Privacy Policy

1. Introduction

Booking Club Pty Ltd (ABN 89 699 101 025) ("BookingClub," "we," "us," or "our") is committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you use the BookingClub website and related services (collectively, the "Platform"). By using the Platform, you consent to the collection and use of your personal information as described in this Privacy Policy.

1.1 Definitions

Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether recorded in a material form or not.

Sensitive Information means personal information about an individual's racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sexual orientation, criminal record, health information, genetic or biometric data.

2. Information We Collect

2.1 Information You Provide Directly

When you register for a BookingClub membership, use our services, or communicate with us, you may provide the following personal information:

Account Registration:

• Full name
• Email address
• Residential address (street, suburb, state, postcode)
• Mobile phone number
• Password (stored in encrypted form)
• Your confirmation that you are 18 or over, given when you join or upgrade to Club Pass or Club Pass+, and when you gave it
• The version of our Membership Terms, Competition Terms and this Privacy Policy that you accepted when you joined or upgraded, and when you accepted it

Members who joined before 8 October 2026 may also have given their date of birth. We keep it with their account and delete it when the account is closed.

Payment Information:

• Credit card or debit card details and billing address (processed and stored by our payment processor, Stripe; we do not store full card details)
• Payment history and transaction records

Identity Verification (including for prize winners):

• Government-issued identification documents (driver's licence, passport), where required, including to check a prize winner's age, identity and residency

Travel Booking Information:

• Guest names for each booking (the lead guest and anyone else you book for)
• Travel preferences and booking history
• Special requirements (dietary restrictions, accessibility needs)

Communications:

• Customer support enquiries and correspondence
• Feedback and survey responses
• Marketing preference selections

Pre-Launch Waitlist (closed at launch):

• Before launch, we collected an email address and, optionally, a first name through the public waitlist form
• At the time, they were used solely to confirm the signup and to send launch updates, which then included early access and founding member availability; the founding offer closed on 3 October 2026
• Not shared with anyone except our email delivery provider
• The waitlist record of someone who went on to open an account is removed on request (by emailing concierge@bookingclub.com.au) and when that account is closed
• This policy promises that waitlist records not converted to an account are deleted within 90 days of launch (10 July 2026)

2.2 Information Collected Automatically

When you access or use the Platform, we automatically collect certain information:

Device and Usage Information:

• IP address and general geographic location derived from IP address
• Device type, operating system, and browser type
• Pages visited, features used, time spent on the Platform, and click patterns

Cookies:

• On the BookingClub website we use essential and preference cookies required to operate the service, and payment cookies set by our payment providers. With your consent (via the cookie banner), we also use analytics and advertising cookies set by Google (Google Analytics) and Meta (Meta Pixel) to understand site traffic and measure our advertising; without your consent these are never loaded. Separately, if you arrive through an ambassador referral link, a third-party service and we each set a cookie for referral attribution. See Section 10 (Cookie Policy) for details.

Email Engagement:

• Our email provider records opens and link clicks to measure delivery and engagement.

Diagnostic Data:

• Error logs and diagnostic information generated by our own systems for security, fraud prevention, and service improvement

2.3 Information from Third Parties

We may receive personal information about you from the following third-party sources:

Travel Platform (LiteAPI, operated by Nuitée):

• Travel booking confirmations, history, and preferences related to bookings you make through the Platform

Payment Processor (Stripe):

• Payment method verification status
• Fraud detection signals
• Transaction success or failure information

Referral Partner:

• If you arrive through an ambassador referral link, our referral partner tells us which ambassador referred you, so the referral can be credited when you subscribe. We record that ambassador's referral code on your account when you join or upgrade

We do not receive information about you from social media platforms, advertising networks, or data brokers.

2.4 Sensitive Information

We do not actively collect sensitive information as defined by the Privacy Act. However, you may voluntarily provide sensitive information in limited circumstances, for example health information when requesting special assistance for travel, or an identity document you provide to claim a prize, which may indicate your nationality or place of birth. If you provide sensitive information, you consent to our collection, use, and disclosure of that information for the purposes for which it was provided.

