Your information.
Handled with care.

Who is responsible

Hurstwood Consulting LLP operates TwentyTwo-2 and is the data controller for the personal information described in this policy.

Hurstwood Consulting LLP is a limited liability partnership registered in England and Wales, registration number OC435853. Registered office: International House, 36–38 Cornhill, London, England, EC3V 3NG.

For privacy questions or to exercise your rights, email privacy@twentytwo2.bar.

This policy covers the public website at twentytwo2.bar, including www.twentytwo2.bar, enquiries sent through it, and the Google Search Console connection used in our private marketing workspace at marketing.twentytwo2.bar. That connection is described separately below; this policy does not cover other marketing-workspace features or account, venue, guest-order or Assistant Bartender processing within twentytwo2.app.

When you get in touch

The enquiry form collects your name, email address and message. Your bar or business name and setting are optional. It also records whether your enquiry concerns home use, hospitality or a general question, and uses a submission identifier to prevent duplicate delivery.

We use this information to respond, discuss your interest or a proposed pilot, and keep track of the conversation. For general correspondence, our legal basis is our legitimate interest in answering enquiries and managing relationships. Where you ask us to take steps towards a contract with you, the basis is taking those steps at your request.

The required fields are needed to send and answer your enquiry. You can instead email hello@twentytwo2.bar. Please do not include passwords, payment-card details or sensitive information about yourself or other people.

Submitting an enquiry does not subscribe you to a newsletter. We use your details for the enquiry and related follow-up, rather than automatically adding you to a promotional mailing list.

Notes from our bar

If you choose to join our mailing list, we collect your email address, optional first name and a record of your permission. On the Home launch page you can also choose Home, Home Plus or “Not sure yet”. After email confirmation, we store that preference and its confirmation date to organise our crowdfunding interest list and relevant launch updates. Choosing an edition is not a purchase or pledge. Existing subscribers must confirm preference changes by email; opting out of newsletters also excludes them from launch emails. We send a confirmation link and only activate your subscription after you confirm. Our legal basis is your consent to receive cocktail stories, home-hosting ideas and product updates, including launch offers.

Netlify stores the subscriber record separately from application accounts, including subscription status, dates, signup source and the wording you agreed to. Resend delivers confirmation emails. Microsoft 365 receives replies sent to our contact addresses. Newsletter subscribers are not added to our internal Microsoft 365 distribution group.

If you unsubscribe, you may optionally select a reason. Leaving this blank does not affect withdrawal. We use these categories to improve the newsletter, on the basis of our legitimate interest in understanding its relevance and frequency. The selected category is stored separately from subscriber records, without an email address, name, IP address or contact identifier, and reported as monthly counts. We do not use it to contact you again. Newsletter management and unsubscribe pages are excluded from our website analytics.

You can unsubscribe through the link in a newsletter or email privacy@twentytwo2.bar. Withdrawal stops future newsletters; we retain a limited record of the withdrawal and previous consent to respect your choice and handle any dispute. A new subscription requires fresh confirmation. Pending confirmation links expire after 24 hours; this does not automatically delete the pending record.

We review pending records and subscription records for removal when no longer needed. Signup abuse controls use hourly counters with hashed email and IP identifiers stored by Netlify. A hash is not anonymous data. These counters are not used for marketing profiles.

Keeping the website working

Our hosting provider, Netlify, processes technical request information such as IP addresses, requested pages, request times and browser information to deliver and protect the site and investigate faults. Our legal basis is our legitimate interest in operating a reliable, secure website.

The enquiry endpoint validates submissions and temporarily counts attempts using a hashed version of the email address to limit abuse. A hash is a protective measure, not a guarantee of anonymity. The counter has a one-hour validity window and is held in server memory. The form handler does not create an application database record or intentionally log your message.

Understanding website use

We use Plausible Analytics to understand which pages people visit and how they find the site. It processes page addresses, referral and campaign information, visit times, approximate location and device or browser information to produce usage statistics.

Plausible uses IP address and browser information to derive a daily visitor identifier; it states that it does not store the raw IP address or raw browser user-agent string. Its standard service uses no analytics cookies or persistent browser identifiers, and does not follow visitors across websites or across days.

We use these statistics to improve the website, not to make advertising profiles. Our basis for any personal-data processing involved is our legitimate interest in understanding and improving website use. The enquiry form does not send its field contents to Plausible. See Plausible’s data policy for its processing and storage details.

Google Search Console in our marketing workspace

TwentyTwo2 Marketing is a private workspace used by Toby Forman and authorised users to understand and improve the website’s performance.

