Introduction

We are committed to managing personal information lawfully, fairly and transparently. Where the Privacy Act 1988 (Cth) applies to us, we will handle personal information in accordance with that Act and the Australian Privacy Principles (APPs). We will also comply with any other privacy, data protection, direct marketing or sector-specific requirements that apply to our activities.

This Privacy Policy describes the kinds of personal information we collect and hold, how we collect and hold that information, the purposes for which we collect, hold, use and disclose it, how an individual may access or correct personal information, how privacy complaints may be made and handled, and whether personal information is likely to be disclosed to overseas recipients.

Your use of the website does not, by itself, amount to consent to every handling practice described in this Policy. Where consent is required by law, we will seek consent separately. This Policy should be read with any collection notice, terms of use or service terms provided at the relevant time.

Personal information we collect

The personal information we collect depends on how you interact with us. It may include:

• name and contact details
• business or organisation details
• postal, billing or delivery addresses
• information submitted through forms or enquiries
• account registration and profile details
• booking, reservation, membership or event information
• order, payment and transaction records
• customer support and communication records
• marketing and communication preferences
• other information you voluntarily provide

We may also automatically collect technical and usage information, including:

• IP address
• browser type and version
• device and operating system information
• referring website or page
• pages viewed and website interactions
• session, cookie and similar tracking information
• security, diagnostic and error-log information

Sensitive information

We will only collect sensitive information where the collection is reasonably necessary for one or more of our functions or activities and the individual has consented, or where collection is otherwise required or authorised by law. Sensitive information may include health information, biometric information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record and membership of a professional or trade association or trade union. Remove this paragraph, or tailor it with legal advice, if the business does not collect sensitive information.

Government-related identifiers

We will not adopt a government-related identifier as our own identifier, or use or disclose a government-related identifier, except where permitted by law. Examples include Medicare numbers, tax file numbers and driver licence numbers.

How we collect information

We may collect personal information when you:

• visit or use our website
• submit a contact, enquiry, quote or other form
• contact us by phone, email, in person or through social media
• subscribe to communications
• purchase products or services
• create or use an account
• make a booking or reservation
• apply for or maintain a membership
• register for an event, activity, promotion, competition or survey
• leave a comment
• upload a file, document, image or other content

We may collect information directly from you, automatically through cookies, analytics, server logs and security systems, or from third parties where it is unreasonable or impracticable to collect it directly from you, or where collection from a third party is otherwise permitted by law.

At or before collection, or as soon as practicable afterwards, we will take reasonable steps to notify you of the matters required by applicable law. A collection notice displayed on a form or at another collection point may provide more specific information and should be read with this Privacy Policy.

Unsolicited personal information

If we receive personal information that we did not solicit, we will determine within a reasonable period whether we could have collected it under applicable law. If we could not have collected it and it is not contained in a Commonwealth record, we will destroy or de-identify it as soon as practicable where lawful and reasonable to do so.

Anonymous and pseudonymous interactions

Where practical, you may interact with us anonymously or using a pseudonym. We may require identification where it is impracticable to deal with you anonymously, where identification is required or authorised by law, or where it is needed to provide products, services, support, bookings, memberships, account access or other functionality.

Why we collect, hold, use and disclose information

We may collect, hold, use and disclose personal information to:

• respond to enquiries and communicate with you
• provide and improve products, services and website functionality
• process orders, payments and transactions
• administer bookings, memberships, accounts, events and registrations
• provide customer support
• manage business relationships and internal administration
• perform analytics, reporting and service improvement
• maintain security and detect spam, fraud, misuse or unlawful activity
• comply with legal obligations and lawful requests
• send marketing communications where permitted
• manage complaints, disputes and legal claims

Disclosure of personal information

We may disclose personal information where reasonably necessary for the purposes described in this Policy, including to:

• employees and authorised contractors
• website hosting, cloud, IT and security providers
• email, communications and customer-management providers
• analytics and marketing providers
• payment processors and financial service providers
• booking, event and membership platforms
• delivery, logistics and fulfilment providers
• professional advisers, insurers and auditors
• government agencies, regulators, courts and law-enforcement bodies where required or authorised by law
• a purchaser or successor in connection with a proposed or completed business sale, restructure or transfer, subject to appropriate safeguards

We will not use or disclose personal information for a secondary purpose unless the use or disclosure is permitted by law, including where consent has been obtained or an applicable exception applies. We do not sell personal information unless that practice is expressly disclosed and lawful.

Overseas disclosure

We may use third-party service providers located in Australia and overseas. These may include hosting, cloud software, email, analytics, marketing, payment, booking and membership providers.

Personal information may therefore be stored, accessed or processed outside Australia. Where practicable, we will identify the countries in which overseas recipients are likely to be located.

