The small print · Maison Carlton
Privacy policy
How Maison Carlton collects, uses and looks after your personal information: when you enquire, reserve, celebrate, join the club, or simply read this site.
- Last updated 8 October 2026 TBC
- Version 1.0
- About 15 minutes to read
Start here
The short version
- What we collect. What you tell us, such as your name, contact details and the details of your event or reservation, and a little about how you use this site.
- Why. To reply to you, plan and run your booking, take payment, keep the house safe and, if you have asked, send you news.
- Who sees it. Our team, and a few companies that help us run the house, such as our website host, our email and our payment provider. We never sell it.
- How long. Only as long as we need it: most enquiries for two years, and booking and payment records for six years, because tax law requires it.
- Your say. You can ask to see, correct or delete what we hold, or object to how we use it. You can stop our marketing at any time.
- A concern? Tell us first at privacy@maisoncarlton.com TBC. You can also complain to the Information Commission (the ICO).
Contents
1Who we are
One company runs Maison Carlton and everything in it.
Maison Carlton is the events house, cocktail bar and private members’ club at 3 Carlton Crescent, Southampton. Bar Nocturne, Club Nocturne, Maison D’Or, Orchidée and Atelier are all part of it.
Maison Carlton is run by Property Wealth Investors (SPV) Ltd TBC, a company registered in England and Wales under number 10351642 TBC, with its registered office at 3 Carlton Crescent, Southampton SO15 2EY. In data protection law we are the controller of the personal information this policy describes: we decide why and how it is used. We are registered with the Information Commission (the ICO) under number TBC.
No.4 Carlton Boutique Hotel, next door at 4 Carlton Crescent, is run by TBC. If you book a room there, the hotel’s own privacy notice also applies.
- privacy@maisoncarlton.com TBC
- Phone
- +44 (0)23 8110 2222
- Post
- Privacy, Maison Carlton, 3 Carlton Crescent, Southampton SO15 2EY
We have not appointed a data protection officer. A member of our management team looks after data protection and reads every message sent to the address above.
2What this policy covers
This website, and every way you deal with the house.
This policy explains what happens to your personal information when you:
- use this website, maisoncarlton.com;
- send us an enquiry, ask for a brochure, or call, email or message us;
- reserve a table at Bar Nocturne or a table for afternoon tea;
- plan a private event, a wedding celebration or an exclusive hire with us, or come to one as a guest;
- ask about or join Club Nocturne;
- sign up for news from the house; or
- visit the house, work with us or apply for a job with us.
It does not cover other websites we link to, such as no4carlton.com, Instagram, LinkedIn or Google Maps. They have their own policies.
3What we collect
Mostly what you choose to tell us.
What you tell us
- Contact details: your name, email address and phone number, and a postal address for invoices or the club. If you are booking for work, your company and job title.
- Your occasion: the date, the number of guests, the room or package you are interested in, timings, menu choices and anything you write in a message.
- Reservations: the date, time and size of your party, and any note you add.
- Payments: when you pay a deposit or a bill, or give a card to hold a reservation, your card details go straight to our payment provider. We never ask for your card number or security code on paper or by email. We see only the card type, the last four digits, the expiry date and whether the payment went through.
- Club Nocturne: what you tell us when you request an invitation and, if we invite you to apply, your application: your date of birth, home and business addresses, your business and role, its turnover and how long it has been trading, who referred you, and what you hope the club will bring you. On your first visit we check photo ID to confirm your age, and record only the type of document, the country that issued it, the last four digits of its number and its expiry date.
- Your preferences: whether you would like news from the house, and how you would like us to reply.
- Your guests: if you organise an event, you may give us your guests’ names, dietary needs or a seating plan. Please let them know, and point them to this policy.
