Privacy & Cookie Policy
Last updated: 25 October 2026
Template to review: this page describes the tools our website uses today. It is not legal advice. If something here doesn't match how we work, please tell us at hellodahhans@gmail.com.
This policy explains how Dahhan's Café & Food ("we", "us") looks after your personal information when you visit dahhanscafe.com, book a table, order, ask about catering, contact us, or reply to one of our adverts.
Who we are
Dahhan's Café & Food, Fountain House, Western Way, Exeter EX1 2DE. We are the data controller for the information described here.
Email: hellodahhans@gmail.com · Phone: 01392 759192
What we collect
- Table bookings: your name, phone number, email, date, time, party size, occasion and any notes you add.
- Online orders: your name, phone number, delivery address and postcode, the dishes you choose and any notes (for example allergies).
- Dahhans Passport: the card holder's name and email, your Passport reference, and when it was bought, activated or cancelled. Staff see the name when they scan your card.
- Catering enquiries: your name, phone, email, event date, guest numbers, event type, postcode and your message.
- Advert click reference: if you arrive by clicking one of our Google adverts, the click reference Google adds to the link (gclid, gbraid or wbraid) is sent with your booking, order or enquiry so we can tell which adverts bring in customers. It is only saved in your browser if you accept cookies.
- Technical data: device, browser and pages visited, collected through cookies and similar tools, only if you accept them (see Cookies).
- Messages: anything you send us on WhatsApp, by phone, email, or through a Facebook or Instagram lead form.
How we use it
- To confirm and manage your table booking, order or catering enquiry, and to contact you about it.
- To answer your questions.
- To understand how our website and adverts perform, so we spend less on adverts that don't work (only with your consent).
Our lawful bases are performing a contract with you or steps you ask for before one (bookings, orders, enquiries), our legitimate interests in running the café, and your consent for advertising and analytics cookies and for sharing booking/order details with Google and Meta for advert measurement (including the server-side copy described below). The cookieless measurement Google receives when you have not accepted relies on our legitimate interest in knowing, in total, how well our adverts work; it uses no cookies and no ad identifiers.
Cookies and similar tools
When you first visit, a bar at the bottom of the screen asks whether you accept advertising and measurement cookies. Accept and Reject are equally easy, and nothing is switched on unless you press Accept. You can change your mind at any time with the "Cookie settings" link at the bottom of every page, or here:
If you don't accept (or press Reject)
- Google: we use Google Consent Mode. The Google tag still loads, but it sets no cookies and reads none. It sends Google short "cookieless pings": that a page was viewed or a booking, order, phone tap or enquiry happened, the page address, the time, your browser type, your consent choice and, if you came from one of our Google adverts, the click reference in the link. Ad identifiers are removed. Google uses these pings only to estimate, in total, how many bookings and orders our adverts produce ("conversion modelling"). It cannot use them to recognise you across sites or to show you adverts. No email or phone number is sent.
- Meta (Facebook and Instagram): nothing at all. The Meta Pixel is not even loaded, and our server sends Meta nothing about you.
If you press Accept
- Google and Meta cookies are set and the tags below run normally.
- Enhanced conversions (Google): after a booking, order or catering enquiry, your email and phone number are scrambled (SHA-256 hashed) in your browser and sent with the conversion so Google can match it to an advert click.
- Server-side order and booking tracking (Meta Conversions API): when you place an order or book a table, our website server (hosted by Netlify) also sends Meta a copy of that one event: the order or booking reference, the value, the dishes ordered, the page address, your IP address and browser type, Meta's cookie ID for your browser, and your email and phone number hashed in your browser. Meta uses the reference to count the order once even if your browser blocked the pixel. This only happens if you accepted cookies, and never if you rejected them.
If you accept and later press Reject, we stop all of this and delete the Google and Meta cookies on this site.
