Privacy Policy

01Who this policy applies to

This Privacy Policy ("Policy") explains in general terms how My Ultimate Pty Ltd ABN 56 005 339 579 (ACN 005 339 579) and its brands, including but not limited to My Ultimate, My Ultimate Girls Trip, My Ultimate Hens, My Ultimate Bucks, My Ultimate Team, My Ultimate Guys Weekend, My Ultimate Divorce Party, My Ultimate Getaway, My Ultimate Birthday and My Ultimate Proposal (referred to in this document as "My Ultimate", "we", "our" or "us") protects the privacy of your personal information.

We are firmly committed to protecting the privacy and confidentiality of personal information, and we maintain physical, electronic and procedural safeguards appropriate to the information in our care.

We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

We are an Australian business. We operate from Australia, our customers are overwhelmingly in Australia, and our handling of personal information is governed by Australian law.

A note on scope. This Policy describes how My Ultimate handles personal information across its business. Where it describes website technology, such as the tracking technologies in section 8 and the choices panel at the top of this page, it is describing the website on which this Policy appears. Our other brand websites may use different technology, and where they do, the version of this Policy published on those sites describes it.

02What is personal information?

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether it is recorded in a material form or not.

Sensitive information is a special category of personal information which includes health information, and information about racial or ethnic origin, religious beliefs and sexual orientation. Sensitive information receives additional protection under the Privacy Act, and we generally collect it only with your consent. See section 6.

De-identified and aggregated information is not personal information. We create combined and de-identified information from the dealings we have across our customers, for example how many groups travel to a destination in a season, which package types are most often chosen for a milestone birthday, or how long a booking usually takes from first enquiry to confirmation. Once information has been de-identified or aggregated so that it is no longer about an identified or reasonably identifiable person, it is not personal information, this Policy does not restrict how we use or share it, and we may use it to run, improve, report on and grow our business.

Two commitments go with that. We do not attempt to re-identify information we have de-identified, and we do not publish or share it in a form that we consider could reasonably identify you or your group.

03Dealing with us anonymously

Where it is lawful and practicable, you have the option of dealing with us without identifying yourself, or by using a pseudonym. For example, you can browse our website or ask a general question about a destination without telling us who you are.

In most cases we will need your real name and contact details to answer a specific enquiry, prepare a quote, or make and manage a booking, because we cannot arrange accommodation, transport or activities for a person we cannot identify.

04What personal information do we collect?

Generally, the type of personal information we collect about you is the information that is needed to facilitate your event arrangements and bookings and to provide event services and products to you.

Depending on how you deal with us, this may include:

• your name and preferred name
• your mailing address
• your telephone and mobile numbers, including a secondary contact number for the day of your event
• your email address
• the name of the person the event is being held for, and the names and approximate number of people in your group
• your event date, destination, package selection and timing preferences
• dietary requirements
• accessibility and special assistance requirements, including health information, where you choose to tell us
• anything else you choose to include in the notes or message fields of our forms
• payment details sufficient to identify and administer your booking, such as the amount paid, the date and whether a payment succeeded
• recordings and transcripts of telephone calls between you and our team, as described in section 9
• records of your communications with us, including emails, messages, call notes and enquiry history
• information about how you use our website, as described in section 8

We also collect information required for the ordinary business activities of My Ultimate, including financial details necessary to process transactions, and any other information you elect to provide to us.

We do not hold your card number

We never see, receive or store your full card number or expiry date. Card payments are processed by our bank's payment platform, which captures your card details directly and returns to us only a secure token, a substitute reference that lets us identify the payment without exposing the card. Your card details are held in our bank's secure vault, not by us.

This means your full card number is not held in our ordinary booking systems.

05How do we collect personal information?

Directly from you. Wherever practical we collect personal information directly from you. This will generally happen when you deal with us in person, by telephone, letter, email or through our website. We may request information when you make an enquiry or purchase, when you complete a booking or contact form, when you enter competitions or register for promotions, when you request information, and when we invite you to complete surveys or provide feedback.

From other people. Because we arrange group travel, we often receive information about you from someone else. If a friend is organising your trip, she may give us your name, the fact that you are attending, and details such as dietary or accessibility requirements. See section 7.

