Privacy Policy

1. Introduction

Booking Club Pty Ltd (ABN 89 699 101 025) ("BookingClub," "we," "us," or "our") is committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, use, disclose, store, and protect your personal information when you use the BookingClub website and related services (collectively, the "Platform"). By using the Platform, you consent to the collection and use of your personal information as described in this Privacy Policy.

1.1 Definitions

Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether recorded in a material form or not.

Sensitive Information means personal information about an individual's racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sexual orientation, criminal record, health information, genetic or biometric data.

2. Information We Collect

2.1 Information You Provide Directly

When you register for a BookingClub membership, use our services, or communicate with us, you may provide the following personal information:

Account Registration:

• Full name
• Email address
• Date of birth
• Residential address (street, suburb, state, postcode)
• Mobile phone number
• Password (stored in encrypted form)

Payment Information:

• Credit card or debit card details and billing address (processed and stored by our payment processor, Stripe; we do not store full card details)
• Payment history and transaction records

Identity Verification (including for prize winners):

• Age verification data
• Government-issued identification documents (driver's license, passport), where required

Travel Booking Information:

• Passport details (number, expiry date, issuing country)
• Travel preferences and booking history
• Special requirements (dietary restrictions, accessibility needs)

Communications:

• Customer support inquiries and correspondence
• Feedback and survey responses
• Marketing preference selections

Pre-Launch Waitlist:

• Email address and, optionally, first name, collected through the public waitlist form
• Used solely to confirm the signup and to send launch updates, including early access and founding member availability
• Not shared with anyone except our email delivery provider
• Removed on request (unsubscribe link in every email, or by emailing concierge@bookingclub.com.au); waitlist records not converted to an account are deleted within 90 days of launch

2.2 Information Collected Automatically

When you access or use the Platform, we automatically collect certain information:

Device and Usage Information:

• IP address and general geographic location derived from IP address
• Device type, operating system, and browser type
• Pages visited, features used, time spent on the Platform, and click patterns

Cookies:

• On the BookingClub website we use essential and preference cookies required to operate the service, and payment cookies set by our payment providers. With your consent (via the cookie banner), we also use analytics and advertising cookies set by Google (Google Analytics) and Meta (Meta Pixel) to understand site traffic and measure our advertising; without your consent these are never loaded. Separately, a third-party service may set its own cookie if you arrive through an ambassador referral link (attribution) or when a booking is processed by our travel payment partner. See Section 10 (Cookie Policy) for details.

Diagnostic Data:

• Error logs and diagnostic information generated by our own systems for security, fraud prevention, and service improvement

2.3 Information from Third Parties

We may receive personal information about you from the following third-party sources:

Travel Platform Partner:

• Travel booking confirmations, history, and preferences related to bookings you make through the Platform

Payment Processor (Stripe):

• Payment method verification status
• Fraud detection signals
• Transaction success or failure information

Referral Partner:

• If you arrive through an ambassador referral link, our referral partner tells us which ambassador referred you, so the referral can be credited when you subscribe

We do not receive information about you from social media platforms, advertising networks, or data brokers.

2.4 Sensitive Information

We do not actively collect sensitive information as defined by the Privacy Act. However, you may voluntarily provide sensitive information in limited circumstances, for example health information when requesting special assistance for travel, or passport information that may indicate nationality or place of birth. If you provide sensitive information, you consent to our collection, use, and disclosure of that information for the purposes for which it was provided.

3. How We Use Your Information

We collect and use your personal information for the following purposes:

3.1 Service Delivery

• Creating and maintaining your membership account
• Authenticating your identity and managing account security
• Processing subscription payments and managing billing
• Processing membership upgrades, downgrades, and cancellations
• Facilitating travel bookings through our travel platform partnership
• Calculating and allocating promotional entries for prize draws (loyalty accrual and referral bonuses)
• Conducting monthly prize draws, verifying winner eligibility, and coordinating prize fulfillment
• Publishing winner announcements for prizes over $1,000 (first name and suburb/state, for a minimum of 28 days; see Section 4.3)
• Providing customer support and responding to inquiries

3.2 Communication

• Sending transactional emails (confirmations, receipts, notifications)
• Notifying you about draw results and prize wins
• Sending service updates and important account information
• Delivering marketing communications (with your consent)

3.3 Service Improvement

• Analyzing usage patterns using our own systems to improve the service
• Conducting research and development
• Personalizing your experience
• Monitoring and preventing fraud and security issues

Third-party analytics (Google Analytics) and advertising measurement (Meta) run only if you consent via the cookie banner; our default is essential cookies only.

