Privacy policy.

Velocity Group Pty Ltd (ABN 12 345 678 901) ("we", "us", "our") is committed to protecting your personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what we collect, why, how we use it, and the rights you have under Australian law.

1. Who we are

Velocity Group Pty Ltd operates the café and website at velocitygroup.net.au. Our principal place of business is 42 Burnley Street, Richmond VIC 3121, Australia. For any privacy-related query, contact our Privacy Officer at privacy@velocitygroup.net.au.

2. What we collect

We only collect personal information that is reasonably necessary for our business. The kinds of information we collect include:

• Identity & contact details — name, email, phone number, provided when you make a reservation, send us a message, or sign up to our newsletter.
• Booking details — date, time, party size, and any notes you choose to share (e.g. dietary requirements, accessibility).
• Transaction details — if you buy beans to take home, we keep a record of the order, but we never store your full payment card details (these are processed by our payment provider).
• Website usage — pages visited, time on site, approximate location, device and browser type. See our cookie policy for the full breakdown.

3. Why we collect it (the APPs basis)

Under the Australian Privacy Principles, we must have a lawful basis for handling your information. We rely on the following:

• APP 3 (collection) — we collect only what is reasonably necessary.
• Performance of a contract — to confirm and manage your reservation or order.
• Legitimate business operations — to operate the café, prevent fraud, comply with food safety record-keeping, and improve our service.
• Your consent — for marketing communications (you can withdraw this at any time).

4. How we use it

We use your personal information to:

• Confirm and manage table reservations and bean orders.
• Reply to enquiries you send us through the contact form or by email.
• Send service communications about a booking (e.g. a reminder, or a follow-up if we need to reschedule).
• Send marketing communications (only with your consent — see section 6).
• Comply with our legal obligations (e.g. record-keeping under food safety and tax law).

We will never sell your personal information, and we do not share it with third parties for their own marketing purposes.

5. Who we share it with

We disclose personal information to a small number of trusted service providers, only as needed:

• Booking system — the third-party platform we use to manage reservations.
• Payment processor — for bean orders (Stripe / Square / equivalent).
• Email service — for transactional and marketing emails.
• IT and hosting providers — who host our website and store backups.
• Government authorities — where required by law (e.g.ATO, Food Safety regulators, law enforcement with proper authority).

Each of these providers is bound by their own privacy obligations and may only use your information to provide the service they offer us.

6. Marketing communications

If you sign up to our newsletter, we may send you occasional emails about new menu items, events, and the rare Saturday pop-up. You can unsubscribe at any time using the link in the footer of any email, or by contacting us directly.

7. Cookies and website analytics

Our website uses a small number of cookies. Some are essential to make the site work; others help us understand how visitors use the site so we can improve it. For a full list, see our cookie policy.

8. How we store and protect it

We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification, or disclosure (APP 11). These steps include:

• Encrypted connections (HTTPS/TLS) on our website.
• Access controls on internal systems, with least-privilege permissions.
• Regular review of the third-party providers who handle data on our behalf.
• Staff training on privacy obligations.

Despite our best efforts, no system is 100% secure. If we become aware of a data breach that is likely to cause serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

9. How long we keep it

We keep personal information only for as long as needed for the purpose it was collected, or as required by law. Typical retention periods:

• Reservations — 30 days after the booking date.
• Bean orders — 7 years (Australian Taxation Office record-keeping requirement).
• Marketing list — until you unsubscribe.
• Website analytics — up to 26 months (aggregated, non-identifying).

10. Your rights

Under the Privacy Act, you have the right to:

• Request access to the personal information we hold about you (APP 12).
• Request correction if the information is inaccurate, out-of-date, or misleading (APP 13).
• Make a complaint about how we have handled your information.

To exercise any of these rights, contact our Privacy Officer at privacy@velocitygroup.net.au. We will respond within 30 days.

11. Changes to this policy

We may update this policy from time to time. The latest version will always be on this page, with the "last updated" date at the top. If the changes are material, we will let you know by email if you're on our list.