Allergies, diets and access needs
Some of what you tell us may reveal something about your health or your beliefs: a food allergy, a medical diet, a halal or kosher meal, or a need for step-free access. The law treats this as special category information. We ask for it only so we can look after you on the day, and we use it for nothing else. We ask your permission for this in words: a tick on our forms, or a yes when we ask on the phone. If you give us a guest’s needs, please make sure they have agreed. You can withdraw your permission at any time, although we may then be unable to cater for you safely. In the house, only the people preparing or serving your food, or looking after you, see it. We delete it within three months of your visit TBC, unless something happened on the day and we need a record in case of a claim.
When you use this website
- Like every website, ours receives technical information such as your IP address and the type of browser you use, so it can deliver pages and keep the site secure.
- If you say yes to analytics cookies, Google Analytics records how the site is used: which pages are visited, for how long, and roughly where in the world visitors are. We use the reports to see how the site is used, not to identify you.
- If you say yes to marketing cookies, we note which campaign or advert brought you to the site and send it with any enquiry you make.
- When you fill in our enquiry form, your answers (never your contact details) are kept in your browser until you close the tab, so nothing is lost if you go back a step.
Our cookie policy lists each cookie and what it does.
What we receive from others
- Venue directories and booking platforms, such as Tagvenue, HeadBox or Hire Space TBC, pass us your enquiry if you send it through them.
- Our partners may tell us about a booking you have made with them, for example Brides of Southampton for the bridal tea TBC.
- Google, if you reserve a table through Reserve with Google.
- No.4 Carlton, next door, if you stay there and take breakfast in Maison D’Or, or reserve a table through the hotel’s reception TBC.
- Event organisers may give us the names and needs of their guests.
- A Club Nocturne member may suggest you to us, and when we consider a request to join we may read what is publicly available about your business, such as its website TBC.
- Our payment providers tell us whether a payment succeeded.
When you visit
- Our CCTV records the entrances and the public rooms, never the washrooms or the bedrooms next door, to keep guests, staff and the house safe TBC.
- We sometimes photograph the rooms during events for our website and social media. We only publish a photograph in which a guest can be recognised if that guest has agreed.
Children
This website is for adults, and bookings are made by adults. Children are welcome at afternoon tea and at many private events, and we hold a child’s details only when a parent or an organiser gives them to us for a booking, such as a name for a place card or a dietary need. We use them for nothing else. You must be 18 to drink in Bar Nocturne and 25 or over to join Club Nocturne.
4How we use it, and why we may
The law lists the reasons a business may use personal information. Here are ours, use by use.
| What we do | The reason the law allows it |
|---|---|
| Reply to your enquiry, send a proposal and arrange a viewing | Steps you ask us to take before a contract. If you enquire for an organisation, our legitimate interest in answering business enquiries |
| Take, change and manage a reservation or a booking, and run your event on the day | Our contract with you |
| Cater for allergies, diets and access needs | Your explicit consent |
| Take deposits and payments, and issue invoices and refunds | Our contract with you, and our legal duty to keep accounts |
| Consider a request to join Club Nocturne, meet you, check your age and run your membership | Steps you ask us to take before a contract; then our contract with you; and our legitimate interest in running a private club safely and within our licence |
| Send you news from the house by email | Your consent or, if you have booked with us and did not say no, our legitimate interest in telling you about similar occasions (section 5) |
| Send you the brochure you asked for | Our legitimate interest in sending what you requested |
| Ask how your visit or event went, and invite a review | Our legitimate interest in improving what we do |
| Photograph the rooms during events for our website and social media | Our legitimate interest in showing the house. We ask before we publish anyone who can be recognised |
| Keep this website secure and working | Our legitimate interest in running a safe website |
| Count visits with Google Analytics, and see which campaigns bring enquiries | Your consent, given in our cookie settings |
| Keep the house, our guests and our staff safe, including with CCTV TBC | Our legitimate interest in preventing and detecting crime |
| Deal with complaints, and establish or defend legal claims | Our legitimate interests, and our legal duties |
| Consider a job application | Steps you ask us to take before a contract |
| Work with suppliers, partners and the press | Our legitimate interest in running the business |
| Meet our duties under tax, licensing and other law | Legal obligation |
Where we rely on legitimate interests, we have weighed them against your interests and rights, and you can object at any time (section 10). You do not have to give us your details, but we need them to reply to an enquiry or to hold a booking. We do not make decisions that significantly affect you by automated means alone.