3. How We Use Your Information

We collect and use your personal information for the following purposes:

3.1 Service Delivery

• Creating and maintaining your membership account
• Authenticating your identity and managing account security
• Processing subscription payments and managing billing
• Processing membership upgrades, downgrades, and cancellations
• Facilitating travel bookings through our travel platform partnership
• Calculating and allocating promotional entries for prize draws (loyalty accrual and referral bonuses)
• Conducting monthly prize draws, verifying winner eligibility, and coordinating prize fulfilment
• Publishing winner announcements for prizes over $1,000 (first name, surname initial and state, for a minimum of 28 days; see Section 4.3)
• Providing customer support and responding to enquiries

3.2 Communication

• Sending transactional emails (confirmations, receipts, notifications)
• Notifying you about draw results and prize wins
• Sending service updates and important account information
• Delivering marketing communications (with your consent)

3.3 Service Improvement

• Analysing usage patterns using our own systems to improve the service
• Conducting research and development
• Personalising your experience
• Monitoring and preventing fraud and security issues

Third-party analytics (Google Analytics) and advertising measurement (Meta) run only if you consent via the cookie banner; our default is essential cookies only.

3.4 Legal and Regulatory Compliance

• Complying with trade-promotion regulatory requirements and maintaining draw records
• Publishing winner information as required by law
• Responding to lawful requests from government authorities
• Enforcing our Membership Terms and other policies
• Protecting our rights, property, and safety, and the rights, property, and safety of our members and the public

3.5 Direct Marketing

We may use your personal information to send you direct marketing communications about our products, services, and special offers, with your consent. You may opt out at any time by:

• Clicking the "unsubscribe" link in marketing emails
• Adjusting your communication preferences in your account settings
• Contacting us at privacy@bookingclub.com.au

You cannot opt out of transactional or service-related communications (for example, account confirmations, payment receipts, prize notifications, or security alerts).

4. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We share your information with third parties only in the following circumstances:

4.1 Service Providers

Stripe (Payment Processing):

• We share payment information with Stripe to process membership and hotel booking payments and refunds. Stripe's use of your personal information is governed by its privacy policy.

Travel Platform (LiteAPI, operated by Nuitée):

• To book a hotel we share the details needed to source and confirm your stay (your name and email address as the person making the booking, the name of each guest, and the hotel, room and stay dates) with LiteAPI, the travel technology platform operated by Nuitée, which processes data in the United States (see Section 5). LiteAPI passes these details to the wholesale accommodation supplier the room is sourced from. You must have the permission of the guests you book for to provide their names.

Hotels:

• The hotel or property you book receives the guest names and stay details so it can hold your reservation and check you in. The hotel handles this information under its own privacy policy, in the country where it is located, which for an overseas stay is your destination country.

Hosting Provider:

• Our application is hosted and deployed with a third-party cloud hosting provider, which processes data stored by the Platform to the extent necessary to provide hosting infrastructure.

AI Search Provider (Anthropic):

• Our plain-English hotel search uses Anthropic's Claude AI to understand what you type into the search box. Only the text you type and today's date are sent (not your name, email or account details), and Anthropic processes this data in the United States (see Section 5). Please do not include personal details in your search text: anything you type there is sent to Anthropic with it.

Email Service Provider (Resend):

• We use Resend to send transactional and (with consent) marketing emails. Resend receives your email address and the emails we send you, which may include your name, and processes this data in the United States (see Section 5). Our email provider records opens and link clicks to measure delivery and engagement.

Business Email (Google Workspace):

• Our business email, including the inboxes you write to for support and privacy requests, runs on Google Workspace. Emails you send us, our replies, and any details you include are stored by Google, which processes data in the United States and other countries where it operates data centres (see Section 5).

Referral and Attribution Provider:

• We use a third-party referral-tracking provider to run our ambassador program. If you arrive through an ambassador referral link, limited information (a referral identifier and your subscription event) is processed by that provider so the referring ambassador can be credited. This provider processes data in the United States (see Section 5). It is not used for advertising or to build a profile of you.

Analytics and Advertising (consent-based):

• If you consent via the cookie banner, Google (Google Analytics) and Meta (Meta Pixel and Conversions API) receive usage and conversion data (such as pages viewed and signup events, and for completed purchases a hashed email) to help us understand traffic and measure our advertising. Both process data in the United States. If you choose essential-only, no data is shared with them from your browser.

These service providers are contractually obligated to protect your information and use it only for the purposes we specify. Beyond the consent-based analytics and advertising services described above, we do not share your information with advertising networks or social media platforms.