| Tool | Who | What it does | Needs consent? |
|---|---|---|---|
| Google tag (Google Ads, ID AW-18318013504) | Google Ireland Ltd / Google LLC | Measures which Google adverts lead to bookings, orders, catering enquiries, phone taps and WhatsApp taps, and lets us show adverts to past visitors. After a booking, order or enquiry it can send your email and phone number, hashed (scrambled) in your browser, so Google can match the conversion to an advert click ("enhanced conversions"). | Yes for cookies and enhanced conversions. Without consent it sets no cookies and sends only cookieless pings with no ad identifiers (see above). |
| Google Analytics 4 (G-8JNG02SYTH, linked inside the Google tag) | Counts visits and pages viewed so we can see how the site is used. | Yes for cookies. Without consent it sends only cookieless pings, like the Google tag. | |
| Meta Pixel (1024233677366911) | Meta Platforms Ireland Ltd | Measures visits and actions (adding to basket, opening checkout, orders, bookings, catering enquiries) that come from our Facebook and Instagram adverts, and lets us show adverts to past visitors. After a booking, order or enquiry it can send your email and phone number, hashed in your browser ("advanced matching"). | Yes. The pixel is not loaded and nothing is sent until you accept. |
| Meta Conversions API (server-side, from our Netlify website server) | Meta Platforms Ireland Ltd | Sends Meta a copy of an order or table booking so it is counted once, as described above. | Yes. Only sent if you accepted cookies. |
dahhans_click (our own) | Us | Remembers a Google advert click reference for up to 90 days so a later booking can be linked to the advert. | Yes. Not stored at all unless you accept. |
dahhans_conv_fired, dahhans_conv_once, dahhans_ud_pending (our own) | Us | Stop one booking or order being counted twice, and keep your email and phone number in this browser tab for up to 2 hours, between the booking or catering form and the confirmation page, so they can be hashed and matched there. | Yes. Only stored if you accept. |
dahhans_consent (our own) | Us | Remembers your Accept/Reject choice for 180 days. | No (strictly necessary) |
| Basket, last booking, language and music settings (our own, in your browser's local storage) | Us | Keeps your basket, shows your booking confirmation, remembers English/Arabic and music on/off. | No (needed for features you ask for) |
You can also block or delete cookies in your browser settings. The site works without advertising cookies.
Who we share it with
We share information only with service providers who help us run the café and website. They may only use it to provide their service to us:
- Web3Forms (form delivery): booking, order and catering forms are sent to our email inbox through Web3Forms.
- Epos Now (our till): online orders are sent to our till so the kitchen can print them.
- WhatsApp (Meta): when you press "Send order on WhatsApp" or "Send booking on WhatsApp", WhatsApp opens with your details filled in, and the message is sent only if you press Send. WhatsApp handles it under its own privacy policy.
- SumUp and Revolut (payments and gift cards): payment and gift card links take you to SumUp or Revolut, who process your payment under their own privacy policies. We do not see your card details.
- postcodes.io: when you use the "Do we deliver to you?" checker, the postcode you type is looked up to check the distance. No other details are sent.
- Google and Meta: advert measurement as described in Cookies. Cookies, enhanced conversions, the Meta Pixel and the server-side copy of orders and bookings only with your consent. Without it, Google receives cookieless pings only and Meta receives nothing.
- Netlify also stores Dahhans Passport records (name, email, reference and status) so staff can check cards at the till.
- Netlify (website hosting) and Google Fonts (typefaces), which receive your IP address as part of loading the site.
We may also disclose information where the law requires it. We do not sell your details.
Adverts and lead forms
If you submit an instant form on Facebook or Instagram, Meta passes your answers to us. We use them only to contact you about your enquiry, such as confirming your table. Meta handles your data under its own privacy policy. You can manage how Meta uses your information through your Facebook and Instagram ad settings.
International transfers
Some providers (for example Google, Meta and Netlify) may process data outside the UK. Where they do, they rely on safeguards recognised under UK data protection law, such as the UK International Data Transfer Addendum or the UK-US Data Bridge.
How long we keep it
We keep booking, order and enquiry details only as long as needed to deal with them and for ordinary business and legal record-keeping, then delete or anonymise them. Dahhans Passport records are kept while the Passport is in use, as it is a lifetime card. Ask us to delete yours at any time. Details from advert lead forms are deleted when no longer needed for your enquiry. Advertising cookies last as set by Google and Meta (typically up to 13 months for Google and 90 days for Meta).
Your rights
Under UK data protection law you can ask us to access, correct or delete your information, restrict or object to how we use it, ask for a copy in a portable format, and withdraw consent at any time (for cookies, use the button above). To do any of this, email hellodahhans@gmail.com or call 01392 759192. You can also complain to the Information Commissioner's Office at ico.org.uk.
Children
Our adverts and forms are not aimed at children, and we do not knowingly collect information from anyone under 18 through them.
Changes
We may update this policy and will change the date above when we do.