ADRENALINE SPORTS (QLD) PTY LTD

PRIVACY POLICY

Personal Information, Participant Data & Payment Information

 1. Our Commitment to Privacy

Adrenaline Sports (QLD) Pty Ltd (Adrenaline Sports, we, us or our) respects the privacy of our customers, participants, visitors, employees, contractors and other individuals whose personal information we collect and hold.

This Privacy Policy explains how Adrenaline Sports collects, uses, stores, protects and discloses personal information and, where applicable, sensitive information.

Where the Privacy Act 1988 (Cth) applies to Adrenaline Sports, we handle personal information in accordance with the Australian Privacy Principles (APPs). We also seek to apply appropriate privacy and information-security practices to personal information regardless of whether a particular legal exemption applies.

2. Who This Policy Applies To

This Privacy Policy applies to personal information collected by Adrenaline Sports through or in connection with:

·        our website and online services;

·        online booking systems;

·        online participant indemnity, waiver and declaration forms;

·        the APEX timing system and its secure cloud-based database;

·        Airtable, where basic customer contact and booking-related information is held;

·        telephone and email enquiries;

·        participant registration and check-in;

·        safety and risk assessment processes;

·        CCTV, photographs and security systems where applicable;

·        feedback, complaints and incident reporting;

·        payment and transaction systems; and

·        other interactions with Adrenaline Sports.

3. What Is Personal Information?

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is recorded in material form or not.

Depending on the circumstances, Adrenaline Sports may collect:

·        full name, date of birth and age;

·        telephone/mobile number and email address;

·        residential or postal address where reasonably necessary;

·        emergency contact details;

·        booking and participation details;

·        participant declarations, waivers and indemnity information;

·        information relevant to participant safety;

·        incident and accident information;

·        photographs, video or CCTV images where applicable;

·        transaction details, payment status and refund information; and

·        limited payment-card information handled through our payment provider.

4. Sensitive Information and Health Information

Some information collected in connection with participation in our activities may constitute sensitive information under the Privacy Act, including health or medical information where it is reasonably necessary for participant safety or another permitted purpose.

Examples may include medical conditions relevant to participation, allergies, injuries, physical limitations or other information voluntarily disclosed through a participant safety or indemnity process.

Where the Privacy Act applies, Adrenaline Sports will only collect sensitive information where permitted by law and, where required, with appropriate consent. We will limit collection to information reasonably necessary for the relevant purpose.

5. How We Collect Personal Information

We generally collect personal information directly from the individual concerned, including when a person:

·        makes a booking;

·        completes an online participant indemnity, waiver or declaration form;

·        participates in an Adrenaline Sports activity;

·        contacts us by telephone or email;

·        provides feedback or makes a complaint;

·        enters a competition or promotion;

·        interacts with our website or social media; or

·        provides information for safety, emergency or operational purposes.

Information may also be provided by a parent or guardian, emergency contact, corporate customer, booking agent, insurer, service provider, government authority or other person where reasonably necessary and permitted by law.

6. Why We Collect Personal Information

We may collect, hold, use and disclose personal information for purposes including:

·        processing and managing bookings;

·        providing customer service and communicating booking information;

·        administering participant registrations, indemnities and declarations;

·        managing participant safety and emergency response;

·        contacting emergency contacts where reasonably necessary;

·        managing incidents, accidents, complaints and insurance matters;

·        processing payments, refunds and accounting records;

·        maintaining business and operational records;

·        complying with legal, regulatory and insurance obligations;

·        improving our services and business operations; and

·        sending direct marketing where permitted by law and subject to applicable opt-out requirements.

7. Systems Used to Store Customer Information

7.1 APEX Timing System

Customer and participant details obtained through our online participant indemnity/waiver process and booking information are held in the secure cloud-based database associated with the APEX timing system used by Adrenaline Sports.

Access to APEX information is restricted to authorised personnel who require access for legitimate operational, safety, customer service, administration or other authorised business purposes.

7.2 Airtable

Basic customer information and contact details may also be held in Airtable for booking administration, customer communication and operational purposes. The information held in Airtable is limited to what is reasonably required for these purposes.

Access to Airtable records is restricted to authorised personnel and is managed using account and access controls appropriate to the information held.

7.3 Payment Information – Zeller

Adrenaline Sports uses Zeller as an EFTPOS/payment provider. Payment-card transactions may therefore be processed through Zeller's payment systems and related financial services.

Adrenaline Sports does not intentionally retain complete credit or debit card numbers, CVV/CVC security codes, PINs, magnetic-stripe track data or other sensitive payment authentication data in its own customer databases.

Where limited payment information or a payment reference is made available to Adrenaline Sports, such information will be handled only for legitimate business purposes such as reconciling transactions, refunds, accounting or customer service.

Where payment-card information is stored or processed by Zeller or another payment provider, that information is subject to the provider's own security controls, terms and privacy documentation. Adrenaline Sports will not request customers to provide complete card details by ordinary email, SMS or other unsecured communication channels.

8. How We Protect Personal Information

Adrenaline Sports takes reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Security measures may include:

·        restricted user access and role-based permissions;

·        unique user accounts and strong authentication controls;

·        multi-factor authentication where available and appropriate;

·        secure cloud-based systems;

·        access controls for APEX, Airtable and other business systems;

·        software and security updates;

·        secure backups where appropriate;

·        confidentiality obligations for staff and contractors;

·        physical security of business premises and records;

·        secure disposal or deletion procedures; and

·        procedures for identifying and responding to suspected data breaches.

