period, relevant footage may be shared with police, insurers, legal advisers or other authorised recipients where necessary and lawful. Recipients are responsible for their own lawful retention of footage supplied to them.

Signs at the premises identify the use of CCTV. To request footage showing you, contact us with the approximate date, time and location so we can locate it. Disclosure may require protection of other people’s identities.

7. Guest Wi-Fi

We offer password-protected guest Wi-Fi using a Hyperoptic connection. We do not require your email address to access it and do not subscribe you to marketing because you use it.

Providing an internet connection involves processing technical information, such as IP addresses, device identifiers and connection information. Where we process this information, we do so for our legitimate interests in providing and securing the network and investigating faults or misuse.

Hyperoptic also processes network information under its own Privacy and Cookie Policy.

8. Photography and video

We may take photographs and videos to promote the pub, including on our website and social media.

For posed images, we ask for your permission and explain the intended use. Where we rely on consent, you can withdraw it by contacting us.

For general venue and atmosphere shots that incidentally include adults, we may rely on our legitimate interests in promoting the pub, provided this is proportionate and does not override the rights and reasonable expectations of those pictured. Entering the pub does not itself mean you consent to photography.

We avoid showing identifiable children in promotional material.

Please tell the photographer or a staff member if you do not wish to be included. You can also contact us about an image already published. We will assess objections and removal requests, and remove material where required. We cannot guarantee removal of independent copies or shares made by others.

9. Who receives information

Depending on the activity, information may be processed by:

  • Squarespace, for website hosting.

  • Google services, including Gmail, Drive and Sheets.

  • MailerLite, for newsletter subscriptions, delivery and reporting.

  • Indeed, for recruitment.

  • Hyperoptic, for internet connectivity.

Photos and videos published on our social channels are also processed by the relevant platform, including Instagram/Meta or TikTok, under its own privacy terms.

Authorised management, marketing, recruitment and security personnel receive access appropriate to their role. Providers supporting our IT, website, marketing or security may also process information where needed.

Some providers act on our instructions. Others, including social media and recruitment platforms, also process information independently under their own privacy notices.

We may disclose relevant information to professional advisers, insurers, police, regulators or other authorities where necessary and lawful. We do not sell personal information.

10. International processing

Some technology providers process personal information outside the UK, including in the European Economic Area and the United States.

For transfers for which we are responsible, we use an applicable UK adequacy arrangement or appropriate safeguards, such as approved contractual clauses with the UK Addendum or an International Data Transfer Agreement, as required. The arrangement depends on the provider and destination.

You can contact us for information about the safeguards applicable to your information or to request a copy, subject to necessary redactions.

11. How long we keep information

We retain personal information only for as long as necessary for its purpose, taking account of legal obligations, complaints and legal claims.

  • Enquiries: Correspondence remains in Gmail while needed to respond, maintain relevant records or deal with related complaints or legal obligations. Retention depends on the subject, whether it is resolved and any continuing need for the information.

  • Newsletter: Subscription details are kept while you remain subscribed and the service continues. After you unsubscribe, we retain only information needed to respect your opt-out, demonstrate consent or meet other justified obligations.

  • Recruitment: We retain access to applications and any copies while needed for recruitment and related queries or claims. Continued retention depends on the recruitment outcome, applicable claim periods and any separately agreed future-vacancy purpose. Indeed’s retention of your account and applications is governed separately by its policy.

  • CCTV: Footage is deleted after 28 days.

  • Promotional images: We review these annually and remove material no longer needed, subject to any continuing lawful purpose.

  • Website and Wi-Fi information: Retention depends on the service, its settings and the period needed for operation, security or investigation. Cookie durations are explained in our cookie information.

12. Your rights

Depending on the circumstances, you can request:

  • Access to your personal information.

  • Correction of inaccurate information.

  • Deletion of your information.

  • Restriction of its use.

  • Transfer of certain information to you or another organisation.

You have the right to object to processing based on legitimate interests, including our use of your image.

You have an absolute right to object to use of your personal information for direct marketing, including related profiling.

Where we rely on consent, you can withdraw it at any time. Some information may still need to be retained for another lawful purpose.

Contact info@flanagansedinburgh.com to exercise your rights. We may need to verify your identity. We normally respond within one month; if a lawful extension is needed, we will explain why.

We do not use solely automated decisions that produce legal or similarly significant effects on you.

13. Complaints and updates

Please contact us if you have a concern about how we use your information.

You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

We may update this policy when our services or practices change. The date at the top shows the latest update. Where required, we will bring material changes to your attention and obtain fresh consent before new consent-based uses.