From our suppliers and partners. We may receive information from accommodation providers, venues, transport operators and activity providers in the course of arranging and delivering your experience.

Automatically, when you use our website. See section 8.

We keep records of our dealings with you, whatever channel they arrive through. That includes email, our website forms, letters, telephone calls, SMS, messaging apps and social media messages. We keep them so that we have an accurate record of what was asked, quoted, agreed and arranged. Section 9 explains how we handle telephone calls specifically, because recording a call is different from keeping an email.

If you send us something we did not ask for. People sometimes give us more than we need, such as a medical certificate, a document belonging to somebody else, or details in a message that have nothing to do with the booking. Where we receive personal information we did not ask for and could not have collected ourselves, the Privacy Act requires us to destroy or de-identify it if it is lawful and reasonable to do so, and we will. Where we could lawfully have collected it, we treat it in the same way as the rest of your information.

06Sensitive information

Some of the information we may collect is sensitive information under the Privacy Act. In our business this is most often health information, such as an accessibility or mobility requirement, an allergy, a medical condition relevant to an activity, or a pregnancy. Dietary requirements may also reveal sensitive information in some circumstances.

We generally collect sensitive information only where you choose to give it to us, and with your consent, unless the Privacy Act otherwise permits or requires us to collect it. We ask for it for one reason: so that your trip can be arranged safely and so that the people looking after your group know what they need to know.

We will use and disclose sensitive information only for the purpose you gave it to us for, which is arranging and delivering your event, unless you consent to another use or the law requires or permits it. That means we will pass a mobility requirement to the hotel or the activity provider who needs it, and we will not use it for marketing.

There is one situation where sensitive information may be used beyond that purpose. If a complaint, dispute or claim concerns the very thing the information relates to, for example whether an accessibility requirement was passed on and met, we may use and disclose what is relevant in order to investigate and answer it. The Privacy Act permits use and disclosure that is reasonably necessary for a legal claim, and we would rather tell you that now than surprise you with it later.

You are not required to provide sensitive information. If you prefer not to include it in a form, tell your consultant directly instead.

If you are giving us sensitive information about someone else in your group, you confirm that they have agreed to you giving it to us for the purpose of arranging the trip, and that you are authorised to tell us so on their behalf. You do not need to get anything in writing. You do need to have asked them. See section 7.

07Information about other people in your group

Group travel means one person usually organises on behalf of everybody else. If you are that person, you will often give us information about other people, including guests, the person the event is being held for, and emergency or secondary contacts.

If you give us personal information about someone else, you confirm that:

• you are authorised to provide it to us; and
• you have made that person aware of this Policy and of the fact that we will use their information to arrange and deliver the event.

We will use information about other members of your group only for the purpose of arranging, delivering and administering the event, and for the related purposes described in section 10.

If you are a member of a group and someone else has given us your information, you have the same rights under this Policy as anybody else. You can ask us what we hold about you, ask us to correct it, and ask us not to send you marketing. Contact details are in section 22.

08Our website: cookies, analytics, advertising and session analytics

What we use

Our website uses cookies and similar technologies. "Similar technologies" includes pixels, tags, software development kits, device and browser identifiers, advertising identifiers, local storage, session storage and comparable technologies now in use or developed in future.

These technologies are provided by us and by third parties, including search, social media, advertising and analytics companies. Rather than name individual suppliers, which change from time to time, we describe below what each kind of technology actually does, because that is the part that affects you.

We change providers within these categories from time to time, and our digital marketing partners may add or remove tools. When that happens, the kinds of technology, the purposes and the choices described in this section continue to apply, and so do your rights and your ability to opt out.

If you would like to know which providers we are using at a particular time, ask us and we will tell you.

What these technologies collect

Depending on the technology, this may include your IP address, general location derived from it, device type, operating system, browser, screen size, the pages you view, the time and duration of your visit, the website or advertisement that brought you to us, the links and buttons you click, how far you scroll, and how you move through a page.

Contact details and advertising measurement

When you submit an enquiry or booking form, we may share your name, email address and phone number with our advertising providers so that they can tell us which advertising led to you contacting us. This is called conversion measurement, and it is how we work out which advertising is worth paying for.

Where the provider's technology does so, those details are converted into a scrambled value, called a hash, before they are sent. Hashing does not necessarily make information anonymous, because the provider may be able to match the scrambled value against information it already holds.

