Privacy Policy
Last updated: 4th August 2026
Who we are
The CornerStone at Rannoch Limited is a company incorporated in Scotland (company number SC687798), with its registered office at The CornerStone, Allt Mor Place, Kinloch Rannoch, Pitlochry PH16 5PQ.
In this policy, “we”, “us” and “our” mean The CornerStone at Rannoch Limited. We are the data controller for the personal information described here — that means we decide why and how it is used, and we are responsible for looking after it.
We are registered with the Information Commissioner’s Office under registration reference ZC096983.
Our data protection contact is Aislinn Crozier. If you have a question about anything in this policy, or about how we use your information, please email info@thecornerstonerannoch.co.uk or write to us at the address above.
What this policy covers
This policy explains what personal information we collect through our website and our services, why we collect it, what we do with it and what rights you have. It applies to:
- visitors to our website;
- people who book a table, a meeting room or a private event;
- people who contact us by email, through a form on our website or through social media;
- people who subscribe to our email updates; and
- people who apply to work with us.
Staff have a separate privacy notice covering employment information.
The information we collect and why
Booking a table
We take restaurant and bar bookings through OpenTable. Their booking form does not load automatically — you will see a short explanation and a button, and nothing is sent to OpenTable until you choose to load it or you have already accepted optional cookies. If you would rather not, you can book on OpenTable’s own website instead using the link we provide.
When you book, OpenTable collects your name, email address, telephone number, party size and any notes you add to the booking, and passes the booking details to us. We use this to hold and honour your reservation, to contact you about it, and to manage seating and staffing. Our lawful basis is performance of a contract with you. Where a booking is for more than six people we ask for a pre-order so that our chef can serve the group during normal service; we use those details for the same purpose.
For the booking records we hold, we are the data controller and OpenTable acts on our instructions. OpenTable is separately a data controller for any account you hold with them and for their own purposes. Their privacy policy is at opentable.co.uk/legal/privacy-policy. OpenTable is based in the United States — see “Sending information outside the UK” below.
Dietary and allergen information
If you tell us about a food allergy, intolerance or dietary requirement, that is information about your health, which the law treats as a special category needing extra protection. We use it only to prepare and serve your food safely, and we rely on your explicit consent — given by choosing to tell us — to do so.
Where you provide it through a booking, it is held in our booking records alongside the rest of the reservation. We share it only with the kitchen and service team looking after your booking, and we do not add it to any marketing list or customer database.
CLIENT QUERY — Does the team record allergy details in the booking system, or take them on the day? The answer decides whether this promises deletion after the visit or retention with the booking record.
Meeting room, workspace and private hire enquiries
When you enquire about the meeting room, workspace or a private event, we collect your name, contact details and whatever you tell us about your requirements — dates, numbers, catering and any accessibility needs. We use this to answer your enquiry and to plan the event.
While we are discussing an enquiry, our lawful basis is our legitimate interest in responding to people who contact us. Once you go ahead with a booking, our basis is performance of a contract with you.
Contacting us
When you use a form on our website, or email us, we receive the information you have given us — usually your name, your email address and your message. We use it only to deal with and reply to what you have contacted us about, and we will reply using the contact details you have provided. Our lawful basis is our legitimate interest in responding to enquiries.
Form submissions are emailed to us and are also stored on our website, where they are kept for up to 12 months and then deleted automatically. We often clear them sooner.
Our forms are protected from automated spam by a hidden field that real visitors never see or interact with. No third party is involved and nothing about you is sent anywhere.
If you speak to us in person about a booking or an enquiry, we may note down your name and contact details for the same purpose.
Keeping our website secure
Our website records IP addresses and failed login attempts so that we can identify and block attacks on the site. Our lawful basis is our legitimate interest in keeping the website secure and available.
Email updates
You can choose to receive occasional email updates from us about what is happening at The CornerStone — events, live music, seasonal menus and community news. If you sign up we collect your name and email address, and we rely on your consent. We ask you to confirm your subscription by email, so nobody can be added without their agreement.
We use Mailchimp to send these emails. Mailchimp acts on our instructions and is based in the United States — see “Sending information outside the UK” below.
Mailchimp records whether an email was opened and which links were clicked, which helps us judge what is worth sending. We tell you this when you subscribe, and you can stop it at any time by unsubscribing.
