These documents are being finalised. Any details marked “to follow” will be added shortly.
Data procedures: breaches, requests and retention
This page sets out how Capri Mirfield, Capri Newmillerdam and Capri @ The Vine deal with personal data breaches and with requests from people about their information, and how long we keep different records.
Who we are
Capri Group is the name we use for three restaurants. Each restaurant is run by its own limited company, and that company is responsible for your booking and for any personal information it holds about you.
| Restaurant | Company | Company number | Registered office | ICO registration |
|---|---|---|---|---|
| Capri Mirfield | Capri Mirfield Ltd | 15453883 | 79 Old Bank Road, Mirfield, England, WF14 0HY | ZB789665 |
| Capri Newmillerdam | Kos Kir (Dam) Ltd | 17071063 | Unit 9 Sheepscar Way, Leeds, England, LS7 3JB | (details to follow) |
| Capri @ The Vine | Kos Kir (Vine) Ltd | 17071129 | Unit 9 Sheepscar Way, Leeds, England, LS7 3JB | (details to follow) |
All three companies are registered in England and Wales. Restaurant addresses and phone numbers: (details to follow).
Privacy contact for all three restaurants: (details to follow).
1. Personal data breaches
A personal data breach is anything that leads to personal information being lost, destroyed, changed, shared or seen without permission, whether by accident or on purpose. Examples include an email sent to the wrong person, a lost booking sheet, a stolen phone or laptop, or a hacked account.
| Step | What happens |
|---|---|
| Report | Whoever finds the breach tells their manager or the privacy contact, (details to follow), straight away. If computers, email, tills or the network may be affected, Leeds IT Services Ltd is told at the same time on info@leeds-it.co.uk. |
| Contain | We act quickly to limit the harm, for example by recalling an email, changing passwords, locking an account or getting back lost paperwork. |
| Assess | We work out what information is involved, how many people are affected and how serious the risk to them is. |
| Report to the ICO | If the breach is likely to put people's rights and freedoms at risk, we report it to the Information Commissioner's Office within 72 hours of becoming aware of it. |
| Tell the people affected | If the risk to people is high, we tell them without delay, explaining what happened and what they can do to protect themselves. |
| Record and learn | Every breach is recorded, even if it is not reported to the ICO, with what happened, its effects and what we did. We then put right whatever allowed it to happen. |
2. Requests about your information
Anyone, whether a customer, a member of staff or a job applicant, can ask us for a copy of the information we hold about them, or ask us to correct it, delete it, restrict or stop using it, or move it to another organisation. A request can be made in writing, by email or in person to any member of staff, who must pass it to the privacy contact the same day.
We may ask for proof of identity before we reply. We reply within one month of receiving the request, or of receiving proof of identity if we need it. If a request is complex or there are several, we may extend this by up to two further months and will tell the person why within the first month. We do not usually charge. Where a copy would show other people, such as other customers on CCTV, we remove or blur their details. If we cannot do what is asked, we explain why and tell the person they can complain to the ICO.
Requests should be sent to (details to follow).
3. How long we keep records
We keep information only as long as we need it, then delete or securely destroy it. Where the law sets a minimum period, it is shown below.
| Record | How long we keep it | Why |
|---|---|---|
| Table bookings and booking notes, including allergy notes | (details to follow) | To manage bookings and deal with any questions about a visit |
| Marketing contact details and consent | Until the person unsubscribes, then only a record that they opted out | So we only market to people who have agreed, and never to people who have opted out |
| Deposit, payment, sales and gift voucher records | Six years after the end of the financial year they relate to | HMRC and company accounting requirements |
| CCTV recordings | About 30 days, then overwritten automatically | Safety and security; saved footage is kept only while needed for an incident, claim or investigation |
| Customer Wi-Fi technical logs | Only as long as needed to run and protect the network | Network security and dealing with misuse |
| Complaints | (details to follow) | To resolve complaints and deal with any claims |
| Payroll, tax and National Insurance records | At least 3 years after the end of the tax year they relate to (the law's minimum) | HMRC requirement |
| Right to work check copies | For the whole of employment and 2 years after it ends (the law's minimum) | Home Office requirement |
| Other staff records | (details to follow) | Employment and to deal with any claims |
| Accident book entries | At least 3 years from the date of the entry (the law's minimum) | Health and safety requirement |
| Unsuccessful job applications | (details to follow) | To deal with any questions or claims about the recruitment |
| Breach records and information requests | Six years | To show how we dealt with them |
4. Review
We review these procedures once a year, and after any serious breach or change to our systems.
Last updated: 3 November 2026