Privacy policy

Tablewick is an online booking and table management service for restaurants and cafes. It is owned and run by Wemark Tech Pty Ltd, ABN 33 702 092 966, of 3/392 Main North Road, Blair Athol SA 5084 (“Tablewick”, “we”, “us”).

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), the Spam Act 2003 (Cth), and the Notifiable Data Breaches scheme. We apply these standards whether or not a particular law strictly applies to us.

This policy covers three groups of people:

• Venues and their staff. Restaurants, cafes and bars that sign up for Tablewick, and the owners, managers and hosts who log in. For this information we decide how it is used.
• Guests. People who book a table, join a waitlist or are added by a venue. When you book, you are booking with that venue. The venue decides how it uses your details, and Tablewick stores and processes them for the venue as its service provider.
• Visitors. People who browse our website.

Each venue is responsible for its own handling of guest information, including any privacy policy it publishes. If you have a question about how a particular venue uses your details, you can ask the venue or ask us and we will help.

From guests

• Name, mobile number and email address.
• Booking details: date, time, party size, seating preference, occasion and the booking reference.
• Anything you choose to tell the venue, such as special requests, dietary requirements or allergies.
• Your booking history with that venue: visits, cancellations and missed bookings.
• Notes and tags the venue's staff add to your profile, such as a table preference.
• Whether you agreed to hear from the venue about news and offers, and when and how you agreed or unsubscribed.
• If the venue holds a card for a booking: a reference to the card stored by Stripe, the card brand, last four digits and expiry. We never see or store the full card number or security code.
• Text messages you send in reply to us, such as C to confirm, X to cancel or STOP.

From venues and their staff

• Names, email addresses, phone numbers and roles of people who log in.
• Business details: venue name, address, ABN, opening hours, floor plan, branding and settings.
• Billing details. Subscription and SMS credit payments are processed by Stripe, which holds the card. We keep the Stripe customer reference, plan, invoices and payment status.
• If a venue takes card holds or deposits, the identifier of its own Stripe account. Stripe collects the identity and bank details it needs to verify the business directly.
• Support messages and records of changes made in the dashboard.

Collected automatically

• Technical information such as IP address, browser, device, pages viewed and error logs, used to run and secure the service.
• Cookies needed to keep you signed in. See section 11.

Sensitive information. Dietary requirements and allergies can reveal health information. We only collect them when you choose to provide them, so the venue can cater for you, and you consent to that use by providing them. They are not used for marketing.

• Directly from you, when you book, join a waitlist, reply to a message, sign up or contact us.
• From the venue, when its staff take a booking by phone or in person, or update your guest profile.
• From Google, if you book through Reserve with Google. Google passes us the details needed to make the booking.
• From Stripe, which tells us whether a payment or card hold succeeded.
• Automatically, as you use the website and booking widget.

We use personal information to:

• make, confirm, change and cancel bookings, and run waitlists;
• send booking confirmations, reminders and updates by email and SMS, and tell you when your table is ready;
• help the venue look after you, including seating, dietary needs and the service sheet it shares with its team;
• hold a card and charge a no-show or late cancellation fee where the venue's policy allows it and you agreed when booking;
• send news and offers from a venue, but only if you agreed to hear from that venue (section 6);
• bill venues for their subscription and SMS credits;
• provide support, prevent fraud and spam bookings, and keep the service secure;
• improve Tablewick using aggregated or de-identified information that does not identify you;
• meet our legal obligations.

We do not sell personal information. We do not use guest information to market Tablewick, and we do not share one venue’s guests with another venue.

A venue can send email and SMS campaigns, such as a special night or a set lunch, only to guests who agreed to hear from it. You agree by leaving or ticking the “Send me news and offers” box when you book. Some venues tick this box for you and you can untick it before you book. We keep a record of the wording you saw, whether the box was ticked for you, and when you agreed.

Every marketing email and text names the venue and includes a way to unsubscribe. You can stop them at any time by:

• using the unsubscribe link in any marketing email or text,
• using your email app's built-in unsubscribe button,
• replying STOP to a text, which stops marketing texts from every venue on Tablewick, or
• emailing privacy@tablewick.com.au.