You can unsubscribe using the link at the bottom of every email, or by emailing us. We will act on it straight away. If you unsubscribe we keep a note of your email address on a suppression list, so that we do not accidentally add you back. We also keep a record of when and how you signed up, so that we can show we had your consent.
Our website
Cookies and similar technologies
Cookies are small files stored on your device when you visit a website. We use very few of them, and we do not allow anything to be set by anyone else unless you agree.
Some cookies are essential — without them the site will not work properly, and these are always set. Everything else is only set if you accept. You can accept or reject optional cookies using the banner shown when you first visit, and you can change your mind at any time using the “Manage Consent” link in the footer of every page. We also respect the Global Privacy Control signal, so if your browser sends one we treat it as a refusal and will not ask again.
Our typefaces are served from our own website rather than from a font service, so nothing about your visit is shared in order to display the page.
The cookies we use are listed below.
| Set by | Purpose | Category |
|---|---|---|
| The CornerStone | Keeps the site working and remembers your cookie choices | Essential — always set |
| OpenTable | Runs the booking form, once you have chosen to load it | Optional — only after you ask |
| Google Analytics | Tells us how many people visit and which pages they use | Optional — set only with your consent |
You can also block or delete cookies through your browser settings — the “Help” function in your browser will explain how. Guidance is available from the Information Commissioner’s Office at ico.org.uk and at allaboutcookies.org. Please note that blocking cookies may stop parts of our site working as they should.
Website analytics
We use Google Analytics to collect statistics about how our website is used — how many people visit, which pages they look at and what kind of device they are using. This helps us see what is working and what needs improving. We do not use it to identify individual visitors, and it is only active if you accept analytics cookies.
You can also opt out of Google Analytics across all websites using the browser add-on at tools.google.com/dlpage/gaoptout.
The map of where we are
Our contact page shows a map of where to find us. By default this is a plain picture held on our own website, so nothing is requested from anyone else in order to show it and nothing is stored on your device.
If you have accepted preference cookies, we show an interactive map in its place, which you can move and zoom. The imagery for that comes from CARTO, a company based in the United States. Your browser requests it from them directly rather than through us, so your IP address forms part of that request. The map itself sets no cookies. If you have not accepted, nothing is ever requested from CARTO.
Our address and a link for directions are shown either way, so you never need the interactive map in order to find us. You can change your choice at any time using the “Manage Consent” link in the footer.
Embedded content and links
Our website can display the OpenTable booking form and the interactive map described above. Neither is loaded unless you have accepted optional cookies or asked for it directly, so a visitor who does neither reaches nothing outside our own website. Any other content we embed in future would be covered by its own provider’s privacy policy rather than ours. Our website also links to other organisations’ websites; we are not responsible for their privacy practices.
Social media
We have pages on Facebook and Instagram, both operated by Meta. If you message us, comment, like or follow us there, the information you provide is handled by Meta under its own privacy policy, which you can read at facebook.com/privacy/policy. We can see and reply to messages and comments, and we use them only to respond to you.
Our website links to those pages but does not embed anything from them, and we do not use advertising or tracking pixels.
We sometimes take photographs at events at The CornerStone and share them on our social media pages. If you would prefer not to appear, please tell a member of the team on the day, or email us afterwards and we will remove the photograph.
Working with us
If you apply for a job with us, through our website form or by email, we collect the information in your application and anything you tell us during the recruitment process. We use it to assess your application and, if you are successful, to prepare for your employment. Our lawful basis is taking steps to enter into a contract with you, and our legitimate interest in running a fair recruitment process.
If your application is not successful we keep it for six months in case a similar role comes up, and then delete it. You can ask us to delete it sooner.
Complaints about our service
If you complain to us, we use your information only to investigate and respond, and to review the quality of what we do. If your complaint is about a member of our team, we may need to tell them who has complained. If you would rather we did not, please say so and we will do what we can, although it is not always possible to deal with a complaint anonymously.
Who we share information with
We do not sell your personal information, and we do not share it for anyone else’s marketing.
We share information with the suppliers who help us run The CornerStone — our booking system, our email platform, our website host, our backup provider and our analytics provider. They act on our instructions under a written contract and cannot use your information for their own purposes, except where they are separately identified above as controllers in their own right.