Information accessed and purpose. With the Google account holder’s authorisation, the workspace accesses Google Search Console using read-only permission. It retrieves search-performance information for our configured website, including clicks, impressions, click-through rates, average search position and search queries made available by Google. We use this information to understand how people find the website and improve its content. This connection cannot change Search Console settings and does not request access to Gmail, Google Drive or contacts.

To the extent personal information is involved, our legal basis is our legitimate interest in understanding and improving our website’s search performance. The Google account holder controls the connection through Google’s authorisation process and can revoke access as described below.

Storage and protection. Google authorisation credentials are held in the marketing application’s server-side configuration on Netlify and are not included in the browser application. Reports are retrieved when an authorised user refreshes analytics and are displayed in the signed-in workspace. The current integration does not save these reports to an application database or retain a historical reporting archive. Google retains the underlying Search Console information under its own policies.

Access and sharing. Report information is available to authorised workspace users. Google supplies the reports, and Netlify processes the requests and responses as our hosting provider. The Search Console integration does not send these reports to the workspace’s AI content-generation service. We do not sell Google API data, use it for personalised advertising or use it to train general-purpose AI models.

Disconnecting and deletion. The Google account holder can revoke TwentyTwo2 Marketing’s access at any time through their Google Account’s third-party connections page. Revoking access prevents further authorised retrieval; it does not delete the underlying information held by Google. To request removal of the stored connection credentials, contact privacy@twentytwo2.bar. We remove credentials when the connection is retired or their deletion is requested.

TwentyTwo2 Marketing’s use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements.

Cookies and your display preference

The public website saves your chosen Daylight or After dark appearance in your browser’s local storage under twentytwo-commercial-theme. This remembers the display you requested; it is not used for advertising or sent with your enquiry.

This preference has no automatic expiry. You can change it using the appearance button, or remove it by clearing this website’s stored data in your browser. The website still works if browser storage is blocked, but may not remember your choice.

We do not currently use advertising cookies or advertising pixels on this website. The separate signed-in application has different storage and authentication requirements.

Who receives information

Hurstwood Consulting LLP and people authorised to help handle enquiries can access relevant correspondence. Service providers process information needed for their work: Netlify hosts the site and form endpoint; Resend delivers enquiry and subscription-confirmation emails; Microsoft 365 hosts our email mailboxes; and Plausible provides website analytics.

We may also disclose relevant information where required by law or where necessary to establish, exercise or defend legal claims. We do not sell enquiry information or provide it to advertisers for cross-site advertising.

Some hosting and email processing may take place outside the European Economic Area or the UK, including in the United States. Provider data-processing terms include provisions for international transfers, such as adequacy arrangements or standard contractual clauses where applicable. You can ask us for information about the safeguards relevant to your data. Plausible states that its hosted visitor analytics data is processed and stored in the EU.

Provider information: Netlify, Resend, Microsoft 365 and Plausible.

How long information is kept

We keep enquiry correspondence while answering your request and while a related discussion or relationship remains active. When that purpose ends, retention depends on whether the correspondence is still needed for an agreed follow-up, a legal obligation or a specific dispute. We remove information when those reasons no longer apply. Asking a question does not justify keeping your details indefinitely.

Email delivery records, mailbox copies, backups and hosting logs have separate retention settings and provider schedules. Deleting a message from a working mailbox may not immediately remove it from backups. Contact us if you need details about the retention or deletion of your particular correspondence.

The website’s display preference remains in your browser until you clear or replace it. Plausible rotates its daily identifier salt every 24 hours; this does not mean all analytics records are deleted daily.

Your choices and rights

Depending on the applicable law and circumstances, you can ask to access or correct your personal information, have it erased, restrict its use or receive a portable copy. You can object to processing based on legitimate interests. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing. You can always object to the use of your information for direct marketing.

Email privacy@twentytwo2.bar with enough context to identify your request. We may ask for proportionate information to verify your identity. Under the GDPR, we normally respond within one month; if a permitted extension is needed, we will explain why within that month.

You can complain to the CNIL in France or the relevant data-protection authority where you live or work. You do not need to contact us first to exercise that right.

This website does not use your enquiry to make solely automated decisions that have legal or similarly significant effects on you.

Links and changes to this policy

When you follow a link to the application, a social network or another service, its own privacy information applies. The marketing workspace’s Search Console connection is covered by the specific section above. Photographs and stories on this website are editorial material; their presence does not change how your browsing or enquiry information is handled.

We will update this page when the website’s processing changes. The date at the top identifies this version. See our Legal & ownership notice for information about website content and imagery.