Privacy policy
Last updated 4 October 2026
This policy explains how Barton Grocer & Bottleshop ("we") collects, uses and looks after personal information when you order catering from us online or by phone, and the information we keep about our staff for rostering and pay.
What we collect from customers
- Your name, business or department, phone number and email address.
- The delivery address and suburb, or that you'll pick up.
- Your accounts payable contact's name, phone number and email address, and any purchase order number.
- Dietary requirements and allergies you tell us about, and any notes on your order.
- What you order, when, and how you paid (payments themselves are handled by Xero and its payment providers; we never see or store card numbers).
Why we collect it
To prepare, deliver and invoice your order, to contact you about it, to keep our accounts, and to prepare food safely for anyone with dietary requirements or allergies. We don't use your details for marketing, and we never sell them.
Who can see it
- Our managers, who handle orders and invoices.
- Our kitchen team, who see only what they need to make and deliver your order (not your email, accounts details or prices).
- Xero, our accounting system, which creates and sends your invoice or quote.
- Microsoft 365, which sends our order emails.
- Supabase, which hosts our ordering system's database in Sydney, Australia.
These providers only use your information to provide their service to us.
How we keep it safe
Your information is stored in Australia. Only signed-in managers (with a second sign-in code) can see customer details, every change is recorded, and connections to our providers are encrypted.
How long we keep it
We keep order and invoice records for as long as tax law requires (at least five years), then delete them. Your browser may remember the details you typed on our order form so you don't have to type them again; you can clear this by clearing your browser's site data.
Staff information
For our own staff we keep names, contact details, pay rates (copied from our payroll in Xero), rosters, leave, clock-in times and a photo taken at each clock-in. Clock-in photos are visible only to managers and are deleted automatically after 30 days. Staff were given a separate written notice about the time clock.
Seeing or correcting your information, and questions
You can ask to see the information we hold about you, or to correct it, or make a complaint about how we've handled it, by emailing catering@bartongrocer.com.au. We'll reply within 30 days. If you're not happy with our answer, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.