What do we mean by our privacy policy?

This privacy policy is a document that publishes the way that we, OMH Prop Co Group Limited including (but not limited to) our other associated companies, our subsidiaries, holding company, our affiliates, operating companies, our operating brand(s), trading name(s) such as Suburb, Suburb Bar & Restaurant, Suburb Wine, Suburb Beer, Suburbfood and Suburb Express including, hereinafter referred to as ‘us’, and/or ‘we’ (where context provides), gather, hold, communicate, and manage your information. We fulfil a legal requirement to protect your ‘right to privacy’ and our responsibilities as a business. 


You have the right to be informed about the collection and use of your personal information. This is a requirement of the data protection regulations and our privacy policy provides you with the information relating to how we lawfully use your information; the purpose for which we use your information; and the manner in which your information is controlled and remains secure, giving you an opportunity to review and object to how your information is being processed. 


We are the controller for the personal information which we process, unless otherwise stated. Should you have any questions relating to the use of your information please write to us at our registered address, OMH Prop Co Group Limited, Steel City House, 2 West Street, Sheffield, S1 2GQ. 


We aim to remain open about the information we are collecting about you, why it is needed, how it is being processed and who has access to it.
This policy provides you with all the information necessary to ensure that you retain the confidence that your personal information is protected from misuse and is being used and treated as you would expect.

This policy will cover the Information relating to us, including how to contact us, our commitment to you, the information we hold about you, how we collect your information, why and with who we sometimes share your information, how we use your information, how we protect your information, how long we keep your information and finally your right to privacy.
References in this notice to our operating company and/or trading name ‘Suburb’ (and/or its various derivatives), ‘we’, ‘us’ or ‘our’ are too references to our holding company OMH Prop Co Group Limited – which is a limited company registered in England and Wales under Company Registration number 15862613 which uses the prefix ‘Suburb’ as a trading name in affiliation with our operating companies from time to time.

OMH Prop Co Group Limited is registered with the Information Commissioner’s Office under the registration number ZC073607.

Our commitment to you
We, together with our subsidiaries and other associated companies are committed to:

• Valuing the personal information entrusted to us and making sure we respect that trust; 

• Going further than just the law when it comes to handling personal information and adopting good practice standards. We always adopt what common sense dictates. We will be open with individuals about how we use their information and whom we share it with. 

• Considering and addressing the privacy risks first when we are planning to use or hold personal information in new ways making it easy for individuals to access and correct their personal information.
• Keeping personal information to the minimum necessary and deleting it when it’s no longer needed.
• Having effective safeguards in place to make sure personal information is kept securely and does not fall into the wrong hands.
• Providing training to staff who handle personal information and treating it as a disciplinary matter if they misuse or do not look after personal information properly.
• Putting appropriate financial, technical and protective measures in place when looking after personal information to ensure that we can live up to our promises.
• Regularly checking that we are living up to our promises and reporting on how we are doing.

The information we hold about you

Personal information is any information that relates to or can be related back to you. This can include your name, contact details or any other information we gather as part of our relationship with you. 


The information we hold can be categorised into several groups. We refer to these as ‘information categories’. These categories cover all the information requirements needed to provide you with the various products and services offered by OMH Prop Co Group Limited.

These categories are:

Who you are: such as name, age, identification or gender.
Where you are: such as your home, work or email address.
How you pay: such as your bank details and payment history.
What you have: such as the products and services you have or had with us.
Where you have been: such as information you have accessed or websites visited.
What you have accessed: such as system logs, IP addresses, networks accessed or CCTV images.
What you need: such as your marketing preferences.
Where you have worked (in case you are a candidate not a customer): such as your CV, covering letter and references.
What we require (in case of staff members and/or candidate for work): such as health records, sexual orientation, religion and ethnicity. The collection and use of this information are subject to stricter controls and its use remains limited.

On occasions, we may require information outside of the categories listed above, which will often require your consent; thus we will notify you of this at the relevant time before its collection or use. We may also receive this information from a third party, upon which we may not have received direct consent from you but will have been provided with the necessary evidence from the third party on its lawful processing. This is classed as in-direct collection, which will be covered below.

How we collect your information

The majority of personal information we process is provided directly by you, for one of the processing activities we have listed herein above in the; ‘how we use your information section’. In addition to this, there are other multiple collection methods used by us, which are dependant upon the types of information categories in question. These methods are:

We may collect information from public registers or from other freely available resources such as; Companies House, LinkedIn, job sites, directory listings, electoral databases, social media and general internet searches. Given its nature, we cannot guarantee how the information contained on these public registers has been obtained or who has access to it – (Research collection).
As we mentioned above, this method of collection applies when you are providing us with the information directly. This can be either; over the phone, in person, via our website surveys, or job applications, during an event whereby a business card or a signing in sheet is provided, or on a form or questionnaire and/or simply through postal or email communication responses (Direct collection).

