Skip to main content
Bawley Vale Estate

PRIVACY POLICY

How Bawley Vale Estate collects, uses, and protects your personal information under Australian, UK, EU, and US (California) privacy law.

Who we are

Bawley Vale Estate Pty Ltd ("we", "us", "Bawley Vale Estate") operates the venue at 226 Bawley Point Road, Bawley Point NSW 2539, the website at bawleyvale.estate, and the booking and guest services described on this site.

This policy explains how we handle personal information. We are based in Australia but we take destination-wedding enquiries from the UK, EU, and US, so the policy covers all four regimes:

  • Australia — Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).
  • United Kingdom — UK GDPR and the Data Protection Act 2018.
  • European Economic Area — EU General Data Protection Regulation (GDPR).
  • United States (California) — California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

If you have questions reach the Privacy Officer at <a href="mailto:[email protected]">[email protected]</a>. If you are in the UK or EU and prefer postal contact, write to the address above marked "Privacy Officer".

Status. Version 2.0, 2026-06-10. Operator-drafted; flagged for legal sign-off before being treated as a final compliance statement.

What we collect (data categories)

We collect the personal information needed to run a wedding venue, winery, and the related guest services. The categories below apply across all jurisdictions; the regime-specific sections later describe the legal basis and the rights you have over each category.

  • Enquiry form on this site — your name, email, phone (optional), event type, preferred date, guest estimate, and any message you send. Also: your IP address (anonymised prefix) and a coarsely-truncated browser user-agent for spam triage.
  • Imported and manually-captured contacts — name, email and/or phone, the channel we found you on (web enquiry, email, Instagram DM, Facebook message, manual entry, CSV import, public crawl), and any context the coordinator recorded when adding you (e.g. "saw the @bawleyvaleestate post about the May open day").
  • Social-channel ingestion — when you message our Instagram or Facebook page, we ingest the message body, your handle/display name, and the conversation timestamp into the CRM so the coordinator can reply in one place. See Social-channel ingestion.
  • Bookings — billing name, customer contact email, event date, guest count, package selection, deposit and invoice records.
  • Guest portal (where used) — wedding party contact details, dietary requirements you've shared with us, song requests, supplier contacts.
  • Marketing list (opt-in only) — the email address you provided when subscribing.
  • Tracked-link events — when a coordinator sends you a tracked link to an info-pack or a specific page, we record open/visit events against your enquiry. See Tracked links and cookies.
  • Site usage signals — first-party session cookie, CSRF protection cookie, and (only with consent) a single first-party cookie that remembers your tracked-link attribution.

We do not collect government-issued identifiers (TFN, passport, SSN, driver licence) from customers. Employee TFN / superannuation data, where collected, is handled separately under our HR retention policy and is out of scope for this notice.

Why we collect it

  • To respond to enquiries about your event.
  • To confirm and run bookings — quotes, invoices, deposits, contracts, and event-day logistics.
  • To send transactional emails (booking confirmations, deposit receipts, password resets).
  • To comply with Australian taxation and business-record requirements.
  • To send opt-in marketing about upcoming events at the estate. You can unsubscribe in any email.
  • To recognise when you re-engage with us (so the coordinator picks up where the last conversation left off rather than starting from scratch).

Who sees it

We share personal information with third parties only where necessary to deliver the service:

  • Xero — invoicing, contacts, payment reconciliation. Xero is the system of record for accounting data.
  • Square (where used for cellar door payments) — card processing.
  • Mailgun — transactional email delivery.
  • Cloudflare — content delivery + security (bot protection on this site uses Cloudflare Turnstile).
  • AWS Sydney region — the systems behind this site run on AWS infrastructure in Australia.
  • Meta / Instagram / Facebook — we read the inbound messages you send us via Instagram or Facebook through the Graph API; we do not push your data to them beyond what is needed to reply to your conversation.
  • AI providers (drafting assistance only) — see AI-assisted tools.

We do not sell personal information. We do not "share" your personal information for cross-context behavioural advertising as those terms are defined under California law (CPRA).

International transfer

Our primary systems run in the AWS Sydney (ap-southeast-2) region. That means personal information you give us is processed in Australia regardless of where you are.