9. Payment Card and Credit Card Security

Adrenaline Sports seeks to minimise the amount of payment-card information that it stores or handles directly. Card payments are processed through authorised payment providers such as Zeller.

Adrenaline Sports will not intentionally store CVV/CVC security codes or other sensitive authentication data after payment authorisation. Where cardholder information is not required for an ongoing legitimate business purpose, it will not be retained.

Staff must not write down, photograph, email, text, copy into spreadsheets, or otherwise record a customer's full card number or CVV/CVC security code unless a specific lawful and secure process has been formally approved.

Customers should never send full card details or CVV/CVC information to Adrenaline Sports by email, SMS, social media message or ordinary written correspondence.

10. Access to Personal Information

You may request access to personal information that Adrenaline Sports holds about you. We may need to verify your identity before providing access. Access may be refused where permitted or required by applicable law.

Requests should be directed to the Privacy Contact listed in Section 23.

11. Correction of Personal Information

We take reasonable steps to ensure that personal information we hold is accurate, complete and up to date. If you believe information we hold is inaccurate, incomplete or out of date, please contact us and request correction.

12. Retention and Secure Disposal

Adrenaline Sports will retain personal information only for as long as reasonably necessary for the purpose for which it was collected, or where retention is required or permitted by law.

Retention periods may vary because information may be required for:

·        accounting and taxation purposes;

·        insurance and claims management;

·        incident and accident records;

·        legal or regulatory obligations;

·        participant and booking administration;

·        dispute resolution; or

·        legitimate operational and business purposes.

When personal information is no longer required, Adrenaline Sports will take reasonable steps to securely destroy, delete or de-identify it, subject to any applicable retention requirement.

13. Disclosure of Personal Information

Personal information may be disclosed where reasonably necessary to:

·        payment providers, including Zeller;

·        booking and timing system providers, including APEX;

·        cloud and database service providers, including Airtable where applicable;

·        accountants, insurers, brokers and professional advisers;

·        IT and other service providers;

·        emergency services or medical professionals where appropriate;

·        government agencies or regulators where required or authorised by law; or

·        other persons where the individual has consented or disclosure is otherwise permitted or required by law.

Adrenaline Sports does not sell personal information to third parties for their independent marketing purposes.

14. Overseas Disclosure and Cloud Services

Some technology, cloud, booking, payment or software providers used by Adrenaline Sports may store or process information outside Australia. Where required by the Privacy Act, Adrenaline Sports will take reasonable steps to address applicable requirements before disclosing personal information to an overseas recipient.

Because cloud and software providers may change their infrastructure and hosting arrangements, the location of data storage may vary over time. Further information may be requested from our Privacy Contact.

15. Cookies, Analytics and Website Technologies

Our website may use cookies and similar technologies to operate the website, remember preferences, understand website usage, measure performance and, where permitted, support marketing activities. Third-party services may collect information in accordance with their own privacy policies.

16. CCTV, Photographs and Video

For safety, security, incident management, operational and promotional purposes, Adrenaline Sports may use CCTV, photographs or video at our premises or during activities.

Images collected for security or incident management will not ordinarily be used for unrelated marketing. Where photographs or video are used for promotional purposes, Adrenaline Sports will take reasonable steps to obtain any consent required by law.

17. Children and Minors

Adrenaline Sports may provide activities to persons under 18 years of age. Information concerning a minor may be collected from or provided by a parent or legal guardian where appropriate. We will take reasonable steps to ensure information relating to minors is handled appropriately and only used for legitimate purposes.

18. Data Breaches

Adrenaline Sports maintains procedures for identifying, containing, assessing and responding to suspected or actual data breaches.

Where the Privacy Act's Notifiable Data Breaches scheme applies and an incident constitutes an eligible data breach, Adrenaline Sports will comply with applicable notification obligations, including notification to affected individuals and the Office of the Australian Information Commissioner where required.

19. Direct Marketing

Adrenaline Sports may send direct marketing communications where permitted by law. Customers may opt out at any time using the unsubscribe facility provided or by contacting us.

Opting out of marketing will not prevent us from sending essential communications concerning bookings, payments, safety, incidents or other transactions.

20. Third-Party Service Providers

Adrenaline Sports uses third-party service providers to support its business. Relevant providers include, but are not limited to, Zeller for EFTPOS/payment services, APEX for timing and associated participant/booking data, and Airtable for limited customer contact and booking administration.

We take reasonable steps to ensure service providers that handle personal information on our behalf have appropriate security and privacy arrangements, having regard to the nature and sensitivity of the information.

21. Staff and Contractor Access

Access to personal information is restricted to personnel who reasonably require access for their role. Staff and contractors may be subject to confidentiality, privacy, information-security and incident-reporting requirements.

22. Privacy Complaints

If you believe Adrenaline Sports has mishandled your personal information, please contact us using the details below. We will investigate the complaint and provide a response within a reasonable period.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) through its privacy complaints process.

23. Contact Details

24. Changes to This Privacy Policy

Adrenaline Sports may update this Privacy Policy from time to time to reflect changes to our business, technology, service providers, privacy practices or applicable law. The current version will be made available through our website. The Effective Date and Version shown at the beginning of this document identify the current version.