Privacy Policy
1. Who we are
This Privacy Policy explains how Topolabamba, operated by The Di Maggio’s Restaurants Limited (trading as Di Maggio’s Restaurant Group or DRG), collects, uses, shares and protects personal information when you visit our website, contact us, make a reservation, dine with us, purchase vouchers, sign up for communications or use other services we provide.
The Di Maggio’s Restaurants Limited is registered in Scotland under company number SC390675. Registered office: 87 St Vincent Street, Glasgow, G2 5TF.
For data protection questions, contact info@thedrg.co.uk or write to Data Protection, Di Maggio’s Restaurant Group, 87 St Vincent Street, Glasgow, G2 5TF.
2. What information we collect
Contact and identity details, such as name, email address, telephone number and, where needed, postal address.
Reservation and dining information, such as venue, booking date, party size, dietary or accessibility requests, booking notes and relevant dining history.
Transaction information, such as purchases, voucher orders, refunds and payment status. Card payments may be processed directly by specialist payment providers; we do not ordinarily need to store full card details.
Marketing preferences, newsletter subscriptions, promotion entries and your interactions with our communications.
Website and device information, such as IP address, device/browser information, pages viewed, referral source and cookie or similar identifiers, depending on your consent settings.
Correspondence and feedback, including enquiries, complaints and customer service records.
Wi-Fi and loyalty/app information, where those services are offered, as described in the relevant service notices.
CCTV images where cameras operate in our venues for safety and security.
If you voluntarily tell us about allergies, dietary needs, health or accessibility requirements, that information may be sensitive. We use it only as appropriate to help fulfil your request and apply additional safeguards where required.
3. Where information comes from
We receive information directly from you, automatically through your use of our website (subject to applicable cookie choices), from booking and ordering partners, from payment or voucher providers, and occasionally from a person organising a group reservation on your behalf.
4. Why we use information
To Handle reservations, purchases, voucher orders and customer requests
To Respond to enquiries, maintain service quality, resolve complaints and administer our business
Send email or SMS marketing where permitted
Measure website use with non-essential analytics
Run relevant advertising and measure campaign performance using optional advertising technologies
Prevent fraud, maintain security and operate CCTV
Maintain accounting, tax and other legally required records
Manage competitions or promotions
Where we rely on legitimate interests, we balance our business needs against your rights and freedoms. We will not rely on consent where another lawful basis is more appropriate, and we will not treat use of the website alone as consent to optional cookies.
5. Marketing and Restaurant Rewards
Where you subscribe or we are otherwise legally permitted to contact you, we may send news, offers, events and information about Sugo and, where clearly explained at sign-up, other participating DRG brands or Restaurant Rewards. We respect your communication choices. You can unsubscribe using the link in marketing emails or by contacting info@thedrg.co.uk.
If you use Restaurant Rewards or a related app, additional programme-specific terms and privacy information may apply. We do not sell or rent customer email lists for third-party marketing.
6. Website analytics, Google services and advertising
Our website uses Google services such as Google Analytics and Google advertising technologies to understand how people use the website, improve its performance and measure advertising. The precise services and data collected depend on the tools actually enabled on Sugo’s website.
Where required by UK law, we ask for your consent before setting or accessing non-essential analytics or advertising cookies or similar technologies. You can refuse or withdraw that consent through our cookie settings, where available, without losing access to core website functions.
How Google uses information from sites and apps that use its services: https://business.safety.google/privacy/
Google Privacy Policy: https://policies.google.com/privacy
7. Cookies and similar technologies
Cookies are small files or identifiers stored on or read from your device. We may use strictly necessary cookies to operate the site; preference cookies to remember choices; analytics cookies to understand usage; and advertising cookies or tags to measure and personalise advertising, where used.
Strictly necessary technologies may operate without consent where legally exempt. Non-essential technologies should remain off until you make an affirmative choice. You should be able to reject them as easily as you accept them and change your choices later.
You can also manage cookies through your browser, although disabling necessary cookies may affect site functionality.
8. Bookings, payments, deliveries and external platforms
When you make a reservation, order food or buy a voucher, we and relevant service providers may process the information necessary to deliver that service. Providers may include booking systems, delivery marketplaces, payment processors, voucher platforms and customer support suppliers.
We work with the following 3rd parties: ResDiary, Deliveroo, Just Eat, ITISON, Access and Wireless Social
Where you leave our website for a third-party service, that provider may act as an independent controller under its own privacy policy. Please review its notice.
9. Who we share information with
We may share information with authorised DRG personnel, IT and website hosts, reservation and order platforms, payment providers, email/CRM and marketing suppliers, analytics and advertising providers (where enabled), professional advisers, insurers, regulators and law-enforcement bodies when necessary and lawful.
Service providers acting on our instructions are required to protect personal information and use it only for authorised purposes. Some third parties may independently determine how they use information and will provide their own notices. We may also disclose information in connection with a lawful business sale or restructuring.
10. International transfers
Some service providers may process personal information outside the UK. Where UK data protection law requires safeguards, we use an applicable adequacy decision or appropriate contractual and organisational protections, such as the UK International Data Transfer Agreement or UK Addendum, as relevant.
11. How long we keep information
We keep personal information only for as long as reasonably necessary for the purpose collected, including applicable legal, tax, accounting, operational and dispute-resolution requirements. Different records have different retention periods. We securely delete or anonymise information when it is no longer needed.
12. Security
We use appropriate technical and organisational measures designed to protect personal information from unauthorised access, alteration, disclosure or loss. No internet service is completely secure. Please avoid emailing payment card details, passwords or other highly sensitive information.
13. Your data protection rights
Subject to applicable legal conditions and exceptions, you may have the right to access your personal information, correct inaccurate information, request erasure, restrict or object to certain processing, receive certain information in a portable format, and withdraw consent where processing relies on it. You also have rights concerning qualifying solely automated decisions.
To exercise your rights, email info@thedrg.co.uk. We may ask for reasonable evidence of identity. We normally respond within one month, subject to lawful extensions or exceptions.
You may complain to the UK Information Commissioner’s Office (ICO) if you are unhappy with how we handle your information.
ICO — Make a complaint: https://ico.org.uk/make-a-complaint/
14. Children
Our website and general marketing are not designed to collect personal information from children without an appropriate lawful basis or any consent required by law. If you believe a child has provided information inappropriately, please contact us.
15. CCTV and venue security
CCTV may operate at our venues to protect customers, staff, property and premises, investigate incidents and support lawful requests from authorities. Signs at relevant venues should identify CCTV use. Access to recordings is restricted and footage is retained only for an appropriate period, subject to incidents or legal requirements.
16. Other websites
Our website may link to websites and services that we do not control. Their privacy practices may differ from ours, and their own privacy notices apply.
17. Changes to this policy
We may update this Privacy Policy to reflect changes in our services, technology or legal requirements. The current version will be published on the website with its effective date. Material changes may be communicated separately where appropriate.
Last revised: 16 October 2026
18. Contact us
Data Protection
Di Maggio’s Restaurant Group
87 St Vincent Street
Glasgow G2 5TF
Email: info@thedrg.co.uk