  • For UK / EU residents. Australia is not the subject of a current UK or EU adequacy decision. Where your data is transferred from the UK or EEA to us in Australia, we rely on the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses (SCCs) as appropriate, combined with the practical safeguards described under "Security" below. You can request a copy of the transfer mechanism we apply to your data by contacting the Privacy Officer.
  • For California residents. Data is transferred to Australia (a non-US jurisdiction) for processing. We apply the same security controls described below.
  • Some third-party processors (Xero, Mailgun, Cloudflare, Meta) operate from the US, UK, EU, or globally. They each maintain their own transfer mechanisms (UK-EU SCCs, EU adequacy framework participation where applicable, the EU-US Data Privacy Framework where applicable) and we contract with them under data-processing terms that align with our obligations to you.

How long we keep it

| Category | Retention window | Notes | | --- | --- | --- | | Enquiry IP and user-agent | 90 days | Nulled automatically by a nightly job (spam-triage only). | | Enquiry name + email + message | Indefinite as a business record | Removed on a verified subject-deletion request. | | Imported / CRM contact (name + email + phone + channel + context) | Indefinite as a business record | Removed on a verified subject-deletion request. | | Social-channel messages | While the lead is active, then archived with the lead record | Tied to your CRM contact for the same lifecycle. | | Bookings and invoices | 7 years | Statutory tax-record period (Australia). | | Marketing list | Until you unsubscribe | One-click unsubscribe in every email. | | Tracked-link events | While the lead is active, archived with the lead record | Deleted with the rest of your record on request. | | Audit log of admin actions | 3 years target | Exempt from subject-deletion under APP § 36 / Art. 17(3)(b) GDPR. | | Login attempts | 90 days target | Internal security log; minimal personal data (email + IP). |

Operator note (internal). Two of the windows above (audit log, login attempts) are stated targets and not yet enforced by an automated purge job — see docs/06-privacy.md for the engineering status. They are accurate as a commitment but the enforcement work is tracked separately.

Your rights at a glance

| Right | AU (Privacy Act / APPs) | UK GDPR | EU GDPR | US California (CCPA / CPRA) | | --- | --- | --- | --- | --- | | Know what we hold about you | APP 12 — access | Art. 15 — access | Art. 15 — access | Right to know | | Get a copy in a portable form | On request | Art. 20 — portability | Art. 20 — portability | Right to data portability | | Correct inaccurate information | APP 13 — correction | Art. 16 — rectification | Art. 16 — rectification | Right to correct | | Delete information | On request (subject to retention exceptions) | Art. 17 — erasure ("right to be forgotten") | Art. 17 — erasure | Right to delete | | Opt out of marketing | Spam Act 2003 — unsubscribe in every email | Direct-marketing opt-out (PECR + Art. 21) | Art. 21 — direct-marketing objection | Right to opt out of sale / share (we do not sell or share) | | Object to processing / restrict use | Limited (complaint route) | Art. 21 / Art. 18 | Art. 21 / Art. 18 | Right to limit use of sensitive personal information | | Non-discrimination for exercising rights | Implicit | Implicit | Implicit | Right to non-discrimination (CPRA) | | Complain to a regulator | OAIC (oaic.gov.au) | ICO (ico.org.uk) | Lead supervisory authority in your member state | California Privacy Protection Agency / Attorney General |

How to exercise any of these rights

  • Self-service export — use the request a copy of my data form. You will receive an email link to verify the request, then a downloadable export. We aim to respond within 30 days (Australia / GDPR) and 45 days (CCPA), in line with each regime.
  • Self-service deletion — use the delete my data form. Same email verification step. We confirm the action and identify any records we are required to retain (e.g. paid invoices under tax law).
  • Email — write to <a href="mailto:[email protected]">[email protected]</a> with "Privacy request" in the subject line. Mention which regime you are exercising rights under (AU / UK / EU / CA) so we can route it correctly.
  • Authorised agent (California) — a California resident may use an authorised agent to submit a request; we will ask for proof of authorisation and the resident's identity verification before acting.
  • We do not charge for exercising any of these rights, and we do not discriminate against you for doing so.