We act on an unsubscribe straight away, and always within five working days as the Spam Act requires. Once you unsubscribe, booking a table again with a pre-ticked box does not sign you back up. Messages about bookings you make, such as confirmations and reminders, still come through because they are part of the service you asked for.

We use Stripe to process payments. Card details are entered into forms provided by Stripe and go straight to Stripe. They never pass through or get stored on our servers. Stripe is certified to the highest level of the Payment Card Industry Data Security Standard (PCI DSS).

• Card holds and no-show fees. These are processed on the venue’s own Stripe account using Stripe Connect. The venue receives the payment and Stripe shares the transaction details with the venue.
• Venue subscriptions and SMS credits. These are processed on Tablewick’s Stripe account.
• Venue verification. When a venue connects a Stripe account, Stripe collects identity and banking information directly to meet its legal obligations. We receive only the account status.

Stripe uses payment information to provide its services, to prevent fraud and to meet its legal obligations, and it may set cookies on payment forms for fraud prevention. Stripe handles that information under its own privacy policy.

The venue you book with sees your booking, contact details, requests and history with that venue. Its staff use Tablewick to manage your booking.

Service providers who help us run Tablewick, under contracts that require them to protect the information and use it only to provide their service:

Others, only where required or allowed by law, for example to respond to a court order or a lawful request from a government agency, to protect someone’s safety, or as part of a sale of our business, in which case the buyer must keep handling the information in line with this policy.

Our main database is in Sydney. Some providers listed above process information in other countries, mainly the United States and Japan, to send emails and text messages and to process payments. Before using a provider we take reasonable steps to make sure it protects personal information to a standard consistent with the Australian Privacy Principles, including through contract terms and security reviews.

• All connections use encryption (HTTPS). Data is encrypted at rest by our hosting providers.
• Each venue can only see its own data. This is enforced in the database itself, not just in the app.
• Staff accounts have roles, so hosts see less than owners and managers.
• Card details are held by Stripe, never by us.
• Access to production systems is limited to the people who need it to run and support Tablewick.
• We monitor for errors and misuse, and limit repeated booking attempts to stop spam.

We keep cookies to a minimum:

• Sign-in cookies keep venue staff logged in. Without them the dashboard cannot work.
• A cookie remembers which venue you are working in if you manage more than one.
• Your browser's local storage remembers small preferences, such as whether the sidebar is collapsed.
• Stripe may set cookies on payment forms to prevent fraud.

We do not use advertising cookies, and the booking page and widget do not track guests across other websites.

• Guest and booking information is kept while the venue uses Tablewick, so the venue can see your history and honour your preferences. A venue can delete a guest at any time.
• If a venue closes its account, its venue and guest data is deleted. Copies in our backups are overwritten on a rolling basis, generally within 30 days.
• Unsubscribe records are kept for as long as we hold your details, so we never message you again by mistake.
• Billing records are kept for seven years to meet Australian tax law.
• Technical logs are kept for a short period, generally no more than 90 days.

You can ask for a copy of the personal information we hold about you, or ask us to correct it, by emailing privacy@tablewick.com.au. We will respond within 30 days and there is no charge. We may need to confirm your identity first. If we cannot give you access, we will explain why.

Guests can change or cancel a booking using the link in their confirmation email or text. You can also ask the venue directly to update or delete your profile.

You may use a nickname instead of your real name when booking, but the venue needs a working mobile number or email to confirm the booking and contact you about it.

Tablewick is for adults booking on behalf of their party. We do not knowingly collect information directly from children under 16. If you think a child has given us their details, contact us and we will delete them.

If a data breach is likely to result in serious harm, we will notify the people affected and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, and tell affected venues so they can help their guests.

Contact our privacy officer at privacy@tablewick.com.au or by post to Privacy Officer, Wemark Tech Pty Ltd, 3/392 Main North Road, Blair Athol SA 5084. We will acknowledge a complaint within 7 days and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

We may update this policy as Tablewick changes or the law changes. The date at the top shows the latest version. If we make a significant change that affects venues, we will email them before it takes effect.