This policy is a working draft and will be reviewed before the app launches.
1. Who we are
The Octet Club is operated by Paahun Global Limited (trading as The Octet Club), a company registered in England and Wales with company number 16884211. Paahun Global Limited is the controller of your personal data for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
You can contact us about anything in this policy at hello@theoctetclub.com.
2. Information we collect
When you request an invitation
Your full name, email address, company or organisation (optional), role, a short description of what you do, an optional link to your work, how you heard about us, and a record of your consent and the date of your request.
When you create an account in the app
- Your name and email address.
- Your mobile number, captured at registration for verification and account security. It is never shown to other members.
- Your answers to profile prompts, such as what you have built, what you are working on and what you can help with.
- Your profile photo.
- Dietary preferences and requirements you choose to share, which we pass to the restaurant hosting your dinner. Where these reveal health or religious information, we process them only with your explicit consent.
- Your seat bookings, attendance and cancellations.
- Messages you send to and receive from other members through the app.
Payments
Seat payments are handled by a third-party payment processor. We do not see or store your full card details. We receive a record of the transaction, such as the amount, date and the last four digits of your card.
Technical information
Basic technical information needed to run the website and app securely, such as device type, app version and error logs.
3. How we use your information and our lawful bases
- Considering your request for an invitation — your consent and our legitimate interest in curating a considered membership.
- Providing your account, showing your profile to members at your table, and managing bookings — performance of our contract with you.
- Taking payment and keeping financial records — performance of contract and compliance with legal obligations.
- Sharing dietary requirements with the restaurant — your explicit consent.
- Delivering in-app messages between members — performance of contract.
- Keeping the club safe, enforcing our Terms and preventing misuse — our legitimate interests.
- Sending service emails about your bookings and account — performance of contract.
We do not sell your personal data, and we do not use it for third-party advertising.
4. Who we share it with
- Other members — your name, photo and profile prompts are visible to members considering or seated at the same table. Your email address and mobile number are never shown.
- Restaurants — the name on the booking and any dietary requirements, for the dinner you have booked.
- Payment processor — to take and refund payments.
- Hosting and database provider (Supabase) — which stores our data on our behalf.
- Email delivery provider — to send service emails.
- Professional advisers and authorities — where required by law or to protect our rights.
Our providers act as processors under written contracts. Where data is transferred outside the UK, we rely on an adequacy decision or the UK International Data Transfer Agreement or Addendum.
5. How long we keep it
- Waitlist requests: up to 24 months from your request, unless you become a member or ask us to delete it sooner.
- Account data and messages: for as long as your account is open, and deleted within 30 days of account deletion, save for limited records we must keep.
- Payment and booking records: six years, to meet tax and accounting obligations.
6. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected (rectification);
- have your data erased;
- object to processing based on our legitimate interests;
- restrict processing in certain circumstances;
- receive your data in a portable format (portability);
- withdraw consent at any time, where we rely on consent.
To exercise any of these rights, email hello@theoctetclub.com. We will respond within one month.
7. Deleting your account
You can delete your account at any time from within the app under Settings, or by emailing hello@theoctetclub.com from the address registered to your account. See Delete account for details.
8. Security
We use encryption in transit, access controls and reputable providers to protect your data. No system is perfectly secure, and we will notify you and the regulator of a serious breach where the law requires.
9. Complaints
If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
10. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed, and we will tell members about significant changes.