Get your
burrito fix

Privacy Policy

Our Privacy Policy at Tortilla Mexican Grill PLC

At Tortilla, we are deeply committed to safeguarding your privacy and protecting the personal information you share with us. This policy outlines how we collect, store, and utilize your data when you visit our restaurants, browse our website, or engage with our digital services—including our loyalty programs, feedback platforms, and "click & collect" features.

As the primary data controller, Tortilla Mexican Grill PLC (Registered in England and Wales, No. 13511888) ensures that all data processing is conducted transparently and in full compliance with current data protection soulutions. We collect information—such as contact details and transaction history—to improve your dining experience and provide personalized rewards. We maintain rigorous security protocols to prevent unauthorized access and ensure your information remains confidential.

Furthermore, this policy serves to inform you of your statutory rights. Under applicable law, you have the right to access, rectify, or request the deletion of your personal data at any time. For inquiries or to exercise these rights, you may contact our team at our registered office: 142-144 New Cavendish Street, London, W1W 6YF. By using our services, you acknowledge the terms described herein as we strive to serve you better.

Information on how we use your personal data, along with the types of data we use and why we need to use this data have been listed below:

Payments

Types of Personal Data: Financial information: transaction amount, date, branch name & the last 4 digits of your card.

Why We Need This Data: We need this information to process your order

Why It Is Important: We need to process this data to enter into and perform contracts with you

Find Food Service

Types of Personal Data:Your GPS location and how far away you are from our restaurants

Why We Need This Data: To help you find our nearest restaurant

Why It Is Important: It is in our interests to help you find us easily

Analytics

Types of Personal Data: Your browsing details, including time of visit, how long you stay at each page and your interaction with
our website and app

Why We Need This Data: To ensure both our website and app are working as intended, and to continually improve these platforms

Why It Is Important:Where you have consented to analytics, it is in our interests to maintain and improve accessibility and functionality of our website and app

Marketing

Types of Personal Data: Your browsing details including other websites visited, browser and device details, IP address, other cookies stored on your device and your public social media information

Why We Need This Data: To carry out marketing campaigns and send you communications

Why It Is Important: Where you have consented to marketing, it is in our interest to send you marketing communications

CCTV

Types of Personal Data: Your static or moving imagery via CCTV surveillance in our restaurants

Why We Need This Data: To ensure your safety and security when you visit our restaurants, assist in the detection and prevention of crime and to abide by health and safety standards

Why It Is Important: It is in our interests to protect our customers and staff, and maintain health and safety standards in our restaurants

Customer Notices

Types of Personal Data: Your contact details

Why We Need This Data: To notify you of any important changes to our products, services and our organization

Why It Is Important: It is in our interests to provide you with notice of any changes to our products, services and our organization

In addition to the Personal Data that we collect directly from you (as described in the section immediately above this one), we also collect certain of your Personal Data from third party sources. These sources are broken down below, together with a description of whether they are publicly available or not.

Third party data source: Social Media sites

Publicly available? Yes

Category(ies) or other types of personal data received: Identity Data, Contact Data

Third party data source: Recruiters, CV search companies, background check providers and referees, including ATS

Publicly available? No

Category(ies) or other types of personal data received: Identity Data, Contact Data, Job Application Data

Third party data source: Analytics Providers

Publicly available? No

Category(ies) or other types of personal data received: Behavioural Data,Technical Data

Third party data source: Collectors of feedback – Reputation.com and any online surveys

Publicly available? No

Category(ies) or other types of personal data received: Feedback Data, Contact Data

Third party data source: Free Wifi login – Wireless Social

Publicly available? No

Category(ies) or other types of personal data received: Identity Data, Contact Data, Technical Data

Third party data source: Click & Collect system – Ritual

Publicly available? No

Category(ies) or other types of personal data received: Identity Data, Contact Data

Third party data source: Loyalty system – MCR

Publicly available? No

Category(ies) or other types of personal data received: Identity Data, Contact Data, Behavioural Data

We share your personal data amongst entities within the Tortilla family, and with third party companies providing services to us. Your personal data may be:

Transferred to third party organisations that provide services to us

We use third party information technology companies to support us in providing our services to you, and to help provide, run and manage our internal administrative systems. For example, we use service providers for payment systems, identity management, website hosting and management, data analysis, data back-up, security and storage services.

Transferred to government agencies and/or regulators

We may also transfer your data to government agencies or regulators to adhere to any legal requirements.

You have a number of rights with regards to your personal data. A list of these rights and how you may exercise them has been included below:

Rights to Access Personal Data and Right to Data Portability: You have the right to access your personal data at any point, and may make a request to do so either verbally or in writing. You also have the right to data portability, meaning you may request to receive your personal data in a standard use, machine readable format.

Right to Rectification of Personal Data: You have the right to request us to rectify any inaccurate or incomplete personal data we may have on you. If you make this request, we will update your personal data with the correct information provided.

Rights to Objection, Restriction and Erasure of Personal Data: You have the right to restrict how your data is being used, and the right to request us to delete your personal data.

Right to Withdraw Consent: In any circumstances in which we process data based on consent, you may withdraw your consent at any time.

Right to be Informed: You have the right to be informed about how we collect, use and retain your data, which is why we have set out this information within this policy. If you would like further information regarding your data, you may contact us at any time.

To exercise any of these rights, please send an email using the feedback form on this site and selecting ‘Data Request’ in the enquiry form. Depending on your request, we may ask for further confirmation of your identity or additional information to fulfil your request.

The Right to Complain to the ICO: If you wish to make a complaint to us about how we use or retain your personal data, please send an email using the feedback form on this site and selecting ‘Data Request’ in the enquiry form. You also have the right to lodge a complaint with the data protection authority. The relevant authority for the UK is the Information Commissioner’s Office (ICO). If you wish to file a complaint with the ICO, you may find the following information helpful: https://ico.org.uk/make-a-complaint/

Get your burrito fix

Privacy Policy

Our Privacy Policy at Tortilla Mexican Grill PLC

Get your
burrito fix