5News from the house
Only if you want it, and easy to stop.
Now and then we send emails about new menus, the Christmas dates, evenings in Nocturne and events at the club. We send them only:
- if you have ticked the box to say yes; or
- if you have booked with us, and we gave you the chance to say no at the time and in every email since. Then we write only about occasions like the one you booked.
If you reached us through a directory, a booking platform or Reserve with Google, we send news only if you have said yes to us.
Every email has an unsubscribe link, or you can write to privacy@maisoncarlton.com. When you unsubscribe, we keep your email address on a do-not-contact list so that we never write again by mistake. Our emails do not record whether you open them or which links you click TBC.
We do not buy mailing lists, we do not give your details to other businesses for their marketing, and we do not use your information to target you with advertising on social media TBC.
If you join Club Nocturne, the club calendar and members’ invitations come with your membership. Tell us if there are any you would rather not receive. Any other news reaches you only as this section describes, and we never pass your details to another company for its own marketing, No.4 Carlton included, unless you have said yes to that company by name.
6Who we share it with
Never sold. Shared only with the people who help us run the house, and only what they need.
We never sell your personal information.
Companies that work for us
These companies handle personal information for us, under contracts that require them to keep it secure and to use it only on our instructions.
| Who | What they do for us | Where |
|---|---|---|
| WP Engine TBC | Hosts this website, including what you send through its forms | UK and EU, with support from the US |
| Microsoft 365 or Google Workspace TBC | Our email, documents and the spreadsheet in which we log enquiries | UK, EU and US |
| Zapier | Copies new enquiries into our enquiry log, and alerts the events team by email and text message | US |
| Our email delivery service TBC | Sends the emails our website forms send you, such as the reply to your enquiry | EU and US TBC |
| resOS TBC | Manages table reservations for Bar Nocturne and afternoon tea | EU |
| Stripe, including through WooPayments | Processes card payments, and holds a card to guarantee a reservation | UK, EU and US |
| Mews TBC | Runs our tills and card payments in the house | EU |
| Mailchimp TBC | Sends our email news | US |
| Google (Analytics and Tag Manager) | Tag Manager loads our website tools but sets no cookies; Analytics counts visits, only with your consent | EU and US |
| CookieYes | Records your cookie choices | UK and EU TBC |
| WebNi | Builds and maintains this website, and may see form entries while doing so | Serbia TBC |
Stripe also uses some payment information for its own purposes, such as preventing fraud, under its own privacy policy.
Others, when you ask or when the law requires
- Our accountants, lawyers and insurers, for our accounts, for advice and for claims.
- No.4 Carlton, next door, when you ask about bedrooms for you or your guests TBC.
- Suppliers you choose for your event, such as a florist, a photographer or musicians. We pass on only what they need, such as the date, the timings and a contact name.
- Brides of Southampton, for a bridal tea you book with them TBC.
- The directory or booking platform you contacted us through.
- The police, HMRC, the licensing authority, the courts and other public bodies, when the law requires it or to prevent or detect crime.
- Anyone who buys all or part of our business, who would have to keep using your information as this policy describes.
7Information that leaves the UK
Some of our providers work from abroad. The law’s protection travels with your information.
Some of the companies above store or access information outside the UK, mainly in the European Economic Area and the United States. When they do, the transfer is protected as UK law requires. Either the UK government has approved the country, as it has the EEA, and the United States for companies that have joined the UK–US data bridge; or the company has signed the UK’s approved contract terms, the International Data Transfer Agreement or the Addendum to the EU clauses. Ask us if you would like the details.
