Privacy Policy

1. Who we are

Oxford Social is a trading name of Corner Pub Limited, a private limited company registered in England & Wales under company number 17132283. Our registered office is 38b Oswald Road, Scunthorpe, England, DN15 7PQ. We trade from 88-94 Oxford Street, Manchester, M1 5WH.

In this policy, “we”, “us” and “our” mean Corner Pub Limited. We are the data controller for the personal data described below. You can reach us at hello@oxso.co.uk.

2. What we collect

We only collect what we need to serve you. We do not buy personal data from anyone, we do not build advertising profiles, and we do not run third-party tracking or analytics on this site.

Booking a table

Your name, email address, phone number, the date and time you want, how many people are coming, and any notes you add (for example accessibility needs or an allergy).

Booking an event

Your name, email address, which event, and how many tickets.

Managing your own booking

A random one-off code that we put in your confirmation email. It is what lets you change or cancel your table without us having to identify you. It is tied to that one booking, it is not a password, and it is deleted with the booking.

Email updates

Your email address, when and where you requested updates, the consent wording you agreed to, when you confirmed through your inbox, and when you unsubscribe. We use this to send updates you requested and honour your choice to stop them.

Keeping the site working

Your IP address, recorded briefly with a timestamp so that we can stop automated abuse of our booking form.

Fonts loaded from Google

Our pages load typefaces from Google Fonts. That means your browser makes a request to Google’s servers, and your IP address is visible to Google as part of it. We do not send Google anything else about you, and we receive nothing back about you.

3. Why we can use it

UK data protection law requires us to have a lawful basis for using your personal data. Ours are:

• Performance of a contract — to hold your table or your place at an event, to tell you about it, and to sort out any problem with it.
• Legitimate interests — to keep the site secure and free of automated abuse, to keep basic business records, and to run our pub. We have considered your rights and kept the data to a minimum.
• Consent — for email updates. You gave it freely, and you can withdraw it at any time without giving a reason.
• Legal obligation — where we must keep records, for example for tax and accounting.

4. Payments

You pay for what you eat and drink at the bar, in the ordinary way. If you pay by card there, that transaction happens on the card terminal in the pub and through our bank — not through this site, and no card data of yours is ever sent to or stored on this website.

5. Who we share it with

We do not sell your personal data. We never share it for anyone else’s marketing. We share it only with:

• Hostinger — our web host, whose servers store the site and its data.
• Professional advisers and authorities — our accountants, or the police, a regulator or a court, where we are legally required to.

Our staff can see bookings on our internal dashboard, because they need to in order to seat you.

6. How long we keep it

• Bookings and event guestlists — kept while they are useful for handling a complaint or a dispute, and reviewed at least once a year so that anything older than 24 months is cleared out.
• Records needed for tax — 6 years, as UK law requires.
• Email-update subscribers — while you remain subscribed. If you unsubscribe, we keep your address on a suppression list so we do not send to it again by mistake. You can ask us to review or delete that record.
• Unconfirmed email requests — confirmation links expire after 48 hours, and unconfirmed requests are removed after 30 days when the mailing list is next processed.
• Abuse-prevention IP records — one hour, then automatically discarded.

7. Storage on your device

We do not use advertising or tracking cookies, and there is no cookie banner on this site because there is nothing to consent to.

We use your browser’s storage for one thing only: when you open the link in your confirmation email, the code from that link is held for the rest of the browser session so that refreshing the page doesn’t lose your booking. It stays on your device, and closing the tab clears it.

On staff devices only, we also store the staff PIN for the length of the session, so the dashboard doesn’t ask for it on every screen.

8. How we protect it

The whole site is served over HTTPS. No card data ever reaches us, because the site takes no payments. Booking records are held on our hosting provider’s servers, are not publicly reachable, and the staff dashboard requires a PIN.

No system is perfectly secure. If a breach ever affects your rights and freedoms, we will tell you and the Information Commissioner’s Office as the law requires.

9. Your rights

Under UK GDPR you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted, where we do not need to keep it;
• restrict or object to how we use it;
• receive it in a portable, machine-readable format;
• withdraw consent to email updates at any time.

Every marketing email includes an unsubscribe link. You can also email hello@oxso.co.uk and we will respond within one month. It is free, and we will not ask you why.

10. Complaints

If you think we have handled your data badly, please tell us first — we would rather fix it. You also have the right to complain to the UK regulator, the Information Commissioner’s Office, at ico.org.uk or on 0303 123 1113.

11. Changes to this policy

If we change how we use your data we will update this page and move the “last reviewed” date at the top. Where a change materially affects you, we will tell you directly.