Our map imagery is not covered by that arrangement. We have no account or contract with the company that provides it, and we send them nothing; if you choose to load the interactive map, your browser requests the images from them directly. See “The map of where we are” above and “Sending information outside the UK” below.
We may also share information where:
- the law requires it, including with tax authorities, licensing authorities and the police;
- it is needed for legal proceedings, to take legal advice, or to establish, exercise or defend legal rights;
- it is needed to protect someone’s vital interests — for example, if you were taken ill on our premises and we needed to call for medical help;
- it is needed to prevent or detect fraud or to protect our interests or someone else’s; or
- we sell or transfer our business, in which case information may pass to the buyer.
Sending information outside the UK
Backups of our website are stored on Amazon Web Services in Europe. Transfers to countries in the European Economic Area are covered by the UK Government’s adequacy regulations, which recognise that those countries provide a comparable standard of protection.
Some of our other suppliers are based in the United States, or store information there. This includes OpenTable, Mailchimp and Google. Where information goes to those suppliers, we make sure it is protected to the standard required by UK data protection law — either because the supplier is certified under the UK Extension to the EU–US Data Privacy Framework, or because we have a contract in place using the ICO’s International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.
The interactive map described above works differently. We hold no account with the company that supplies the map imagery and send them nothing ourselves — if you choose to load the map, your own browser requests the images directly from their servers in the United States, and your IP address forms part of that request. Nothing is requested unless you have chosen it, and the static map we show by default comes from our own website.
How long we keep information
| What | How long we keep it |
|---|---|
| Booking records | 12 months after the visit |
| Dietary and allergen notes | To be confirmed |
| Enquiries that do not become bookings | 12 months from the last contact |
| Private hire and meeting room bookings | 2 years after the event |
| Website form submissions | Up to 12 months, then deleted automatically — often sooner |
| Email update subscribers | Until you unsubscribe, then your email address only, on our suppression list |
| Complaints | 2 years after the complaint is closed |
| Website security logs | Kept only as long as needed to investigate and block attacks |
| Website backups | In line with our backup schedule; older backups are overwritten |
| Unsuccessful job applications | 6 months |
| Accounting and tax records | 6 years, as required by law |
Keeping your information safe
We take the security of your information seriously. We limit access to people who need it for their work, we use reputable suppliers who maintain their own security standards, and we keep our website, systems and passwords under review. Backups of our website are encrypted and stored securely. Paper records, such as booking sheets, are kept securely and destroyed when no longer needed.
Your rights
You have the following rights over your personal information. You can exercise any of them by contacting us — there is no charge, and we will normally respond within one month. We may need to check who you are first.
- Access — you can ask whether we hold information about you and receive a copy of it.
- Correction — you can ask us to correct anything that is wrong or incomplete.
- Erasure — you can ask us to delete your information. We must do so where it is no longer needed for the purpose we collected it, where you withdraw consent and we have no other reason to keep it, where you object and we have no overriding reason to continue, or where we have used it unlawfully. We may not be able to delete information we are legally required to keep.
- Restriction — you can ask us to pause our use of your information while we check its accuracy, or while we consider an objection you have made.
- Objection — you can object to our use of your information where we rely on legitimate interests. If you object to direct marketing, we will stop straight away, without exception.
- Portability — where we hold information you gave us on the basis of consent or a contract, you can ask for a copy in a portable format, or ask us to send it to someone else.
- Withdrawing consent — where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.
We do not make decisions about you by automated means, and we do not carry out profiling.
If you would like this policy in another format — large print, for example — please ask and we will arrange it.
If you are unhappy
If you are concerned about how we have handled your personal information, please tell us first. Email info@thecornerstonerannoch.co.uk or write to us at the address below. We will acknowledge your complaint within 30 days and respond as quickly as we can.
You can also complain to the Information Commissioner’s Office at any time. You do not have to come to us first, although we would like the chance to put things right.
Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Helpline 0303 123 1113
ico.org.uk
Changes to this policy
We review this policy regularly and will update it when our use of personal information changes.
Contact us
The CornerStone
Allt Mor Place
Kinloch Rannoch
Pitlochry PH16 5PQ
info@thecornerstonerannoch.co.uk