We tell you this plainly because it is more than most people assume happens, and because we would rather you heard it from us than found it out. You can turn this off in Your privacy choices at the top of this page.

Session recording and your form entries

These tools are configured so that the contents of form fields are not captured in a recording. That means the words you type into a message, notes or contact field do not appear in the replay. It does not mean we never see what you send us: when you submit a form, we receive it, and we use it as described in this Policy.

What we use them for

We use these technologies to operate the website; keep it secure; prevent fraud and misuse; remember your preferences; understand how visitors use our pages; find and fix problems; improve our website, our packages and our service; measure whether our advertising works; understand where our enquiries come from; show you our advertising on other websites and platforms, including advertising based on pages you have viewed; build audiences for advertising; and analyse and improve our business generally.

Your control

We do not use a cookie consent pop-up. We would rather give you a persistent choice you can change whenever you like than a banner you click once to make it go away. Your choice is stored on this device, so clearing your browser data or switching device or browser may mean you need to set it again.

Instead:

• Your privacy choices, at the top of this page, is reachable from the footer of every page on the site. There you can switch off advertising and measurement technologies, and switch off website experience tools, at any time.
• You can also manage or block cookies through your browser or device settings. Some parts of our website may not work properly if you block cookies entirely.

Where this information can identify you

Where cookie or tracking data can reasonably identify you, we treat it as personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and handle it as described in this Policy.

Some of this information may be stored, accessed, processed or disclosed outside Australia. See section 16.

By using our website you acknowledge that we use these technologies as described in this section, and that you may change your choices at any time using the Privacy Choices page. Where the law requires your consent for a particular activity, we will ask for it separately and clearly, rather than treating your use of the website as consent.

Other websites, social media and reviews

Our website links to other websites, including our social media accounts, suppliers, venues and review platforms. Once you leave our site, you are on somebody else's, and this Policy stops applying. Their privacy practices are their own, and we have no control over them. We suggest reading their privacy policy before giving them your information.

The same is true in reverse. Our social media accounts sit on platforms we do not own. When you comment, message or interact with us there, the platform collects information about that under its own terms as well as ours.

Where you review us, or post publicly about your trip and tag us, that content is public. We may repeat, display or link to it, including on our website and our social media accounts, in the form you published it. If you would rather we did not, tell us and we will remove it from our own channels.

09Recording telephone calls

When you speak to us on the phone, the call is recorded. You will hear an announcement telling you so at the start of the call, before we discuss anything.

What we do with recordings. Call recordings and written transcripts of them are used to administer your booking, to make sure we have your arrangements right, for training and quality, to handle feedback, to resolve questions, complaints and disputes, to review and improve how we do things, and to keep an accurate record of what was agreed.

They are also our record of what was said. Where a question arises about what was asked for, quoted, agreed, promised or arranged, we may use a recording, a transcript, an email, a message or any other record of our dealings with you to establish what actually happened, to respond to feedback or a complaint, to answer a claim made against us or by us, and to protect our legal interests. Where the matter involves a supplier, venue, operator, insurer, payment provider, business partner or adviser, we may give them the part of that record that is relevant, so the matter can be sorted out on the facts rather than on recollection. We share what is relevant to the question, not the whole file.

Transcripts and analysis. Our telephony provider produces written transcripts of calls, and may use automated and artificial intelligence systems to do so and to analyse calls. This means the content of your call is processed by that provider and by the systems it uses. See section 14.

Payment details are automatically removed. Our call recording system is configured to detect and suppress payment card details so that they do not appear in recordings or transcripts.

If you would rather not be recorded, tell the consultant at the start of the call and we will turn recording off, or arrange another way to deal with your request. You will not be disadvantaged for asking.

Sensitive information on a call. If the matter is about you, such as an accessibility requirement or a health matter relevant to the trip, we will ask you at the time whether you are happy for us to record it and pass it to the supplier who needs it.

If the matter is about someone else in your group, we will ask you to confirm that they have agreed to us having it for that purpose and that you are authorised to tell us so on their behalf. See section 7.

In neither case do we treat the opening announcement as consent to collect sensitive information.

How long we keep recordings is dealt with in section 20.