Before disclosing personal information to an overseas recipient, we will take such steps as are reasonable in the circumstances to require the recipient to handle the information consistently with the APPs, unless an exception under the Privacy Act applies. Where applicable, we may remain accountable under the Privacy Act for acts or practices of the overseas recipient.

Cookies and tracking technologies

Our website may use cookies and similar technologies to operate the website, improve functionality and security, remember preferences, maintain sessions, perform analytics and support advertising or marketing.

• remember preferences and form details
• maintain login sessions and account settings
• support comments and content-management functions
• measure website performance and usage
• support advertising measurement and personalisation
• detect malicious activity, fraud, spam or abuse

You can control cookies through browser settings, although disabling some cookies may affect functionality. Where consent or privacy preference controls are implemented, you may be able to manage non-essential cookies and similar technologies.

Embedded content and third-party services

Our website may include third-party videos, images, articles, maps, social media feeds, forms, booking engines, payment gateways or applications. Embedded content may behave as if you visited the third-party website directly. The provider may collect information, use cookies, add tracking and monitor interactions, including where you are logged in to that provider. Review the provider’s privacy policy.

Spam detection and security monitoring

Information submitted through forms, comments, registrations, logins and other interactions may be processed by automated systems or service providers for spam detection, malware protection, fraud prevention, abuse prevention, security monitoring and website protection.

Data quality

We will take reasonable steps to make sure that personal information we collect is accurate, up to date and complete, and that personal information we use or disclose is accurate, up to date, complete and relevant, having regard to the purpose of the use or disclosure.

Security of personal information

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure. Measures may include secure hosting, access controls, authentication, encryption where appropriate, backups, monitoring, patching, malware protection and staff or contractor controls.

No method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, but we will respond to identified risks and incidents under applicable obligations.

Data retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including service delivery, business and transaction records, account administration, comments, bookings, memberships, legal obligations, disputes and security.

Retention periods vary by information type, website configuration, operational need and legal requirement. When information is no longer required, we will take reasonable steps to destroy or de-identify it unless retention is required or authorised by law.

Access, correction, export and deletion requests

You may request access to personal information we hold about you and correction of information that is inaccurate, out of date, incomplete, irrelevant or misleading. If the Privacy Act applies, we will respond within the periods and in the manner required by APP 12 and APP 13. Where website functionality permits, you may also request an export of data associated with your account or comments, or request deletion. A WordPress export or erasure request does not create a broader legal right to deletion where no such right applies.

Access, correction, export and deletion requests are subject to applicable law. We may refuse or limit a request where a lawful ground permits us to do so, and may retain information for legal, accounting, administrative, dispute-resolution or security purposes. We may require reasonable proof of identity. If we refuse access or correction, we will provide written notice and reasons where required by law, together with available complaint mechanisms.

Direct marketing

We may use or disclose personal information for direct marketing only where permitted by applicable law. Commercial electronic messages will be sent in accordance with the Spam Act 2003 (Cth), including applicable consent, sender-identification and unsubscribe requirements.

You may request that we stop sending direct marketing communications by using the unsubscribe facility in the message, updating your preferences or contacting us. We will action an opt-out request within the period required by law. We may continue to send service, account, transaction, safety or legal notices that are not direct marketing.

Data breaches

If we have reasonable grounds to suspect that an eligible data breach may have occurred, we will carry out the assessment required by applicable law. If we have reasonable grounds to believe that an eligible data breach has occurred, we will prepare any required statement and notify affected individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme, subject to any lawful exception.

Privacy complaints

If you believe we have not handled your personal information appropriately, contact us using the details below. Complaints should be made in writing where possible and include enough information for investigation.

We will acknowledge the complaint, investigate it fairly and provide a written response within a reasonable period. We aim to provide a substantive response within 30 days where reasonably practicable. If additional time is required, we will advise you of the reason and the expected response date.

If you are not satisfied with our response and the Privacy Act applies, you may contact the Office of the Australian Information Commissioner: https://www.oaic.gov.au/. Other regulators or external dispute-resolution bodies may apply depending on the circumstances.

E-commerce and online payments

Online orders and payments

We may collect order, billing, delivery, contact and transaction information needed to process and fulfil transactions, provide support, manage refunds or disputes, maintain records and meet legal obligations. Payments may be processed by authorised third-party providers. Unless stated otherwise, we do not store complete payment-card details on our systems.

Fraud prevention

We and our payment or security providers may use transaction and technical information to detect, investigate and prevent fraud, unauthorised transactions and unlawful activity.

Changes to this Policy

We may update this Privacy Policy to reflect changes to our practices, website, services or legal obligations. The updated version will be published on our website and take effect from the effective date shown above. Review this Policy periodically.