Privacy Policy
Bonata · Last updated 13 October 2026
Bonata is a trading name of Citycenter Ltd, a company registered in England and Wales (company no. 14476301), registered office 254 Goldhawk Road, London W12 9PE.
This notice explains what Bonata receives about you, what it does with it, and the choices you have, whether you use the Bonata app, order at www.bonata.co.uk, or deal with Bonata through Places 360's own app or website.
Who does what
The Bonata app and Bonata's online ordering run on Places 360, a platform operated by Digit Places Limited (company no. 13863363). Two organisations are involved, and each is responsible for its own part.
- Places 360 runs your account. You sign in with a Places 360 account, and Digit Places Limited is the data controller for it. Places 360's privacy policy covers your account and what Places 360 collects to run the app, its websites and payments.
- Bonata is responsible for what it receives. Bonata is the data controller for the information about you that reaches it through Places 360, listed below, and for your choice about its marketing.
- Places 360 sends Bonata's marketing for it. When Places 360 sends you Bonata's marketing emails or notifications, it acts for Bonata as its processor: only on Bonata's instructions, under the data processing terms Bonata has agreed with Places 360 (UK GDPR Article 28).
What Bonata receives
- Your orders — what you ordered from Bonata, when and from which location, the name and phone number you give for the order, the address for a delivery, any note you add, and what you paid and whether it was paid. Card payments go through Stripe: neither Bonata nor Places 360 ever sees your full card number.
- Paying later by invoice — if you choose “Pay later — invoice”, Bonata also sees your company name and your account email (or, if your account has no email, its phone number) with those orders, so it can invoice you. If Bonata approves your company to pay later, it keeps your work email and company name on its list.
- Your activity with Bonata — your display name, a reference code used only at Bonata, and any stamps, rewards and offers you collect there, with dates. Bonata never sees what you do at any other business on Places 360.
- Your marketing choice — whether you said yes to Bonata's marketing, for which channel (email or notifications), and when and where you gave or withdrew it.
- Your email address, if you say yes to Bonata's marketing emails. Bonata's owners, and any staff it lets do marketing, can then see your account email so Bonata can send you news and offers. Otherwise Bonata doesn't see your account email, except on orders you pay later by invoice.
- Messages and ratings — if you write to Bonata through its page, it gets what you send, including the email address you give. If you rate a visit or an order, Bonata sees the rating, any note and the location, but never who you are.
A phone number you verify on your account stays with Places 360 and isn't given to Bonata, except on orders you pay later by invoice from an account with no email. The number you type on an order does go to Bonata, for that order, so it can reach you about it.
If you used Bonata's previous app
Bonata's app used to run on an older platform. When Bonata moved to Places 360, the accounts and order history of people who had placed an order with Bonata came across, so you can carry on where you left off:
- Your account — your name, your email address and, if you had one, your password (stored only in scrambled form, as before) became a Places 360 account you sign in to. If you already had a Places 360 account with the same email, it's that one.
- Your past orders — what you ordered from Bonata, when, where and for how much. You see them in the app under Earlier orders, and Bonata can see them, as it could before.
- Signing you in — the first time the new app opens on a phone that had the previous one, it reads the previous app's sign-in from that phone, exchanges it once for a Places 360 sign-in, and deletes the previous app's sign-in from the phone.
Nothing else came across: not your phone number, saved addresses, payment details, or any marketing choice you made in the previous app. Bonata only sends you marketing if you say yes to it on Places 360.
What it's used for, and why that's allowed
| What for | Lawful basis |
|---|---|
| Taking, preparing, delivering and invoicing your orders, and contacting you about them | Contract: the order you placed with Bonata |
| Keeping order and payment records | Legal obligation: UK tax law requires them |
| Running any loyalty card, rewards and offers you join at Bonata | Contract: the programme you joined |
| Sending you marketing emails, and offers as notifications | Consent: only after you say yes, and only on that channel |
| Bringing your account and past orders over from the previous app | Legitimate interests: you keep your account and order history when the app changes |
Under Places 360's business terms, Bonata may use what it receives only for the order or service it came with and for anything else you've agreed to, and may never sell or share it.
Marketing, and how to stop it
Bonata's marketing is opt-in, per channel: nothing is ticked for you, and you can change your mind at any time. You can say yes when you create your account in the Bonata app or at www.bonata.co.uk, when you claim an offer that's for subscribers, or later in Profile.
An email yes is not a notifications yes, and a notifications yes counts only in the Bonata app: you give it there, in Profile → Marketing → Offers as notifications. A yes you gave in the Places 360 app doesn't count in it, and the Places 360 app never sends Bonata's marketing as notifications.
The Bonata app also sends you notifications about your own orders and rewards at Bonata. Those aren't marketing and need no yes; you can turn the app's notifications off in your phone's Settings at any time.
To stop:
- In the app — Profile → Marketing, and switch Emails (or Offers as notifications) off. In the Places 360 app it's Profile → Marketing from venues → Bonata → Emails.
- From any email — every marketing email from Bonata has an unsubscribe link, and one click ends it.
- By telling Bonata — email paddington@bonata.co.uk.
Turning it off stops it straight away: your email leaves Bonata's customer list in Places 360 at once, and Bonata must stop sending you marketing. It takes nothing away: your loyalty card, your stamps and any reward you've already claimed stay yours. If your mailbox provider tells Places 360 you reported one of Bonata's emails as spam, that counts as unsubscribing.
How long it's kept
Your activity and orders with Bonata are kept while your account is active. Order and payment records are kept for the periods UK tax law requires, then deleted. Your marketing choices, and when you made them, are kept while your account exists, to show what you agreed to. Notes left with a rating are deleted after 12 months, and ratings after 24.
If you delete your account (Profile → Delete account), your profile, loyalty progress and marketing choices are deleted, and your identity is removed from Bonata's history. The order records Bonata must keep by law stay, without your name, phone number or address, and nothing in them points back to you.
Where it's kept, and who helps
All of this is held by Places 360, with your account, in London. The companies that help Places 360 run it, such as Stripe for payments and Resend for email, are listed in Places 360's privacy policy. If Bonata connects its own tools, such as a till or a receipt printer, your order details go to them under Bonata's instruction.
Your rights
You can ask Bonata for a copy of the information it holds about you, and ask it to correct it, delete it, limit how it's used, or give it to you in a form you can take elsewhere. You can object to how it's used, and withdraw your consent to marketing at any time; withdrawing doesn't affect what was done before.
Email Bonata at paddington@bonata.co.uk and it will reply within a month. For your Places 360 account itself (signing in, or deleting it), use the app, or see Places 360's privacy policy.
Complaints
If you're unhappy with how Bonata has handled your information, tell Bonata at paddington@bonata.co.uk. It will acknowledge your complaint within 30 days, look into it and tell you the outcome. You can also complain to the Information Commissioner's Office (ico.org.uk).
Children
The Bonata app isn't directed at children: a Places 360 account needs you to be at least 16.
Changes
Bonata will post any changes here and update the date at the top.
Contact
Citycenter Ltd, 254 Goldhawk Road, London W12 9PE · paddington@bonata.co.uk