10How do we use personal information?

We use your personal information to provide you with the event and experience related products and services in the My Ultimate packages, and for purposes related to running our business.

Those purposes include:

• responding to your enquiry and preparing quotes and recommendations
• arranging, booking, delivering and administering your event
• communicating with you before, during and after your trip
• taking and processing payments, and managing deposits and balances
• coordinating with accommodation providers, venues, transport operators, activity providers and other suppliers
• providing customer service and handling questions, changes, complaints and refunds
• identification of fraud or error
• regulatory reporting and compliance
• internal accounting and administration
• keeping records of our dealings with you
• analysing how our customers use our website and our packages, so we can improve them
• market research, business analytics, reporting and forecasting
• improving our products, our website, our processes and our service
• advertising, including showing you our advertising on other websites and social media platforms, and contacting you about your enquiry, your booking or a past booking, subject to section 17
• using artificial intelligence and automated systems to support the activities above, as described in section 14
• handling feedback, reviews, complaints and disputes, and reviewing and improving our packages, our suppliers and our processes as a result
• responding to a claim, allegation, review or complaint, whether it is made to us, to a supplier, to a platform, to an insurer, to a regulator or to a court or tribunal, including by producing our records of what was said and agreed
• protecting our legal interests, including establishing, exercising or defending a legal claim
• any other purpose you would reasonably expect, or that you have consented to, or that is required or authorised by law

Where we use your information for a purpose other than the one we collected it for, we do so only where that purpose is related to the original one and you would reasonably expect it, where you have consented, or where the law permits or requires it.

11When we act as an agent

When we sell products and services to you, we do so as an agent for the wholesaler or provider of those products and services. This means that we usually collect personal information about you, both for our internal purposes and on behalf of the parties for whom we act as agent, for their internal purposes.

Accordingly, when you provide personal information to us in connection with a package, that information will also be provided to the parties whose products and services we sell, and used by them for their own purposes. For example, if you purchase a My Ultimate package that includes a cruise with a cruise operator, your personal information will be provided to that operator to enable your experience to be booked, and will be used by that operator for its purposes.

We work with hundreds of suppliers, and the list changes as packages, venues and seasons change. For that reason it is not possible for us to set out in this Policy exactly how each of them will use your personal information.

What we can tell you is why we provide it to them. We provide suppliers only with the information reasonably needed to arrange or deliver your event. The transport company needs to know where to collect your group and how to reach you on the day. The restaurant needs the booking name, the time and any dietary requirements. The accommodation provider needs to know who is arriving. We do not pass your details to a venue or an operator that has nothing to do with your trip.

Once a supplier receives your information in its own right, its handling of that information may also be governed by its own privacy policy and its own legal obligations, such as record keeping, insurance and regulatory requirements.

Section 12 explains the other kinds of organisation that handle information for us, such as the software and payment systems we run the business on.

We are happy to tell you exactly which suppliers are involved in your particular booking. Just ask your consultant, or contact us using the details in section 22.

12Who do we disclose personal information to?

We may disclose your personal information to:

• accommodation providers, venues, restaurants, transport and vehicle operators, activity and experience providers, and other suppliers involved in delivering your event
• our related entities and the other My Ultimate brands
• our contractors and service providers, including website and software developers, hosting and cloud providers, customer relationship management and communications platforms, email and SMS providers, payment providers, analytics and advertising providers, session analytics providers, call tracking providers, artificial intelligence providers, and IT and security providers
• our professional advisers, including lawyers, accountants and insurers
• regulatory bodies, law enforcement officials and agencies, to protect against fraud and for related security purposes
• any person to whom disclosure is permitted or required by law
• debt recovery and dispute resolution providers, where relevant
• parties involved in a proposed or actual merger, restructure, financing, acquisition, sale of business or assets, due diligence process, insolvency or external administration, or transfer to a successor or related entity, subject to appropriate confidentiality protections

Where feedback, a complaint, a dispute or a claim is involved, we may also disclose to the suppliers, venues, operators, business partners, insurers, payment providers, platforms and advisers connected with the matter the parts of our records that are relevant to it, including call recordings, transcripts, messages and booking records, so that it can be investigated and resolved, so that the service can be improved, and so that we can respond to what has been alleged. Section 9 explains this in more detail.

