Who we are and what this notice covers
Opium is operated by Trebleside Designated Activity Company, a company registered in Ireland under company number 571215, with its registered office at 39/40 Dawson Street, Dublin 2, D02 X067, and is part of the Mercantile Entertainment Group. Trebleside DAC is the data controller for the personal data described here. In this notice “we”, “us” and “our” mean Trebleside DAC trading as Opium.
This notice explains what personal data we collect through this website, why we collect it, who we share it with, how long we keep it, and what rights you have.
If you have a question about this notice or want to exercise any of the rights described below, use our privacy request form or write to Data Protection, Opium, 26 Wexford Street, Dublin 2, D02 HX93. We aim to respond within one month.
This notice was last updated on 13/11/2026. We review it when our processing changes and will post any updated version at this address.
What personal data we collect
| When | What we collect |
|---|---|
| If you contact us | Your name, email address, phone number and message, sent through our General Enquiries and Group Dinner forms |
| If you join our mailing list | Your name and email address, and the record of your consent |
| When you visit the website | Technical information such as your IP address, browser and device, and, if you agree, information collected through cookies as described in our Cookie Policy |
We do not seek special category data (such as health data or information about your beliefs) and ask that you do not send it to us.
What we use it for, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Answer your enquiry and keep a record of our correspondence | Legitimate interests: dealing properly with the people who contact us |
| Plan and quote for group bookings and events you ask us about | Steps at your request before entering a contract |
| Send you news and offers by email | Your consent, which you can withdraw at any time |
| Keep the website secure and block spam and automated abuse | Legitimate interests: protecting our website and the people who use it |
| Understand how the website is used | Your consent, given through our cookie banner |
Our mailing list
We only add you to our mailing list if you tick the box to join it. It is optional, and you can contact us or book without joining. Every email includes an unsubscribe link, and unsubscribing takes effect straight away. You can also ask to be removed using our privacy request form.
Table bookings
Table reservations are made through OpenTable. OpenTable is a separate controller for your OpenTable account and its own privacy policy applies to the details you give it. We receive your booking details from OpenTable so we can look after your visit.
Who we share your data with
We share personal data only where we need to, and only with organisations that are bound to protect it.
| Who | Why |
|---|---|
| WP Engine | Hosts the website and the data held on it |
| Gravity Forms | Handles the forms on this website; entries are stored on our own hosting |
| Google reCAPTCHA and CleanTalk | Check form submissions for spam and automated abuse. For this they receive what you entered and your IP address |
| SMTP2GO | Sends emails from the website, such as form notifications |
| Sucuri and WP Activity Log | Website security monitoring and logs of administrator activity, which include IP addresses |
| Cookiebot (Usercentrics) | Records the cookie choices you make on our website |
| Google Analytics and Google Tag Manager | Measure how the website is used, only where you have agreed through the cookie banner |
| Intuit Mailchimp | Sends our mailing list emails and holds your subscription and consent record |
| Tripleseat | Our event management system, where group and event enquiries are stored |
These organisations act on our instructions as processors, except public bodies and our professional advisers, who act as controllers in their own right. We do not sell your personal data.
Some of these providers are based outside the European Economic Area, or use infrastructure that is. Where personal data is transferred outside the EEA, we rely on the European Commission’s adequacy decisions (including the EU-US Data Privacy Framework) or on standard contractual clauses. You can ask us for details of the safeguards that apply.
How long we keep it
| What | How long |
|---|---|
| Website form submissions | 28 days on the website, then deleted |
| Correspondence with you | Two years from our last contact with you |
| Group and event booking records | Seven years, to meet Revenue record-keeping requirements |
| Your mailing list subscription and consent record | While you are subscribed. If you unsubscribe, we keep only your email address and the date you unsubscribed, so we never email you again by mistake |
| Website security logs | 90 days |
Your rights, security, and how to complain
Your rights. You have the right to ask us for a copy of the personal data we hold about you; to have inaccurate data corrected; to have data erased where we no longer have a reason to hold it; to restrict or object to how we use it; and to receive data you gave us in a portable format. Where we rely on your consent, you can withdraw it at any time. Where we rely on legitimate interests, you can object and we will stop unless we have compelling grounds to continue.
To exercise any of these, use our privacy request form or write to us at the address above. We will respond within one month. We may ask you to confirm your identity first, so that we do not disclose your data to someone else.
Security. We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss or disclosure, and we require our processors to do the same. If a breach occurs that is likely to result in a risk to your rights, we will notify the Data Protection Commission, and you directly where the risk is high.
Cookies. Our use of cookies and similar technologies, and how to change your choices, is described in our Cookie Policy. Non-essential cookies are set only where you have agreed through the consent banner, and you can change your choice at any time.
Complaints. If you are unhappy with how we have handled your personal data, please tell us first so that we can put it right. You also have the right to complain to the Data Protection Commission at any time:
Data Protection Commission
6 Pembroke Row, Dublin 2, D02 X963
www.dataprotection.ie