Privacy Policy

Last updated: 13 July 2026

1. Personal information we collect

The information we collect depends on how you interact with us and may include:

• Identity and contact details: name, email address, telephone number, company name and preferred venue;
• Reservation and dining details: venue, date, time, party size, occasion, booking history, guest requests, whether you are booking for someone else, and communications about the booking;
• Dietary, allergy and accessibility details: information you choose to give us so we can consider your dining or access needs;
• Enquiries and feedback: messages, complaints, survey responses, reviews and other correspondence;
• Marketing details: newsletter subscription, marketing consent, preferences, source and unsubscribe status;
• Transaction details: gift-card or purchase information supplied to us by a payment or platform provider. We generally do not receive or store full payment-card details where payment is handled by an independent provider;
• Recruitment information: employment history, qualifications, availability, references and information contained in a resume or application;
• Technical and usage information: IP address, browser and operating system, device type, user agent, language, approximate location derived from IP, screen size, time zone, referring page, pages and query strings viewed, visit duration, visitor/session identifiers, campaign and UTM information, and website interaction or security logs; and
• Images or recordings: photographs you submit or consent to, and CCTV footage where used at a venue for safety, security and incident management.

If you do not provide information we reasonably need, we may be unable to process a booking, respond to an enquiry, accommodate a request, send requested updates or assess an application.

2. How we collect personal information

We usually collect information directly from you, including when you:

• complete a reservation, contact, newsletter or other website form;
• contact us by phone, email, social media or in person;
• visit, order from or attend an event at one of our restaurants;
• purchase or redeem a gift card through a linked provider;
• enter a promotion, provide feedback or post a review; or
• apply for employment.

We may also receive information from someone booking on your behalf, another member of your group, our restaurant operators, reservation and gift-card providers, payment processors, social-media platforms, review sites, recruitment referees, analytics/security providers and publicly available sources. If you give us another person’s information, please make sure you have their permission and have told them about this policy.

Our website also collects technical information automatically through server logs, cookies, local storage, analytics code and similar technologies.

3. Why we collect, hold, use and disclose information

We use personal information where reasonably necessary to:

• receive, confirm, manage and communicate about reservations and venue requests;
• provide restaurant, gift-card, customer-service and event services;
• respond to enquiries, feedback, complaints and incidents;
• consider dietary, allergy, accessibility and special-occasion requests;
• send offers, invitations and restaurant news where we have consent or are otherwise permitted by law;
• administer promotions, surveys and loyalty or customer programs;
• assess job applications and communicate with candidates;
• operate, secure, troubleshoot, measure and improve our website, restaurants, menus, campaigns and customer experience;
• detect spam, fraud, misuse and security threats, including through Google reCAPTCHA;
• maintain business, tax and transaction records, resolve disputes and enforce agreements;
• comply with laws, regulatory requests and responsible-service, food-safety and workplace obligations; and
• carry out another purpose explained when information is collected, or with your consent.

4. Sensitive information

Allergy, medical and accessibility information may be “sensitive information” under privacy law. We ask you to provide only what is reasonably needed for us to understand the request. We collect and use this information with your consent, where reasonably necessary to provide the requested service, or where otherwise permitted by law.

We may share relevant details with chefs, managers and service staff who need them for the booking. Because our kitchens handle common allergens, providing this information does not guarantee an allergen-free meal. Please also speak to venue staff before ordering.

5. Who we may disclose personal information to

We do not sell or rent personal information. We may disclose relevant information to:

• the restaurant and staff responsible for your booking, dining experience, enquiry or application;
• related The Cray businesses and restaurant operators for administration, customer service and brand operations;
• service providers supporting website hosting, databases, email/SMS delivery, IT support, cloud storage, analytics, advertising, security, bookings, gift cards, payments, customer communications and recruitment;
• Google, when reCAPTCHA or other configured Google services are used, subject to Google’s applicable terms and privacy policy;
• professional advisers, insurers, auditors and financiers;
• government, courts, regulators, emergency services or law-enforcement bodies where required or authorised by law;
• a purchaser, investor or adviser involved in a proposed or completed sale, restructure or transfer of all or part of our business, subject to appropriate confidentiality protections; and
• other persons where you direct or consent to the disclosure.