4.2 Legal and Regulatory Authorities

We may disclose your personal information to government authorities, law enforcement agencies, or regulatory bodies when:

• Required by law, court order, subpoena, or other legal process
• Necessary to comply with trade-promotion reporting requirements
• Necessary to protect our rights, property, or safety, or the rights, property, or safety of others
• Necessary to investigate, prevent, or take action regarding suspected illegal activities, fraud, or violations of our Membership Terms

4.3 Winner Publication

For transparency, we publish the winner of any prize valued over $1,000 AUD on our website in first name, surname initial and state format, for a minimum of 28 days. Publication in this format is a condition of accepting a prize and cannot be opted out of if you win. Any additional publicity beyond that listing (such as a winner story or photo) only occurs with your separate consent (see the Competition Terms).

4.4 Corporate Transactions

In the event of a merger, acquisition, reorganisation, asset sale, or similar corporate transaction, your personal information may be transferred to the acquiring entity. We will notify you of any such change.

4.5 With Your Consent

We may share your personal information with third parties for purposes not described in this Privacy Policy with your explicit consent.

4.6 AI Assistants You Connect

You can choose to connect your BookingClub account to an AI assistant you use, such as ChatGPT or Claude. You sign in on BookingClub and approve the connection yourself.

Once connected, the assistant can, when you ask it to:

• search hotels at your member prices;
• see your membership plan, any hotel credit, your bookings (hotel, dates and status) and your prize draw entries;
• prepare a booking link for you to review and pay on BookingClub.

It cannot make a booking, take a payment, spend your credit or change your account.

When you use a connected assistant, the information it asks for is sent to that assistant's provider and handled under their privacy policy and terms. The provider may store it outside Australia (see Section 5). We don't see your conversations with the assistant. We receive only the details the assistant sends to BookingClub to answer your request, such as destination, dates and number of guests. We keep a record of which apps you have connected, when, and which features they used.

You can disconnect an assistant at any time in Account Settings under AI assistants. Changing your password, signing out of all devices or closing your account also disconnects every assistant.

5. International Data Transfers

BookingClub is based in Australia. Some of our service providers store or process data outside Australia, including:

• United States (Stripe payment processing, our cloud hosting provider, our email provider Resend, our travel technology platform LiteAPI and its operator Nuitée, Google Workspace for our business email, Anthropic for plain-English hotel search, our referral-tracking provider, and, with your consent, Google and Meta analytics/advertising services)
• The country where the hotel you book is located (for an overseas stay, your destination country), which receives the guest names and stay details for that booking
• Other countries where Google operates data centres for Google Workspace, and where the wholesale accommodation suppliers that LiteAPI sources rooms from are based

When we transfer personal information outside Australia, we take steps to ensure that your information receives a standard of protection comparable to the protection under the Australian Privacy Principles. This may include standard contractual clauses or reliance on the recipient's privacy framework. By using the Platform, you consent to the transfer of your personal information outside Australia in accordance with this Privacy Policy.

6. Data Security

We implement reasonable technical, administrative, and physical security measures to protect your personal information from unauthorised access, disclosure, alteration, or destruction. These measures include:

Technical Safeguards:

• Encryption of data in transit using TLS/SSL protocols
• Secure password hashing using industry-standard algorithms
• Secure storage on servers with restricted access
• No storage of full credit card details (Stripe handles all payment data)
• Security reviews and vulnerability assessments

Administrative Safeguards:

• Access controls limiting access to personal information to authorised personnel on a need-to-know basis
• Incident response and breach notification procedures

Despite these measures, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your personal information. You are responsible for maintaining the confidentiality of your account credentials.

7. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

Account and Payment Information: Retained for the duration of your membership and for up to seven (7) years after account closure to comply with Australian tax and business record-keeping requirements.

Promotional Draw Records: Retained as required by trade-promotion regulatory obligations. Winner information (name, contact details, the prize awarded and how it was delivered) is retained for seven (7) years after the draw and then deleted, except the first name, surname initial and state shown on the Platform's winners list.

Travel Booking Information: Retained for up to seven (7) years after travel completion to comply with consumer protection and dispute resolution requirements.

Communications and Support Records: Retained to facilitate ongoing support and dispute resolution.

After the applicable retention period expires, we securely delete or anonymise your personal information.

8. Your Rights and Choices

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the following rights regarding your personal information:

8.1 Right to Access

You have the right to request access to the personal information we hold about you. Submit a written request to privacy@bookingclub.com.au with sufficient information to verify your identity. We will respond within thirty (30) days. We may refuse access in limited circumstances permitted by law, in which case we will provide a written explanation.