Australia — Privacy Act 1988 (Cth) + APPs

  • Legal basis. We collect personal information where it is reasonably necessary for one of our functions or activities (APP 3), where you consent (e.g. marketing list opt-in), or where required by law.
  • Sensitive information. We do not collect sensitive information as defined by the Privacy Act unless you volunteer it (e.g. a dietary requirement that reveals health information).
  • Notifiable Data Breaches. If we become aware of a notifiable data breach affecting your information, we notify you and the OAIC under the NDB scheme.
  • Complaint route. Office of the Australian Information Commissioner — oaic.gov.au.

United Kingdom — UK GDPR + Data Protection Act 2018

  • Controller. Bawley Vale Estate Pty Ltd is the data controller. We do not currently appoint a UK representative under Art. 27 UK GDPR; if you are in the UK and would prefer a local point of contact, raise this with the Privacy Officer and we will respond promptly.
  • Lawful bases (Art. 6).
    • Consent — marketing emails (you opt in, you can withdraw at any time).
    • Contract — quoting, booking, invoicing your event.
    • Legitimate interests — responding to your enquiry; running the venue's CRM so we don't lose track of conversations; minimal anti-spam telemetry on the enquiry form. We have assessed each of these as proportionate and you can object at any time.
    • Legal obligation — tax record-keeping.
  • International transfer. We rely on the UK IDTA (or the UK Addendum to the EU SCCs) for transfers from the UK to Australia. Copies available on request.
  • Complaint route. Information Commissioner's Office — ico.org.uk.

European Economic Area — EU GDPR

  • Controller. Bawley Vale Estate Pty Ltd is the data controller. We do not currently appoint an EU representative under Art. 27 GDPR; if you are in the EEA and would prefer a local point of contact, raise this with the Privacy Officer and we will respond promptly.
  • Lawful bases (Art. 6). Same shape as the UK section above — consent for marketing, contract for booking, legitimate interests for enquiry handling and CRM, legal obligation for tax record-keeping.
  • International transfer. EU Standard Contractual Clauses (2021/914) for transfers from the EEA to Australia. Copies available on request.
  • Complaint route. Your local data-protection authority (lead supervisory authority). A directory is at edpb.europa.eu/about-edpb/about-edpb/members_en.

United States — California (CCPA / CPRA)

  • Categories collected. Identifiers (name, email, phone), commercial information (event package, deposits, invoices), internet activity (the tracked-link events and minimal site-usage signals described below), and geolocation only at the coarse "country / region" level inferred from the anonymised IP prefix.
  • Sources. Directly from you (enquiry, booking, portal), from our social channels when you message us, from a coordinator's manual capture, and (where applicable) from a CSV import you provided.
  • Business purposes. Responding to enquiries, running bookings, billing and tax record-keeping, fraud and abuse prevention, marketing only with your opt-in.
  • "Sale" / "share". We do not sell personal information and we do not "share" personal information for cross-context behavioural advertising as those terms are defined under the CPRA. Because we do not sell or share, there is no opt-out link beyond the usual unsubscribe — but if California regulation changes our exposure to the sale/share definition, we will publish an opt-out link here.
  • Sensitive personal information (CPRA). We do not use SPI for any purpose other than to deliver the service you asked for. You have the right to limit our use of SPI; in practice this is already the only thing we do with it.
  • Retention. Same windows as the table above. We retain personal information no longer than is reasonably necessary for the disclosed purpose.
  • Notice at collection. This policy constitutes the notice at collection required by CCPA § 1798.100(a). The point-of-collection link on each form is /privacy.
  • Authorised agent. You can use an authorised agent; we require written authorisation plus identity verification of the resident.
  • Non-discrimination. We do not deny service, charge different prices, or provide a different level of quality because you exercise a CCPA/CPRA right.
  • Complaint route. California Privacy Protection Agency — cppa.ca.gov — or the California Attorney General.

We use a small set of first-party cookies for session management and CSRF protection (these are essential and do not require consent under UK / EU GDPR or PECR). Cloudflare may set additional cookies for bot detection (e.g. Turnstile). We do not use third-party advertising cookies.

