Privacy Notice
This notice explains how Brighton Tavern Group Pty Ltd trading as Cornerstone Tavern (ABN 59 137 983 174) handles personal information in the Cornerstone Tavern online bookings service. In this notice, “we”, “us” and “our” mean that company.
What we collect
Depending on what you ask us to do, we collect:
- your name, email address and phone number;
- booking, table, party, enquiry, event and standby details;
- optional notes, occasion details and dietary or allergen information;
- your optional marketing choice and the evidence needed to honour it;
- payment status, amount, currency and provider references when a deposit is enabled; and
- necessary cookie, access, delivery, security and technical records.
Some booking and guest history may come from NowBookIt during an authorised migration or parallel cutover. We preserve recorded opt-outs and do not treat an imported subscription flag as a new marketing opt-in.
Why we use it
We use this information to manage bookings, respond to group and function enquiries, run standby, contact you about those services, allocate venue capacity, support safe service, reconcile approved payments and point-of-sale outcomes, prevent misuse, handle privacy requests, and meet legal, accounting, insurance and dispute obligations.
Dietary and allergen information is optional sensitive information. When you select it in the online booking form, the form asks you to consent to its use for guest safety and service. Required form fields are marked; without them we cannot complete the booking, enquiry, standby request or an approved payment.
Marketing
Where we offer marketing sign-up, it is optional and uses a separate, unticked checkbox. It does not affect your booking. You can withdraw marketing consent using the unsubscribe link in a marketing message or by contacting us. Booking, payment, enquiry and standby messages are transactional and do not depend on your marketing choice.
Service providers and overseas processing
We disclose only the information needed for the service to contracted providers and advisers. Our primary Supabase database is hosted in Sydney, Australia. The Bookings application runs on Railway infrastructure in Singapore; Railway's primary processing operations are in the United States. Supabase and its subprocessors may also support the service from the United States and Singapore. When transactional email is enabled, Resend processes message content, destination addresses, metadata and logs in the United States.
If Stripe deposits are enabled, Stripe—not this Bookings application—receives your card details. We retain payment status and reconciliation references, not card numbers or security codes. Stripe may process payment data in Australia, Ireland, the United States and other locations described in its current terms.
H&L point-of-sale and the group CRM are not activated for this venue through this notice. Before either is enabled, we will confirm the recipient, purpose, contract and processing countries and update this notice where required. We may also disclose information to professional advisers, insurers, payment institutions, regulators, courts, police or other authorities where reasonably necessary or legally required.
Current provider details can change. See the official information for Supabase, Railway, Resend and Stripe.
How long we keep information
| Record | Standard period |
|---|---|
| Booking and paid ticket guest details | 730 days after the most recent booking or paid event date |
| Closed enquiry contact details and notes | 365 days after the enquiry closes |
| Closed standby contact details | 90 days after the request closes |
| Completed email, CRM and processed POS personal data | 90 days after delivery or processing is terminal and reconciled |
| Privacy-request resolution notes | 730 days after the request is fulfilled or closed |
| Minimum pseudonymous legal and audit evidence | 2555 days from the relevant service or event date, subject to annual purpose review |
At the end of the applicable contact-data period, the Bookings service removes direct identifiers, dietary or allergen information and free text when no active delivery, reconciliation, security incident or legal hold prevents it. Where a privacy request or retention duty also reaches a processor or protected backup, we reconcile that separately and keep the available outcome evidence. A Bookings database scrub alone does not prove downstream completion, and provider recovery copies may remain for the limited period in the applicable provider contract.
A limited operational, transaction, consent, payment, POS or audit record may remain under a pseudonymous identifier. Pseudonymous is not the same as anonymous. The seven-year period is a conservative minimum review marker for that evidence, not a claim that every record is a financial record or an automatic reason to retain it forever. We review whether a permitted purpose remains and dispose of it when no longer required.
Cookies and security
The current service uses only cookies and signed links needed to preserve a form attempt, protect a particular booking or standby request, and secure staff access. Booking, enquiry and standby draft cookies expire after 10 minutes; booking and standby access cookies after 2 hours; and enquiry and standby receipt cookies after 5 minutes. The current service does not use advertising or analytics cookies. We apply access controls, encryption in transit, rate limits, audit records and data-minimisation controls, but no online service can promise absolute security.
Access, correction and complaints
You may ask what personal information we hold about you, request access or correction, withdraw marketing consent, or ask us to review whether information should be removed or de-identified. We may need to verify your identity before acting. Some information must be retained where a legal, safety, transaction, chargeback or dispute obligation applies, and we will explain that outcome.
Contact the Venue Manager at manager@thecornerstone.com.au, call (08) 9562 0310, or write to 11 Kingsbridge Boulevard, Butler WA 6036. Please describe the booking, enquiry or request without sending card details or unnecessary health information. We will investigate privacy complaints and respond within a reasonable period. If you remain dissatisfied, you can contact the Office of the Australian Information Commissioner.
Changes to this notice
We will update this page when our practices, providers or legal obligations materially change. The version and policy reference above identify the wording and retention decision. For a published notice, the status line also records the owner-approval date.