Privacy Policy

Last updated 28 September 2026

Who we are

Gorse & Grain Restaurant Ltd (“Gorse & Grain”, “we”, “us”) runs the restaurant and bar at Mallow Golf Club and this website, gorseandgrain.com. We are responsible, as the “controller”, for the personal information described in this policy.

You can reach us at Gorse & Grain, Mallow Golf Club, Ballyellis, Mallow, Co. Cork, P51 FX53, on (022) 21145 ext. 4, or through the general enquiry form.

Information you give us

When you use our booking, functions or general enquiry forms, we collect:

• your name, email address and phone number;
• your booking details (date, time and number of people), or your event details (type of event, number of guests, preferred date and the packages you’re interested in);
• anything you write in your message.

If you tell us about allergies, dietary needs or other health information, we use it only to cater for you safely and share it only with our kitchen team. Please don’t include more than we need.

We may also note details when you phone us or call in, for example to take a booking.

How we use it, and why we’re allowed to

• To reply to you and manage your booking or event. This is needed to take the steps you’ve asked for before, and while, you book with us. For general enquiries, it’s in our legitimate interest to answer the people who contact us.
• To cater for allergies and dietary needs. We rely on your explicit consent, which you give by telling us. You can withdraw it at any time, although we may then be unable to cater for you safely.
• To keep our website and forms secure and free of spam. This is in our legitimate interest; see “Keeping our forms safe” below.
• To understand how our website is used, only if you accept analytics cookies. We rely on your consent; see “Website analytics” below.
• To meet our legal obligations, such as keeping accounting records for events you pay for.

We don’t use your information for marketing unless you’ve separately asked us to, and we don’t make decisions about you by automated means.

Keeping our forms safe

To stop spam and abuse, our website checks each form submission automatically. As part of this it turns your internet (IP) address into a scrambled, one-way code and counts how often the forms are used from that address. The code can’t be turned back into your IP address, and the counts delete themselves within two days. A hidden field and a short timer help filter out automated spam.

Our systems keep technical logs for 30 days to help us fix problems. They record the type of enquiry and whether it was sent, but not your name, contact details or message.

We use secure (HTTPS) connections and limit access to your information to the people who need it.

Who we share it with

We don’t sell your information. We share it only with:

• Amazon Web Services (AWS), which hosts our website and sends enquiry emails for us. Our website’s systems run in AWS’s Ireland region, and pages are delivered through AWS’s worldwide network, which uses your IP address to send each page to you.
• Google, which provides the email account where we receive enquiries.
• Google and Microsoft, which provide our website analytics (Google Analytics and Microsoft Clarity), only if you accept analytics cookies.
• Mallow Golf Club, only if your enquiry involves golf at the club (for example tee times for a society day), and only the details they need.
• Authorities or professional advisers, where the law requires it.

When you visit our website, your browser also loads our fonts from Google Fonts and, on our Visit page, a map from Google Maps. Google receives your IP address when this happens and may process it in the United States. You can read Google’s privacy policy.

Where information is transferred outside the European Economic Area, these providers protect it with safeguards approved under data protection law, such as the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

Website analytics (only if you accept)

If you accept analytics cookies, we use two tools to understand how people use our website so we can improve it:

• Google Analytics gives us statistics such as how many people visit, which pages they look at, and how they found us (for example through a search engine or social media). Google Analytics doesn’t store your IP address, and we’ve switched off Google’s advertising features.
• Microsoft Clarity shows us how people scroll and click (as heatmaps) and replays of visits, with anything typed into our forms hidden from us.

Both also record technical details such as your type of device and browser, your approximate location and the page you came from. They don’t tell us who you are, and we don’t combine this information with your enquiries.

Google and Microsoft may process this information in the United States under the safeguards described above. You can read how Google uses information from sites that use its services and Microsoft’s privacy statement. If you don’t accept, neither tool is loaded. You can change your mind at any time with the Cookie settings link at the bottom of every page.

How long we keep it

• Enquiry emails: until your enquiry, booking or event is finished, and then no longer than 12 months, unless we need them for an ongoing booking or event or the law requires us to keep them (accounting records for events you pay for are kept for six years).
• Spam-protection counts: deleted automatically within two days.
• Technical logs: 30 days.
• Analytics (only if you accept): Google keeps detailed Google Analytics data for up to 14 months, and Microsoft keeps Clarity data for up to 13 months (replays of visits are normally deleted after 30 days).

Cookies

We ask before using any cookie that isn’t strictly necessary, and we never use cookies for advertising.

• gg_consent remembers your cookie choice for six months. It’s strictly necessary and holds no personal information.
• Google Analytics’ cookies (_ga and _ga_YF845SM48B) are set only if you accept analytics cookies. They tell visits from different browsers apart, and last up to two years.
• Microsoft Clarity’s cookies (such as _clck and _clsk) are set only if you accept analytics cookies. They recognise a returning browser and link the pages of a visit together, and last up to a year.
• Before the website launches, anyone given a preview link gets one cookie, gg_preview, which lets them see the site for 30 days. It holds no personal information.
• The Google Maps map on our Visit page may set Google’s own cookies. Google explains how it uses cookies.

You can change your choice at any time with the Cookie settings link at the bottom of every page.

Your rights

Under data protection law you have the right to:

• ask for a copy of the information we hold about you;
• ask us to correct it or delete it;
• ask us to restrict how we use it, or object to us using it;
• ask for it in a format you can take elsewhere;
• withdraw your consent at any time, where we rely on consent.

To use any of these rights, ring us on (022) 21145 ext. 4, send a general enquiry, or write to us at the address above. We’ll reply within one month, and we may need to confirm who you are first.

If you’re unhappy with how we’ve handled your information, please tell us so we can put it right. You can also complain to the Data Protection Commission at www.dataprotection.ie, or 21 Fitzwilliam Square South, Dublin 2, D02 RD28.

Children

Our website and forms are meant for adults. If you’re under 16, please ask a parent or guardian to contact us for you.

Changes to this policy

We may update this policy, for example if our website or services change. The date at the top shows when it was last updated.