The third parties to whom we disclose your personal information may also be taken to have collected your personal information in their own right, for their own internal use. For more information, see section 11.

Where we engage contractors and service providers to perform services for us, we use contractual, technical and organisational controls that are appropriate and reasonably available to require them to safeguard your personal information and to use it only for the purposes for which it was supplied. Where we disclose your personal information to a recipient outside Australia, the Privacy Act may make us accountable for how that recipient handles it. We are not, however, responsible for the independent acts of a third party who collects your personal information in its own right as described in section 11, and whose own privacy policy governs its handling of that information.

Other than as described above, we will not disclose your personal information without your consent unless disclosure is necessary to prevent a serious threat to life, health or safety, is authorised or required by law, is reasonably necessary for the enforcement of the law, is necessary to investigate a suspected unlawful activity or serious misconduct, or is otherwise permitted under the Australian Privacy Principles.

13Talking to others involved in your booking

As the booking agent, we recognise that enquiries and communications about an event may come not only from the primary organiser, but also from other members of the group, including friends and family members, or from the person the event is being held for.

Where you make a booking with us as the organiser, you agree that we may discuss the booking with members of your group who can reasonably verify their connection to it, for example by providing the booking number, your name, or the name of the person the event is being held for. What we discuss will be limited to what is reasonably necessary to answer their question or administer the booking, such as the event date, package inclusions, meeting times and what is still outstanding.

There are things we will not discuss with the rest of the group. Unless you tell us otherwise, or the law requires it, we will not use this arrangement to pass on another person's health or accessibility information, payment details, or a private complaint or private message they have sent us. Those stay between us and the person they belong to.

If you would prefer us to deal only with you, tell us and we will. You can do this at the time of booking or at any point afterwards, and we will note it on your file. We will not treat that as a difficult request.

Where it is practical to do so, we will speak with the primary organiser before providing booking information to another member of the group.

We may also use or disclose booking information where it is reasonably necessary to establish, exercise or defend a legal claim, or where the Privacy Act otherwise permits it.

14Artificial intelligence and automated systems

We use artificial intelligence in our business, and we think you should know that rather than have it hidden behind a phrase like "technology providers".

What we use it for

We may use artificial intelligence, machine learning and automated systems to support:

• responding to and managing enquiries
• customer service and communications
• preparing correspondence, quotes and documents
• summarising and organising information
• helping a consultant match or recommend packages and options, where the consultant remains responsible for the recommendation
• supplier and booking administration
• workflow automation and internal processes
• quality control and staff assistance
• research, business analytics and analysis of trends, so that we can improve our packages, our website and our service
• content and marketing preparation
• producing written transcripts of telephone calls, and analysing those calls, as described in section 9

The providers we use, and why we have not listed them

We use a range of artificial intelligence, automation and software providers. Some are dedicated artificial intelligence services. Others are artificial intelligence features built into business software we already use for everyday work such as design, documents, scheduling, communications and customer management.

We have not named them, and that is deliberate. A list of tools would be out of date within months, and a policy that goes out of date is worse than one that tells you the rule we apply. If you want to know which providers are involved at the time you ask, contact us using the details in section 22 and we will tell you.

Some of these systems are operated by us on our own private server infrastructure. Where information is processed there, it does not leave our control.

The rule we apply before a tool touches your information

Where a tool will handle your personal information, we use business or enterprise arrangements, and we select providers whose terms do not permit information we submit to be used to train their general models. We do not switch on optional data-sharing or model-improvement settings for customer information. We check this before we adopt a tool, and we review it when a provider changes its terms or we change our configuration.

Not every tool we use receives customer information at all. A design or artwork tool used to make a brochure, or a scheduling tool used internally, generally never sees anything about you. The rule above is aimed at the tools that do.

Where we use a third party artificial intelligence provider, your personal information may be sent to that provider so that it can perform the task we have asked it to perform.

Our telephony provider also uses automated and artificial intelligence systems to transcribe and analyse recorded calls, under business arrangements on the same basis.

We do not use artificial intelligence to make the kinds of automated decisions described in section 15.

Your choice

Some artificial intelligence processing is necessary to run our business and to deliver the service you have asked us for, in the same way that email and accounting software are necessary, and we cannot provide the service without it.