We may collect information based on your access/browsing habits on platforms such as our website(s). More information on this can be found within our cookie policy. Additional information, such as; usernames and passwords, marketing preferences or system specifications may be captured – these are based solely on the types of products/services or interactions we have with you so may not always be relevant and as such will not be captured (Technical collection).

We may collect information based on interactions with other parties. This includes activities such as recruitment; consultancy, complaints, ID checks and our online landing pages and/or each of them, including our website administration (In-direct collection).

This method relates to information collected to satisfy any legal requirement such as; data incidents (breach notification), the prevention of criminal/fraudulent activity, HMRC matters or freedom of information requests etc. We may collect information about criminal convictions and offences, when it can be demonstrated that we require the information for legal purposes, such as ‘background checking’ (Legal collection).

How we use your information – General

We will only process (i.e. use) your information where we have a legal and proportionate basis to do so. This will be in accordance with our ‘commitments to you’ and our legal requirements.
The legal basis for ‘use’ will form at least one of the following categories:

Your consent: This basis is used when we have provided you with a choice on how your data is used and you agree and consent to how we can use your data as we have described for that specific purpose.

Our legitimate interests: This basis is used when we feel it is within our own interests to use your information, in a lawful capacity by taking both your ‘right to privacy’ and the needs of the business (in delivering our services to you) into consideration. We will never use your information when our own interests supersede your overall right to privacy or the legal basis for which we can process your information. If you have any concerns relating to how your information is used, please contact us immediately. We may use your information on more than one legal basis (or marketing commercial basis), dependant on its expected or intended use. The descriptions below provide an overview of the types of information collected, their use and the legal basis it relies upon.

Direct marketing: we will never send ‘direct marketing’ communications to you unless your subscriber preference allows it. We maintain a concise subscriber preference database covering all customers whose information we hold. This database contains the legal basis upon which, and the individual subscriber preferences upon which, all direct marketing communications are acted upon. Under no circumstances are mailings communicated or your information used outside of these purposes. Should activities be carried out in contradiction to this, we will classify this as an ‘incident’. All incidents are treated seriously and responded to swiftly taking our resources into account. We categorise the risks based on the severity of the incident and the possible risk(s) to you or other customers. Details of the incident may be communicated to you or be made public.

To unsubscribe from direct marketing communications, we provide several options; such as following the embedded links on any direct marketing mailing to access your subscription preferences; or by writing to our registered office at OMH Prop Co Group Limited, Steel City House, 2 West Street, Sheffield, S1 2GQ.

If you accept and subscribe to direct marketing communications, the mailings sent to you will be designed/created by us, but its communication will be made by a third-party undertaking marketing work for us. These third-party marketing companies are expected to comply with our professional rules regarding marketing. They provide direct marketing solutions to us and are required to meet the responsibilities as set out in this privacy policy.

OMH Prop Co Group, do not share, allow access to, or sell your information to third parties for additional marketing purposes, unless express consent is obtained from you.

Recruitment

Applications for all vacancies with us are managed jointly by our internal recruitment team and by professional third-party recruitment agencies who act on our behalf and in accordance with this privacy notice and your right to privacy.

Third party recruitment agencies will be expected to collect career details from you, as per our information category definition and these will be made available to both them and our recruitment team, for the shortlisting, interviewing, vetting and on-boarding stages of the recruitment process.

Equal opportunities responses and other sensitive information (whilst voluntary), will not affect/impede your application. The same will not be made available outside of its permitted use. It will be used solely for the purposes and monitoring of equal opportunities statistics. We will not share any information provided to any third parties for marketing related activities. We only use your information to update you as to the progress of the application and to assess your suitability for the role. We only capture the information required to progress an application. We process information only for as long as is necessary. As part of this activity, you may be asked to participate in a suitability/competency test(s), fulfil a personality questionnaire or attend an interview. Any information captured at this stage will be retained by us and may contain handwritten notes, scores/ratings and/or personal opinions.

If you are unsuccessful at any point during the application process, you will be asked if you’d like your details to be retained on file as part of our ‘talent pool’ for a period of six months. Individuals within our ‘talent pool’ will be provided with details of other vacancies deemed suitable. If you object, this information will be removed from our systems as requested.

Pre-employment checks will be carried out at any point prior to your interview and once a conditional offer of employment has been made. We are required by law to ensure that we can confirm the identity of our staff, including their right to work and to seek assurances as to their trustworthiness, qualifications, integrity and reliability.

Social media/contact

When you call us our telephony systems will automatically collect and display your calling line identification (CLI) information. We use this information to help improve the efficiency and effectiveness of our call handling.

We use transport layer security (TLS) to encrypt and protect email traffic. If your email service does not support TLS, you should be aware that any emails we send or receive may not be protected in transit.

We will also monitor any emails sent to us, including file attachments, for viruses or malicious software. Please be aware that you have a responsibility to ensure that any email you send is within the bounds of the law.

