Privacy Policy

1. Who we are

Oxford Social is a trading name of Corner Pub Limited, a private limited company registered in England & Wales under company number 17132283. Our registered office is 38b Oswald Road, Scunthorpe, England, DN15 7PQ. We trade from Oxford Road, Manchester.

In this policy, “we”, “us” and “our” mean Corner Pub Limited. We are the data controller for the personal data described below. You can reach us at hello@oxso.co.uk.

2. What we collect

We only collect what we need to serve you. We do not buy personal data from anyone, we do not build advertising profiles, and we do not run third-party tracking or analytics on this site.

Booking a table

Your name, email address, phone number, the date and time you want, how many people are coming, and any notes you add (for example accessibility needs or an allergy).

Booking an event

Your name, email address, which event, and how many tickets.

Ordering at the table

Your table number — or, for collection, the name you give us — the items you order, the total, any notes you add, and a short order reference such as OX-1A2B3C.

Paying by card online

The amount, the order reference, our payment provider’s reference for the payment, and whether it succeeded. We never receive or store your card number. See section 4.

Email updates

Your email address, and the date you subscribed — only if you ask for them.

Keeping the site working

Your IP address, recorded briefly with a timestamp so that we can stop automated abuse of our booking and ordering forms.

Fonts loaded from Google

Our pages load typefaces from Google Fonts. That means your browser makes a request to Google’s servers, and your IP address is visible to Google as part of it. We do not send Google anything else about you, and we receive nothing back about you.

3. Why we can use it

UK data protection law requires us to have a lawful basis for using your personal data. Ours are:

• Performance of a contract — to take and fulfil your booking or order, to take payment, and to sort out any problem with either.
• Legitimate interests — to keep the site secure and free of automated abuse, to keep basic business records, and to run our pub. We have considered your rights and kept the data to a minimum.
• Consent — for email updates. You gave it freely, and you can withdraw it at any time without giving a reason.
• Legal obligation — where we must keep records, for example for tax and accounting.

4. Card payments

Our payment provider is Dojo, a trading name of Paymentsense Limited. They are the data controller for the card data you give them, and they process it under their own privacy notice. They tell us only whether the payment succeeded, the amount, and a reference number so we can match the payment to your order.

We accept Visa, Mastercard and American Express.

5. Who we share it with

We do not sell your personal data. We never share it for anyone else’s marketing. We share it only with:

• Dojo (Paymentsense Limited) — to take and confirm card payments.
• Hostinger — our web host, whose servers store the site and its data.
• Professional advisers and authorities — our accountants, or the police, a regulator or a court, where we are legally required to.

Our staff can see bookings and orders on our internal dashboard, because they need to in order to serve you.

6. How long we keep it

• Orders and bookings — up to 24 months, so we can handle refunds, disputes and complaints, then deleted.
• Records needed for tax — 6 years, as UK law requires.
• Email-update subscribers — until you unsubscribe.
• Abuse-prevention IP records — one hour, then automatically discarded.

7. Storage on your device

We do not use advertising or tracking cookies, and there is no cookie banner on this site because there is nothing to consent to.

We do use your browser’s local storage to remember things that make the site usable: what is in your basket, your table number or collection name, and your most recent order so we can show you its progress. This stays on your device, is never sent anywhere except as part of an order you place, and you can clear it at any time through your browser settings.

On staff devices only, we also store a staff PIN and a sound preference for the orders dashboard.

8. How we protect it

The whole site is served over HTTPS. Card data is handled entirely by Dojo and never reaches us. Our order and booking records are held on our hosting provider's servers, are not publicly reachable, and the staff dashboard requires a PIN.

No system is perfectly secure. If a breach ever affects your rights and freedoms, we will tell you and the Information Commissioner’s Office as the law requires.

9. Your rights

Under UK GDPR you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted, where we do not need to keep it;
• restrict or object to how we use it;
• receive it in a portable, machine-readable format;
• withdraw consent to email updates at any time.

Email hello@oxso.co.uk and we will respond within one month. It is free, and we will not ask you why.

10. Complaints

If you think we have handled your data badly, please tell us first — we would rather fix it. You also have the right to complain to the UK regulator, the Information Commissioner’s Office, at ico.org.uk or on 0303 123 1113.

11. Changes to this policy

If we change how we use your data we will update this page and move the “last reviewed” date at the top. Where a change materially affects you, we will tell you directly.