Where we use your personal information for artificial intelligence purposes that are not necessary to deliver your booking, such as analysis of trends to improve our packages, you can opt out. Contact us using the details in section 22 and we will stop using your personal information for those purposes. It costs nothing and it does not affect your booking.

Wherever we can, we use information that has been aggregated or de-identified for those purposes, so that it is no longer about you and the question does not arise.

15Automated decision-making

A person is involved in decisions about your booking. We do not currently arrange for a computer program to make, or to do something substantially and directly related to making, a decision about you that could reasonably be expected to significantly affect your rights or interests. Our quotes, recommendations, pricing and bookings are made by our consultants.

As section 14 explains, a consultant may use automated tools to help prepare or narrow options. The consultant remains responsible for the recommendation and the decision.

From 10 December 2026, changes to the Privacy Act will require privacy policies to include specific information about automated decisions of that kind. If our practices change before then, we will update this section so that it is accurate and complete when that obligation commences.

16Sending information overseas

Some of the providers we use are located outside Australia, or use infrastructure outside Australia. As a result, personal information may be stored, accessed, processed or disclosed outside Australia.

Those are not all the same thing under the Privacy Act. In some arrangements a provider processes information on our instructions and we keep control of how it is handled, which may amount to our own use of the information rather than a disclosure, depending on the arrangement and the degree of control we retain. In others, information is disclosed to an overseas recipient, and the cross-border rules in the Act apply.

Overseas handling may involve:

• our analytics, advertising and measurement providers
• our session and behavioural analytics providers
• our call tracking provider
• our artificial intelligence providers
• cloud, hosting, email and software providers
• overseas suppliers, where your package includes an experience outside Australia

Many of these providers operate distributed global infrastructure, which means we cannot always identify every country in which information may be stored or accessed. The countries most likely to be involved are the United States and other countries in which major cloud and technology providers operate data centres, including within Europe and the Asia Pacific region.

Before disclosing personal information to an overseas recipient, we take steps that are reasonable in the circumstances to ensure that the recipient does not breach the Australian Privacy Principles. Those steps include using established providers who offer contractual data protection terms, and configuring their services to limit what is shared.

Where your trip involves an overseas supplier, we will need to disclose your information to that supplier so that the booking can be made. Before we do, we take the steps that are reasonable in the circumstances to ensure the supplier does not handle your information in a way that would breach the Australian Privacy Principles. What is reasonable depends on the supplier, the country and the information involved.

If you would prefer we did not send your information overseas, tell us and we will talk through what that means for the trip you have in mind.

17Direct marketing, and how to stop it

We do not run newsletter, bulk email or SMS marketing campaigns, and we would like you to know what that means in practice.

We have no newsletter. We do not add you to a mailing list. We do not send bulk marketing emails or SMS campaigns. You may still receive automatic confirmations and reminders about a booking you have made, because those are operational, not marketing.

When we contact you, it is a person, about your enquiry or your booking. If you get in touch, a consultant looks after you and contacts you about the trip you asked us about, by phone, email or message, because that is how the work gets done.

Whether a message counts as marketing depends on what it is for, not on who sends it. Messages needed to run a booking you have made, such as confirmations, payment reminders, supplier details and changes to your arrangements, are operational. A message promoting a different trip, package or offer is marketing, even when one consultant writes it to one person, and we treat it that way.

Two things you can still stop.

We will action your request as soon as we reasonably can, and it costs nothing.

If we ever do send you something promotional, it will say who it is from and it will include a way to unsubscribe. You may still receive messages needed to administer a booking you have made, such as confirmations, payment reminders and changes to your itinerary, because those are not marketing and you will need them.

If you ask us where we got your information from, for example because a friend organising a trip gave it to us, we will tell you, unless it is impracticable or unreasonable to do so.

18Security of your information

How we hold your information. We hold personal information electronically, in our booking, customer, communications and business systems. Some of those run on our own private infrastructure and some are operated for us by cloud and service providers. Paper records, where we have them, are kept securely.

My Ultimate has implemented physical, electronic and managerial security measures to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.