When you arrive on the site, a cookie banner asks whether you accept or decline non-essential cookies (the analytics cookie and the tracked-link attribution cookie). Your choice is recorded in a first-party cookie (bve_cookie_consent) for one year so the banner does not reappear on subsequent visits. You can change your choice by clearing the cookie and refreshing, or by emailing the Privacy Officer.

Single posture across regimes. Rather than serve different consent flows by region, we apply the strictest common standard: opt-in for any non-essential cookie regardless of where you are. UK / EU residents get GDPR-compliant opt-in. Australian and US visitors get the same opt-in, which is stricter than either regime requires. The decision to use one global posture is recorded in docs/06-privacy.md § Cookie consent.

When a coordinator emails you an info pack or links to a specific page or FAQ on this site, that link is tracked: it carries an opaque token that lets us record when the link is opened, alongside a coarsely-truncated user-agent string and an anonymised IP prefix (the last octet is dropped) — the same minimal posture we use for the cookie-consent banner.

We record this against your enquiry so the coordinator knows when you've read the pack and can follow up well, not in the dark. We do not set any analytics cookie before you accept the cookie banner; if you do accept it, a single first-party cookie (bve_lead_token) remembers the most recent tracked link so a return visit from the same browser is attributed to the same enquiry.

You can ask us to delete this data with the rest of your record, and the export tool includes it.

Social-channel ingestion

When you message our Instagram or Facebook page, we ingest the conversation into our internal CRM so the coordinator can reply from one place. What we ingest:

  • the message body you sent,
  • your handle and display name,
  • the conversation timestamp,
  • the platform (Instagram / Facebook),
  • the resulting CRM contact channel (e.g. instagram).

If you would prefer that we do not retain your social-channel messages, ask us at <a href="mailto:[email protected]">[email protected]</a> or use the delete-my-data flow. Note that we cannot stop the social platform itself from retaining the conversation under its own terms — that part is between you and the platform.

AI-assisted tools

The Bawley Vale Estate staff console uses third-party AI models to help the coordinator draft reply suggestions, summarise booking activity, and similar internal-workflow tasks. A few invariants we apply when using AI:

  • Only on explicit user action. AI never runs in the background. It generates a draft only when a staff member clicks a button or opens a page that explicitly requests one.
  • PII is redacted before the model sees it. Personal details — your name, email address, phone number — are swapped with placeholders (e.g. $first_name, $email) before the prompt is sent. The provider sees the placeholders; we swap your real details back in locally before showing the draft to the coordinator. Aggregate facts that aren't personally identifying (event type, preferred date, guest estimate) may be sent so the suggestion is relevant.
  • Drafts are reviewed by a human. Nothing the AI produces is sent to you automatically. A coordinator reviews, edits, or discards every draft.
  • No training, no sale. Our provider terms forbid training their models on our inputs/outputs and forbid resale or onward-sharing of the content. We pay for usage on a per-token basis under those terms.
  • Cost-capped. Monthly AI spend is metered against a configurable budget; when the cap is hit, AI drafting silently disables until the next month or the cap is raised.

The same general principle applies to the other third-party services we use to operate the venue — Xero, Square, DocuSign, Mailgun, Cloudflare, AWS Sydney, Meta. They process the minimum personal data needed to deliver a specific function and are not permitted under our agreements to train on, resell, or otherwise re-purpose the data we share with them.

Security

This site runs over HTTPS, customer secrets are stored encrypted, and the admin / staff console is gated behind authenticated sessions with multi-factor authentication for any role that touches financial or HR data. We log access to sensitive surfaces and review the audit trail regularly.

No system is perfectly secure. If we become aware of a notifiable data breach affecting your information, we notify you and the relevant regulator on the timetable that regime requires (72 hours under UK / EU GDPR; "as soon as practicable" under the AU NDB scheme; the unauthorised-access notification timetable under CCPA where applicable).

Changes to this policy

We update this policy as our practices change. The "last updated" stamp at the top of the page and the version number are the source of truth. Material changes affecting how we use your personal information will be flagged on the website and, where you have an active relationship with us, emailed to you.