Privacy Policy

1. Who we are

Oxford Social is a trading name of Corner Pub Limited, a private limited company registered in England & Wales under company number 17132283. Our registered office is 38b Oswald Road, Scunthorpe, England, DN15 7PQ. We trade from 88-94 Oxford Street, Manchester, M1 5WH.

In this policy, “we”, “us” and “our” mean Corner Pub Limited. We are the data controller for the personal data described below. You can reach us at info@oxso.co.uk.

2. What we collect

We only collect what we need to serve you. We do not buy personal data from anyone, we do not build advertising profiles, and we do not run third-party tracking or analytics on this site.

Booking a table

Your name, email address, phone number, the date and time you want, how many people are coming, and any notes you add (for example accessibility needs or an allergy).

Booking an event

Your name, email address, which event, and how many tickets.

Managing your own booking

A random one-off code that we put in your confirmation email. It is what lets you change or cancel your table without us having to identify you. It is tied to that one booking, it is not a password, and it is deleted with the booking.

Messaging us on Instagram

If you send a direct message to our Instagram account, @oxfordsocial_mcr, we receive your Instagram username, your profile name, the account ID that Instagram gives us for you, your messages and anything you attach, and when they were sent. If you ask about a booking, we also keep the details you give us, such as your name, the date and time, how many people are coming and how to reach you. We use this to reply to you, to set up and manage your booking, and to keep a record of what we agreed. Replies on Instagram are usually sent by our virtual assistant. You can ask to speak to a member of our team at any time, and if you disagree with anything it has told you or decided about a booking, a member of our team will review it.

Email updates

Your email address, when and where you requested updates, the consent wording you agreed to, when you confirmed through your inbox, and when you unsubscribe. We use this to send updates you requested and honour your choice to stop them.

Keeping the site working

Your IP address, recorded briefly with a timestamp so that we can stop automated abuse of our booking form.

Fonts loaded from Google

Our pages load typefaces from Google Fonts. That means your browser makes a request to Google’s servers, and your IP address is visible to Google as part of it. We do not send Google anything else about you, and we receive nothing back about you.

3. Why we can use it

UK data protection law requires us to have a lawful basis for using your personal data. Ours are:

• Performance of a contract — to hold your table or your place at an event, to tell you about it, and to sort out any problem with it. This includes a booking you ask for by messaging us on Instagram.
• Legitimate interests — to keep the site secure and free of automated abuse, to keep basic business records, to reply to messages you send us, and to run our pub. We have considered your rights and kept the data to a minimum.
• Consent — for email updates. You gave it freely, and you can withdraw it at any time without giving a reason.
• Legal obligation — where we must keep records, for example for tax and accounting.

4. Payments

You pay for what you eat and drink at the bar, in the ordinary way. If you pay by card there, that transaction happens on the card terminal in the pub and through our bank — not through this site, and no card data of yours is ever sent to or stored on this website.

5. Who we share it with

We do not sell your personal data. We never share it for anyone else’s marketing. We share it only with:

• Hostinger — our web host, whose servers store the site and its data, including the system where we keep Instagram enquiries.
• Meta — Instagram is run by Meta, which carries the messages between you and us. Meta’s own privacy policy covers how Instagram uses your data.
• Google — our booking calendar runs on Google Workspace, so the bookings we take (your name, the date, time and size of your booking, and any notes) are stored there.
• OpenAI — replies to Instagram messages are usually written and sent automatically by our virtual assistant, which runs on OpenAI’s technology. It can also check availability and make or cancel bookings you ask for. Our team uses ChatGPT to review enquiries and can see every conversation.
• Professional advisers and authorities — our accountants, or the police, a regulator or a court, where we are legally required to.

Our staff can see bookings on our internal dashboard, because they need to in order to seat you.

Meta, Google and OpenAI may handle data outside the UK, including in the United States. Where they do, the transfer is protected in the way UK law requires, for example by UK adequacy regulations (such as the UK Extension to the EU–US Data Privacy Framework) or by the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses.

6. How long we keep it

• Bookings and event guestlists — kept while they are useful for handling a complaint or a dispute, and reviewed at least once a year so that anything older than 24 months is cleared out.
• Instagram enquiries — kept while we deal with your enquiry, and reviewed at least once a year so that conversations that did not lead to a booking are cleared out once they are 12 months old. If an enquiry leads to a booking, we keep it with the booking record.
• Records needed for tax — 6 years, as UK law requires.
• Email-update subscribers — while you remain subscribed. If you unsubscribe, we keep your address on a suppression list so we do not send to it again by mistake. You can ask us to review or delete that record.
• Unconfirmed email requests — confirmation links expire after 48 hours, and unconfirmed requests are removed after 30 days when the mailing list is next processed.
• Abuse-prevention IP records — one hour, then automatically discarded.

7. Storage on your device

We do not use advertising or tracking cookies, and there is no cookie banner on this site because there is nothing to consent to.

We use your browser’s storage for one thing only: when you open the link in your confirmation email, the code from that link is held for the rest of the browser session so that refreshing the page doesn’t lose your booking. It stays on your device, and closing the tab clears it.

On staff devices only, we also store the staff PIN for the length of the session, so the dashboard doesn’t ask for it on every screen.

8. How we protect it

The whole site is served over HTTPS. No card data ever reaches us, because the site takes no payments. Booking records are held on our hosting provider’s servers, are not publicly reachable, and the staff dashboard requires a PIN.

Our enquiries system can only be used by our own team, through a password-protected sign-in.

No system is perfectly secure. If a breach ever affects your rights and freedoms, we will tell you and the Information Commissioner’s Office as the law requires.

9. Your rights

Under UK GDPR you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted, where we do not need to keep it;
• restrict or object to how we use it;
• receive it in a portable, machine-readable format;
• withdraw consent to email updates at any time.

Every marketing email includes an unsubscribe link. You can also email info@oxso.co.uk and we will respond within one month. It is free, and we will not ask you why.

10. Deleting your data

You can ask us to delete the personal data we hold about you at any time, including messages you have sent us on Instagram and anything you told us in them. Email info@oxso.co.uk or send a direct message to @oxfordsocial_mcr saying you would like your data deleted. If you contacted us on Instagram, tell us your Instagram username so that we can find your messages.

We will delete your data within one month and let you know when it is done. If the law requires us to keep something, such as a record we need for tax, we will keep only that and tell you. There are step-by-step instructions on our data deletion page.

11. Complaints

If you think we have handled your data badly, please tell us first — we would rather fix it. You also have the right to complain to the UK regulator, the Information Commissioner’s Office, at ico.org.uk or on 0303 123 1113.

12. Changes to this policy

If we change how we use your data we will update this page and move the “last reviewed” date at the top. Where a change materially affects you, we will tell you directly.