Protection of your information

We apply the highest standards of security when it comes to hosting and protecting your information. We have adopted policies and have technical measures in place to protect your personal data against unauthorised access, accidental loss, improper use and improper disclosure. All of our employees and any third parties that we engage to process your personal information, are obliged to respect the confidentiality of your information and thorough due-diligence checks are carried out. We do not sell, rent, distribute or otherwise make personal information commercially available to any third party, except as described in this policy or with your prior permission.

We are continually improving the resilience, security and adaptability of our IT Infrastructure and as such, working towards the achievement and maintenance of best practice standards relating to information security and cyber essentials. All activities which require the use of your personal information, will be formally assessed for risk(s) relating both to the protection of your rights and freedoms to privacy, and the requirements of us as a data controller. This risk management process will indicate any potential issues relating to the security, lawful handling or controls around the protection of your information. Only activities which are deemed to satisfy these requirements are in use across our systems.

How long do we keep your information

We will only use/store your information for as long as we are permitted to do so. Often this is based on the purpose upon which we collected the information in the first instance.
We have a retention policy which ensures data is kept only for as long as it is needed and to satisfy all statutory or other legal obligations regarding the retention of such records. We will only retain your personal information for as long as is necessary to fulfil the purposes we collected it for.

In some circumstances we may anonymise your personal information (so that it can no longer be associated with you); this can be for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

Your right to privacy & no fees to exercise your privacy rights

We respect your right to privacy and will act in accordance with the latest privacy laws to ensure we meet our underlying commitment to you, as set out by this policy. Further information relating to your rights can be found on the Information Commissioners Office website.

In summary, you have the right to know how your Information is processed by us; the right to obtain copies of the information we hold (including how it’s processed and by whom); the right to correct any mistakes made to your information; the right to request that your information is deleted (in certain circumstances); the right to object if you feel your information is not being processed securely or lawfully; the right to restrict the use of your information in specific areas such as ‘marketing’ communications; and the right to know how decisions (which are or are not automated) are made.

Please contact us immediately should you wish to exert any of these rights.

No fees are due to exercise these rights, unless they are deemed to be excessive, spurious or repetitive, in which case we would contact you directly to discuss the matter further.

Contact us – General

We will receive post at our registered address at OMH Prop Co Group Limited, Steel City House, 2 West Street, Sheffield, S1 2GQ for data protection enquiries. If you would like further information relating to this privacy policy, or wish to log a complaint, report an incident, or request the information that we hold about you; or for any other data protection related query – please write to us at our registered address, OMH Prop Co Group Limited, Steel City House, 2 West Street, Sheffield, S1 2GQ.

It is important that the information we hold about you remains accurate at all times. Please keep us informed should any of your details change using the address above.
For general enquiries, please allow up to 21 working days for a response.

You always have the option to raise all concerns directly with the Information Commissioners Office, whether you’ve raised the matter with us already or not. This is your right.

Information requests & subject access request

You have the right to access/request the information that we holds about you. This is often referred to as subject access request. You can make a subject access request in person, verbally or in writing. Subject access requests help you to understand how and why we are using your data and to check that it is being handled lawfully and is acceptable to you.

We have 30 days to respond/fulfil your request. There is no fee for this service.

Information requests will be responded to within the regulatory guidelines, unless the complexity or volume of information requested impacts upon these timescales. In such cases, we will notify you directly to discuss completion dates.

Incidents & complaints

Incidents and/or complaints relating to our use of controls around your personal information are taken very seriously and we encourage you to bring to our attention, anything which you feel is unfair, misleading or inappropriate.

An incident can be anything from, failure to notify you of an activity in which your data is being used, to the loss of personal information relating to you; the vulnerability or potential misuse of personal information relating to you; or unlawful access or damage to your personal information.

We have the responsibility to coordinate and ensure that each matter is brought to its sensible conclusion within a sensible timeframe and in accordance with the directions set out in this policy.

We are required by law to inform the Information Commissioners Office (ICO) and other interested parties – when an incident or complaint causes significant damage(s), upset or discomfort to you.

On occasion, we may need to request further information from you in order to confirm your identity, exercise your rights, or to ensure we possess the necessary information to investigate the matter in hand. Any and all information we capture at this stage will be treated in the same manner as set out from within this privacy policy. Notifications to the ICO or other interested parties may require further communication of your personal information. This information will only be used for the purposes of the notification in question and will not be processed by any other means. Anonymisation will be used when possible and/or when it is deemed suitable such as to comply with a legal demand and/or a court order.

To ensure that we prevent repeated incidents involving personal information, extracts from incidents or complaints raised will be used as case studies to strengthen corrective actions and build a better privacy practices for the business. These case studies contain no personal information and any references to individuals will be removed. Phrases such as ‘customer’ or ‘employee’ will be used as substitutes and as appropriate.

Privacy update

This privacy policy was first published on 29/07/2024 and it is aligned to the latest legal requirements of GDPR regarding the processing of personal data and on the movement of such data. This notice is maintained by us and is subject to a periodic review.