3.4 Legal and Regulatory Compliance

• Complying with trade-promotion regulatory requirements and maintaining draw records
• Publishing winner information as required by law
• Responding to lawful requests from government authorities
• Enforcing our Membership Terms and other policies
• Protecting our rights, property, and safety, and the rights, property, and safety of our members and the public

3.5 Direct Marketing

We may use your personal information to send you direct marketing communications about our products, services, and special offers, with your consent. You may opt out at any time by:

• Clicking the "unsubscribe" link in marketing emails
• Adjusting your communication preferences in your account settings
• Contacting us at privacy@bookingclub.com.au

You cannot opt out of transactional or service-related communications (for example, account confirmations, payment receipts, prize notifications, or security alerts).

4. How We Share Your Information

We do not sell, rent, or trade your personal information to third parties for their marketing purposes. We share your information with third parties only in the following circumstances:

4.1 Service Providers

Stripe (Payment Processing):

• We share payment information with Stripe to process subscription payments and refunds. Stripe's use of your personal information is governed by its privacy policy.

Travel Platform Partner:

• We share necessary personal information (name, contact details, travel preferences, and passport information where required) with our travel platform partner and the relevant travel service providers (airlines, hotels, and similar) to facilitate travel bookings and reservations. This includes the names of guests you book for, which you must have their permission to provide. Our travel platform partner processes data in the United States (see Section 5).

Railway (Hosting):

• Our application is hosted and deployed on Railway. Railway processes data stored by the Platform to the extent necessary to provide hosting infrastructure.

Email Service Provider:

• We use an email delivery provider to send transactional and (with consent) marketing emails.

Referral and Attribution Provider:

• We use a third-party referral-tracking provider to run our ambassador program. If you arrive through an ambassador referral link, limited information (a referral identifier and your subscription event) is processed by that provider so the referring ambassador can be credited. This provider processes data in the United States (see Section 5). It is not used for advertising or to build a profile of you.

Analytics and Advertising (consent-based):

• If you consent via the cookie banner, Google (Google Analytics) and Meta (Meta Pixel and Conversions API) receive usage and conversion data (such as pages viewed and signup events, and for completed purchases a hashed email) to help us understand traffic and measure our advertising. Both process data in the United States. If you choose essential-only, no data is shared with them from your browser.

These service providers are contractually obligated to protect your information and use it only for the purposes we specify. Beyond the consent-based analytics and advertising services described above, we do not share your information with advertising networks or social media platforms.

4.2 Legal and Regulatory Authorities

We may disclose your personal information to government authorities, law enforcement agencies, or regulatory bodies when:

• Required by law, court order, subpoena, or other legal process
• Necessary to comply with trade-promotion reporting requirements
• Necessary to protect our rights, property, or safety, or the rights, property, or safety of others
• Necessary to investigate, prevent, or take action regarding suspected illegal activities, fraud, or violations of our Membership Terms

4.3 Winner Publication

For transparency, we publish the winner of any prize valued over $1,000 AUD on our website in first name and suburb/state format, for a minimum of 28 days. Publication in this format is a condition of accepting a prize and cannot be opted out of if you win. Any additional publicity beyond that listing (such as a winner story or photo) only occurs with your separate consent (see the Competition Terms).

4.4 Corporate Transactions

In the event of a merger, acquisition, reorganization, asset sale, or similar corporate transaction, your personal information may be transferred to the acquiring entity. We will notify you of any such change.

4.5 With Your Consent

We may share your personal information with third parties for purposes not described in this Privacy Policy with your explicit consent.

5. International Data Transfers

BookingClub is based in Australia. Some of our service providers store or process data outside Australia, including:

• United States (Stripe payment processing, Railway hosting, our referral-tracking provider, and, with your consent, Google and Meta analytics/advertising services)
• Other countries where our service providers operate

When we transfer personal information outside Australia, we take steps to ensure that your information receives a standard of protection comparable to the protection under the Australian Privacy Principles. This may include standard contractual clauses or reliance on the recipient's privacy framework. By using the Platform, you consent to the transfer of your personal information outside Australia in accordance with this Privacy Policy.

6. Data Security

We implement reasonable technical, administrative, and physical security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These measures include:

Technical Safeguards:

• Encryption of data in transit using TLS/SSL protocols
• Secure password hashing using industry-standard algorithms
• Secure storage on servers with restricted access
• No storage of full credit card details (Stripe handles all payment data)
• Security reviews and vulnerability assessments

Administrative Safeguards:

• Access controls limiting access to personal information to authorized personnel on a need-to-know basis
• Incident response and breach notification procedures

Despite these measures, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your personal information. You are responsible for maintaining the confidentiality of your account credentials.

7. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements.

Account and Payment Information: Retained for the duration of your membership and for up to seven (7) years after account closure to comply with Australian tax and business record-keeping requirements.

Promotional Draw Records: Retained as required by trade-promotion regulatory obligations. Winner information is retained permanently for compliance with trade promotion regulations.