8.2 Right to Correction

You can request correction of inaccurate, out-of-date, incomplete, irrelevant, or misleading personal information by contacting privacy@bookingclub.com.au. You can also update most information directly through your account dashboard. We will respond to correction requests within thirty (30) days.

8.3 Right to Deletion

You can request deletion of your personal information, subject to legal retention requirements. Deleting your account will remove most personal data, but some information must be retained for compliance purposes (for example, tax records and draw records required by law). We will assess deletion requests on a case-by-case basis.

8.4 Marketing Opt-Out

You can opt out of marketing communications at any time by clicking "unsubscribe" in emails or updating your communication preferences in your account settings. You will still receive transactional emails related to your membership and bookings.

8.5 Right to Complain

If you believe we have breached the Australian Privacy Principles or handled your personal information inappropriately, please contact us first at privacy@bookingclub.com.au. We will acknowledge your complaint within seven (7) days and provide a written response within thirty (30) days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

Office of the Australian Information Commissioner
Website: www.oaic.gov.au
Email: enquiries@oaic.gov.au
Phone: 1300 363 992
Mail: GPO Box 5218, Sydney NSW 2001

9. Children's Privacy

The Platform is not intended for individuals under the age of eighteen (18). Club Pass and Club Pass+ members confirm they are 18 or over when they join or upgrade, a prize winner's age is checked with government-issued photo identification before any prize is awarded, and we do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected personal information from a person under 18, we will delete that information promptly.

If you are a parent or guardian and believe a minor has provided personal information to us, please contact us at privacy@bookingclub.com.au so we can take appropriate action.

10. Cookie Policy

10.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. Cookies allow the website to recognise your device and remember information about your visit, such as your preferences and login status.

10.2 Cookies on the BookingClub Website

On the BookingClub website itself, we use only the following categories of cookies:

Essential Cookies:

• Enable core functionality such as account authentication, session management, and security
• Cannot be disabled without severely affecting Platform functionality

Preference Cookies:

• Remember your settings and preferences (for example, display settings)

Payment Cookies (Stripe):

• Set by our payment processor, Stripe, to process payments securely and prevent fraud

10.3 Analytics and Advertising Cookies (Only With Your Consent)

If you choose "Accept all" in the cookie banner, we load Google Analytics (traffic and usage analytics) and the Meta Pixel (advertising measurement), each of which sets its own cookies and processes data in the United States. If you choose "Essential only" (or make no choice), these tools are never loaded and no analytics or advertising cookie is set. You can change your mind at any time by clearing this site's data in your browser, which brings the banner back.

10.4 Referral Cookies

If you visit through an ambassador referral link, our third-party referral-tracking partner may set a cookie on your device to attribute the referral, so the referring ambassador can be credited when you subscribe. We also keep the referral code from the ambassador's link in a cookie of our own for 60 days, and record it on your account when you join or upgrade, so the right ambassador is credited and no ambassador is credited for their own membership. These cookies are used only for referral attribution. They are not used for advertising or to build a behavioural profile of you. Our referral partner processes its data in the United States. If you do not arrive through a referral link, these cookies are not relevant to your visit.

10.5 Travel Booking and Payment

Hotel bookings are made on the BookingClub website. To complete a booking we share the details needed to source and confirm your stay (such as guest names and stay dates) with our travel technology platform (LiteAPI, operated by Nuitée), the wholesale accommodation supplier and the hotel you book. Your payment for the booking is taken by BookingClub through our payment processor, Stripe. These providers process that data to fulfil your booking and are governed by their own privacy policies. We do not send your data to them for their own marketing.

10.6 Managing Cookies

You can control and manage cookies through your browser settings, including viewing, blocking, and deleting cookies. Please note that disabling essential or payment cookies may limit your ability to use the Platform, including logging in and making payments.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. We will notify you of material changes by:

• Posting the updated Privacy Policy on the Platform with a new "Last Updated" date
• Sending an email notification to the address associated with your account
• Displaying a prominent notice on the Platform

Your continued use of the Platform after the effective date of the updated Privacy Policy constitutes acceptance of the changes. If you do not agree to the updated Privacy Policy, you must discontinue use of the Platform and may cancel your membership.

12. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact:

Privacy Officer
Booking Club Pty Ltd
Email: privacy@bookingclub.com.au
Mail: Level 3 / 55 Collins St, Melbourne VIC 3000
ABN: 89 699 101 025

For general enquiries, you may also contact:
Email: concierge@bookingclub.com.au
Website: www.bookingclub.com.au

We aim to respond to all privacy enquiries within five (5) business days.