Each independent third-party platform may also collect information directly from you under its own privacy policy.

6. Overseas disclosure and processing

Some technology, cloud, email, analytics, social-media, security, reservation, gift-card or payment providers may store or process information outside Australia. The locations can vary according to the provider and its infrastructure and may include the United States and other countries in which those providers or their subcontractors operate.

Where required, we take reasonable steps to ensure overseas handling is consistent with applicable Australian privacy law. You may contact us for current information about the providers relevant to your interaction and the countries in which they are likely to process information.

7. Cookies, local storage and analytics

Our website uses cookies, browser storage, logs and similar technologies. Our current first-party analytics creates a pseudonymous visitor identifier, stores it in a cookie and local storage, and maintains a session identifier in local storage. The visitor cookie may remain for up to approximately 395 days unless you delete it earlier. A session is treated as new after approximately 30 minutes of inactivity.

Analytics events may record page views, visit duration, page and referrer URLs, campaign parameters, IP address, approximate location, device/browser details, screen size, language and time zone. We use this information to understand website use, measure campaigns, maintain security and improve performance. It is not intended to directly identify you by name, although some technical data may be personal information under applicable law.

Third-party analytics, advertising or social-media tags may also be activated on the website from time to time and may set their own cookies or receive online identifiers under their privacy policies.

You can block or delete cookies and local storage through your browser controls. Blocking them may affect website features, security checks or the way preferences work. Browser privacy signals are handled where required by applicable law.

8. Direct marketing

If you subscribe or otherwise consent, we may use your name, email address, mobile number, venue preference and interaction history to send relevant offers, invitations and updates. We may use a communications provider to send them on our behalf.

You can withdraw consent at any time by using the unsubscribe facility in a message or contacting us at contact@thecray.com.au. We will action valid electronic unsubscribe requests within the period required by law. Opting out of marketing does not prevent necessary service messages about a booking, purchase or enquiry.

9. Storage, security and data breaches

Information may be stored in electronic systems, databases, email accounts, secure administrative systems and, where necessary, physical records. We use reasonable technical and organisational safeguards appropriate to the information, such as access controls, authentication, input validation, anti-spam controls, monitoring and restricted staff access.

No internet transmission or storage system is completely secure. If a data breach occurs, we will investigate, take appropriate remedial action and notify affected individuals and the Office of the Australian Information Commissioner where required by the Notifiable Data Breaches scheme.

10. How long we keep information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and for legal, accounting, fraud-prevention, employment, insurance and dispute-resolution requirements. Retention periods vary by record type. When information is no longer required, we take reasonable steps to delete, destroy or de-identify it, subject to backup cycles and legal obligations.

11. Accessing or correcting your information

You may ask for access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Contact us using the details below and describe the information concerned.

We may need to verify your identity before acting. We will respond within a reasonable period. If a lawful exception prevents access or correction, we will generally explain the reason and available complaint options. We do not charge for making a request, although the law may permit a reasonable charge for providing access in some circumstances.

12. Privacy questions and complaints

If you believe we have mishandled personal information, email or write to us using the details below. Please include enough information for us to understand the concern. We will acknowledge the complaint, investigate it and aim to provide a response within a reasonable period.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC). The OAIC generally expects you to raise the matter with us first.

13. Children

Our website is not directed to children under 16 and they should not submit personal information without a parent or guardian’s involvement. A parent, guardian or booking organiser may provide limited information about a child where needed for a reservation, such as a highchair, accessibility need or allergy. We use it only for the relevant service and related legal or safety purposes.

14. External websites and platforms

Our website links to independent services such as gift-card providers, maps, review sites and social-media platforms. Their privacy practices are controlled by them, not us. Review the privacy policy shown by the relevant service before providing information. This policy does not apply to independent third-party handling except to the extent we receive and manage information from them.

15. Changes to this policy

We may update this policy when our practices, providers or legal obligations change. The current version will be published on this page with a revised “Last updated” date. Material changes may also be highlighted on the website or communicated directly where appropriate.