Travel Booking Information: Retained for up to seven (7) years after travel completion to comply with consumer protection and dispute resolution requirements.

Communications and Support Records: Retained to facilitate ongoing support and dispute resolution.

After the applicable retention period expires, we securely delete or anonymize your personal information.

8. Your Rights and Choices

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the following rights regarding your personal information:

8.1 Right to Access

You have the right to request access to the personal information we hold about you. Submit a written request to privacy@bookingclub.com.au with sufficient information to verify your identity. We will respond within thirty (30) days. We may refuse access in limited circumstances permitted by law, in which case we will provide a written explanation.

8.2 Right to Correction

You can request correction of inaccurate, out-of-date, incomplete, irrelevant, or misleading personal information by contacting privacy@bookingclub.com.au. You can also update most information directly through your account dashboard. We will respond to correction requests within thirty (30) days.

8.3 Right to Deletion

You can request deletion of your personal information, subject to legal retention requirements. Deleting your account will remove most personal data, but some information must be retained for compliance purposes (for example, tax records and draw records required by law). We will assess deletion requests on a case-by-case basis.

8.4 Marketing Opt-Out

You can opt out of marketing communications at any time by clicking "unsubscribe" in emails or updating your communication preferences in your account settings. You will still receive transactional emails related to your membership and bookings.

8.5 Right to Complain

If you believe we have breached the Australian Privacy Principles or handled your personal information inappropriately, please contact us first at privacy@bookingclub.com.au. We will acknowledge your complaint within seven (7) days and provide a written response within thirty (30) days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

Office of the Australian Information Commissioner
Website: www.oaic.gov.au
Email: enquiries@oaic.gov.au
Phone: 1300 363 992
Mail: GPO Box 5218, Sydney NSW 2001

9. Children's Privacy

The Platform is not intended for individuals under the age of eighteen (18). Age verification is required for all members, and we do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected personal information from a person under 18, we will delete that information promptly.

If you are a parent or guardian and believe a minor has provided personal information to us, please contact us at privacy@bookingclub.com.au so we can take appropriate action.

10. Cookie Policy

10.1 What Are Cookies?

Cookies are small text files stored on your device when you visit a website. Cookies allow the website to recognize your device and remember information about your visit, such as your preferences and login status.

10.2 Cookies on the BookingClub Website

On the BookingClub website itself, we use only the following categories of cookies:

Essential Cookies:

• Enable core functionality such as account authentication, session management, and security
• Cannot be disabled without severely affecting Platform functionality

Preference Cookies:

• Remember your settings and preferences (for example, display settings)

Payment Cookies (Stripe):

• Set by our payment processor, Stripe, to process payments securely and prevent fraud

10.3 Analytics and Advertising Cookies (Only With Your Consent)

If you choose "Accept all" in the cookie banner, we load Google Analytics (traffic and usage analytics) and the Meta Pixel (advertising measurement), each of which sets its own cookies and processes data in the United States. If you choose "Essential only" (or make no choice), these tools are never loaded and no analytics or advertising cookie is set. You can change your mind at any time by clearing this site's data in your browser, which brings the banner back.

10.4 Referral Cookies

If you visit through an ambassador referral link, our third-party referral-tracking partner may set a cookie on your device to attribute the referral, so the referring ambassador can be credited when you subscribe. This cookie is used only for referral attribution. It is not used for advertising or to build a behavioural profile of you. Our referral partner processes this data in the United States. If you do not arrive through a referral link, this cookie is not relevant to your visit.

10.5 Travel Booking and Payment

Hotel bookings are made on the BookingClub website. To complete a booking we share the details needed to source and confirm your stay (such as guest names and stay dates) with our wholesale accommodation supplier and travel technology platform, and your payment is processed by our travel payment partner. These providers process that data to fulfil your booking and are governed by their own privacy policies. We do not send your data to them for their own marketing.

10.6 Managing Cookies

You can control and manage cookies through your browser settings, including viewing, blocking, and deleting cookies. Please note that disabling essential or payment cookies may limit your ability to use the Platform, including logging in and making payments.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. We will notify you of material changes by:

• Posting the updated Privacy Policy on the Platform with a new "Last Updated" date
• Sending an email notification to the address associated with your account
• Displaying a prominent notice on the Platform

Your continued use of the Platform after the effective date of the updated Privacy Policy constitutes acceptance of the changes. If you do not agree to the updated Privacy Policy, you must discontinue use of the Platform and may cancel your membership.

12. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact:

Privacy Officer
Booking Club Pty Ltd
Email: privacy@bookingclub.com.au
Mail: Level 3 / 55 Collins St, Melbourne VIC 3000
ABN: 89 699 101 025

For general inquiries, you may also contact:
Email: concierge@bookingclub.com.au
Website: www.bookingclub.com.au

We aim to respond to all privacy inquiries within five (5) business days.