Privacy Policy

Last updated: 11 September 2026

This policy explains how the Saint Peter group handles personal information. It covers:

Saint Peter Pty Ltd (ABN 71 612 838 427), which operates Saint Peter and The Grand National Hotel, 161 Underwood Street, Paddington NSW 2021, saintpeter.com.au and shop.saintpeter.com.au
Saint Peter Production Pty Ltd trading as Fish Butchery Waterloo (ABN 24 653 972 420), Shop 3, 965 Bourke Street, Waterloo NSW 2017, and fishbutchery.com.au
Mr Niland Pty Ltd (ABN 66 633 716 533), which operates mrniland.com

These companies are related to each other. In this policy "we", "us" and "our" means whichever of them you are dealing with. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and we also follow the privacy laws of other countries where they apply to how we deal with you, including the EU and UK General Data Protection Regulations for customers in Europe and the United Kingdom.

The information we collect

The information we collect depends on what you do with us. It can include:

Contact details, such as your name, email address, phone number and postal or delivery address.
Booking and stay details, such as the date, time and size of your booking, your arrival and departure dates, the room you book, the occasion you are celebrating and any requests you make.
Dietary requirements and allergies that you tell us about so we can prepare your food safely. This is health information, which the law treats as sensitive. We only collect it with your consent, only use it to prepare your food and look after you, and only share it with the venue you're visiting and the booking system that holds your booking notes. If you tell us about someone else's allergies, for example for a group booking, please check they're happy for you to do so.
Order and payment details, such as what you buy, when, how much you paid and how you would like it delivered. Card payments are processed by our payment providers and booking platforms, and we only keep the card details those systems need to take payment.
Identification, when you check in to The Grand National Hotel, where we ask for photo identification to confirm who you are.
CCTV images, because we use security cameras at Saint Peter, The Grand National Hotel and Fish Butchery Waterloo for the safety and security of guests, staff and property.
Date of birth, when you order wine or other alcohol from us, because the law requires us to check that buyers are 18 or over.
Marketing preferences, including whether you have subscribed to our emails and which messages you open or click.
Website and device information, such as your IP address, browser, the pages you visit and how you arrived at our websites, collected with cookies, pixels and similar tools (see below).
Information you send us, such as enquiries, event requests, reviews, competition entries and job applications.

We collect most of this directly from you, when you make a booking, place an order, sign up to our emails, enter a competition or contact us. We also receive information from the platforms you use to deal with us, such as booking systems, gift voucher and delivery platforms, and from our payment providers. If someone else books or buys for you, for example a gift voucher or a booking for a group, they give us your details and we rely on them to let you know.

If you would rather not give us some information, you can still browse our websites, but we may not be able to take your booking, fill your order or answer your enquiry.

How we use it

We use personal information to:

take and manage bookings, orders, hotel stays, events, gift vouchers and masterclasses, and to deliver what you have bought;
look after you when you visit, including your dietary needs and special occasions;
take payment, charge any cancellation or no-show fee set out in our booking terms, and process refunds;
answer your questions and deal with problems;
send you news, offers and invitations if you have agreed to receive them or where the law otherwise allows (every email includes an unsubscribe link);
run competitions and contact winners;
understand how people use our websites and improve them, and measure and target our advertising;
prevent fraud, keep our websites secure, and keep our venues, guests and staff safe (including through CCTV); and
meet our legal obligations, including liquor laws, tax and accounting records, and responding to lawful requests from authorities.

Cookies, pixels and analytics

Our websites use cookies and similar technologies to make them work, to remember your cart and preferences, and to measure and improve our marketing. These include analytics and advertising tools from Google and Meta (Facebook and Instagram) and the email tools of Klaviyo and Mailchimp. On mrniland.com we also use Microsoft Clarity, which records how visitors move through pages so that we can find and fix problems.

These tools can collect your IP address, device details and activity on our sites, and some share that information with the provider, which uses it to show you our ads on other websites and apps. You can block or delete cookies in your browser settings, opt out of personalised ads in your Google and Meta account settings, and unsubscribe from our emails at any time.

Automated decisions

Our online stores use Shopify's fraud analysis, which uses your order, payment, device and IP address details to assess whether an order is likely to be fraudulent. If an order is flagged as high risk, a member of our team reviews it before we decide whether to cancel it. If you think your order was cancelled by mistake, contact us. We don't otherwise use computer programs to make, or substantially help make, decisions about you that significantly affect your rights or interests.

Who we share it with

We share personal information only as needed for the purposes above, with:

each other (our related companies), for example so that the restaurant and hotel can both look after a guest;
the service providers who help us run our business, including our website and e-commerce platforms (Squarespace, Shopify), booking systems (OpenTable, Cloudbeds, SiteMinder), ordering and delivery platforms, gift voucher platforms (Wrapped), payment providers, email and marketing platforms (Klaviyo, Mailchimp), analytics and advertising providers (Google, Meta, Microsoft), couriers and warehouses, and our accountants, lawyers and IT support;
competition partners, where a competition's terms say so; and
government authorities and others where the law requires or allows it.

We do not sell your personal information.

Information sent overseas

Some of our service providers store or process information outside Australia. Most are based in, or store data in, the United States (including Google, Meta, Microsoft, Klaviyo, Mailchimp, Squarespace, OpenTable and Cloudbeds) and Canada (Shopify). Orders from mrniland.com that are fulfilled from our warehouse in the United States are shared with that warehouse and with international couriers in the countries they deliver to. Some smaller providers are located elsewhere, and you can ask us for details. We take reasonable steps to make sure overseas providers protect your information.

Keeping it safe

We store information with providers that protect it with measures such as encryption and access controls, and we limit access to the people who need it. We keep information for as long as we need it for the purposes above or as the law requires (for example, tax records are kept for at least five years), and then delete it or make it anonymous. CCTV footage is kept only for a limited time unless it is needed to investigate an incident or the law requires us to keep it, and we only share it with police or other authorities where the law requires or allows. If we have a data breach that is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner.

Your choices and rights

You can ask us for a copy of the personal information we hold about you, or ask us to correct it. We will respond within 30 days and we don't charge for this. In rare cases the law allows us to refuse, and if so we will tell you why.

You can unsubscribe from our emails at any time using the link in any email, or by contacting us.

If you are in the European Union or the United Kingdom, you also have the right to ask us to delete your information, to restrict or object to how we use it, to receive it in a portable format, and to withdraw any consent you have given. You also have the right not to be subject to a decision based solely on automated processing that significantly affects you. We rely on these legal bases: performing our contract with you (orders and bookings), your consent (marketing emails, non-essential cookies, and your explicit consent for any allergy information), our legitimate interests (improving our websites, preventing fraud) and legal obligations. When we send your information outside the EU or UK, for example to service providers in the United States, we rely on safeguards the GDPR allows, such as standard contractual clauses or the EU-US Data Privacy Framework. You can also complain to your local data protection authority.

Questions and complaints

Contact our Privacy Officer:

Email: hello@saintpeter.com.au
Post: Privacy Officer, 161 Underwood Street, Paddington NSW 2021

If you have a complaint about how we've handled your personal information, please email or write to our Privacy Officer and tell us what happened. We'll look into it and give you our response in writing within 30 days. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.

Changes to this policy

We will update this policy when our practices change and show the date of the latest version at the top.