8How long we keep it
As long as we need it, then it goes.
| Information | How long we keep it |
|---|---|
| Enquiries that do not become bookings, and brochure requests | 2 years after we were last in touch TBC |
| Reservations at Bar Nocturne and for afternoon tea | 2 years after your visit TBC |
| Bookings, contracts, invoices and payment records | 6 years after the end of the financial year they relate to, as tax law requires |
| Allergies, diets and access needs; guest lists and seating plans | Deleted within 3 months of your visit or event TBC, unless we need a record because of something that happened on the day |
| Requests to join Club Nocturne that do not go ahead | 12 months TBC |
| Club Nocturne membership records | For your membership, then 6 years |
| The record of your ID check | For your membership, then 12 months TBC |
| Email news | Until you unsubscribe. Your address then stays on our do-not-contact list |
| CCTV recordings TBC | 30 days, unless we need a recording because of an incident |
| Visit-level data in Google Analytics | 2 months, after which we keep only totals |
| Job applications | 6 months after the role is filled, unless you join us TBC |
| Privacy requests and complaints | 3 years after we close them TBC |
After that, we delete the information or make it anonymous.
9How we keep it safe
Fewer people, fewer places, locked doors.
Only the people who need your information can see it. Our systems use encryption in transit (this website runs on HTTPS), two-step sign-in and regular updates. Card details never touch our own systems: they go straight to our payment providers, which meet the card industry’s security standard, PCI DSS. If something ever goes wrong, we will act quickly, and we will tell the ICO, and you, whenever the law requires.
10Your rights
Yours to use, free of charge.
You have the right to:
- see what we hold about you, and have a copy;
- correct anything that is wrong or incomplete;
- have it deleted;
- restrict how we use it while a concern is looked into;
- object to how we use it (see below);
- take it with you: receive what you gave us in a format you can pass to another organisation; and
- withdraw your consent wherever we rely on it. This does not affect what we did before.
Your right to object. You can object at any time to our using your information where we rely on our legitimate interests (section 4). We will stop unless we have compelling reasons that outweigh yours, or need the information for a legal claim. You can also tell us to stop sending you marketing at any time, and we always will.
Some rights apply only in some circumstances. For example, we must keep invoices for six years even if you ask us to delete them. If we cannot do what you ask, we will explain why.
To use any of these rights, use the form below or write to privacy@maisoncarlton.com. It is free. We may ask you to confirm who you are, and the month starts once you have. If you ask for a copy and we need to know which information you mean, we will ask, and the month pauses until you tell us. We will make a reasonable and proportionate search, and reply within one month, or tell you within that month if a complicated request, or several requests, need up to two months more.
11Questions and complaints
Tell us first. If we do not put it right, the regulator will listen.
If you are unhappy with how we have used your information, please tell us first, with the form below or by writing to privacy@maisoncarlton.com. We will acknowledge your complaint within five working days TBC, look into it properly, keep you informed and tell you the outcome.
You can also complain to the UK’s data protection regulator, the Information Commission, which is still known as the ICO: ico.org.uk/make-a-complaint, or call 0303 123 1113.
Make a request or a complaint
Tell us what you would like, and the person responsible for data protection will reply.
Thank you. Your request is with us.
Your reference is PR. Please quote it if you write to us. We will acknowledge your request within five working days and reply within one month.
12Cookies
The necessary ones are always on. The rest wait for your yes.
We use cookies and similar technologies. Those that keep the site working are always on; everything else waits until you say yes. Our cookie policy explains each one, and you can change your choice at any time in .
13Changes to this policy
The date at the top always tells you.
We update this policy when what we do changes, and the date at the top shows when it last changed. If a change matters to you, such as a new use of your information, we will tell you by email if we have your address.
Version 1.0, published 8 October 2026 TBC.
The rest of the small print
Your information: privacy@maisoncarlton.com
Bookings: events@maisoncarlton.com
+44 (0)23 8110 2222 · 3 Carlton Crescent, Southampton SO15 2EY