Those measures currently include:

• multi-factor authentication on business systems and accounts holding customer information
• dedicated private server infrastructure rather than shared hosting
• card details are never held by us. Payments are processed by our bank's platform and card data is stored in the bank's secure vault. We hold only a token
• automated suppression of payment card details from call recordings and transcripts, so that card numbers spoken aloud are not retained
• restricted administrator access, granted on a need to know basis
• access controls and secure account authentication
• encrypted transmission of information to and from our website
• regular review of our security arrangements, software updates and patching
• backups
• staff procedures covering the handling of customer information

We regularly review our security arrangements and update them as technology and risks change.

No method of transmitting or storing information is completely secure, and we cannot guarantee that your information will never be accessed without authorisation. What we can tell you is that we take security seriously, we invest in it, and if something does go wrong we will act on it promptly. Any statement that a business's data is one hundred per cent secure is not one you should believe from anybody.

19If something goes wrong: data breaches

If we become aware of a data breach involving personal information we hold, we will assess it promptly.

Where a breach is likely to result in serious harm to the people affected, the Privacy Act 1988 (Cth) requires us to notify those individuals and the Office of the Australian Information Commissioner. We will comply with those obligations. Where a breach is not likely to result in serious harm, or where we are able to take action that prevents that harm, notification may not be required, and we will make that assessment in accordance with the Act.

20How long we keep your information

We keep personal information for as long as we need it for the purposes described in this Policy, and for as long as we are required or permitted to keep it by law.

The reasons we may need to retain information include supplying our services and supporting you during and after your trip; keeping booking and supplier records; accounting, tax and audit requirements; dealing with complaints, disputes and claims; meeting legal and regulatory obligations; preventing and investigating fraud and misuse; establishing, exercising or defending legal rights; and legitimate business record keeping.

Retention periods vary depending on the type of information and the reason we hold it. Some records, such as financial records, must be kept for periods set by law.

When we no longer need personal information for any purpose for which it may be used or disclosed, and we are not required by law or a court or tribunal order to retain it, we will take reasonable steps to destroy it or to de-identify it.

One thing worth saying plainly, because it is often misunderstood. Australian privacy law does not give you a general right to have your information deleted on request, the way some overseas laws do. What it gives you is the right to ask us what we hold, to have it corrected, and to have it destroyed or de-identified once we no longer need it for any of the reasons above. You can ask us to stop using your information for a particular purpose, and we will, as sections 14 and 17 describe. Where you ask us to stop using information we need in order to arrange or support your booking, we will tell you honestly what we can and cannot continue to do for you. And where we are keeping something because a law, a limitation period, an insurer or a live dispute requires it, we will keep it and tell you why.

21Accessing and correcting your information

Subject to the exceptions set out in the Privacy Act 1988 (Cth), you may ask us for access to the personal information we hold about you, and you may ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading.

To make a request, contact us using the details in section 22. Please tell us what information you are looking for, so that we can find it. We may need to verify your identity before we can provide access, so that we do not disclose your information to somebody else.

We will respond within a reasonable period, and we aim to do so within 30 days.

There is no charge for making a request. We may charge a reasonable cost for giving you access to information where the request requires significant work, and we will tell you what that cost will be before we do the work. We will not charge you for correcting information.

If we refuse access or refuse to correct information, we will tell you in writing why, and how you can complain about that decision.

If what you want is deletion rather than access or correction, section 20 explains what we can and cannot do, and why.

22Complaints, and how to contact us

If you have a question about this Policy, a concern about how we have handled your personal information, or a concern about our use of artificial intelligence or website tracking, please contact us.

Privacy contact My Ultimate Pty Ltd Email: fun@myultimate.com.au Phone: 1300 339 734

How we handle a complaint

1. Tell us what happened and what you would like us to do about it. Putting it in writing helps, but you can call us if you prefer.
2. We aim to acknowledge your complaint within 5 business days.
3. We will investigate and aim to respond to you within 30 days. If it is complicated and we need longer, we will tell you why and agree a timeframe with you.
4. We will tell you the outcome and what we are doing about it.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

Website: oaic.gov.au Phone: 1300 363 992 Post: GPO Box 5218, Sydney NSW 2001

23Young people

Our packages are intended for adults.

Where a group includes a guest under 18, the organiser can give us the ordinary booking information we need for that guest, such as their name and that they are attending, on the same basis as for anyone else in the group.

Sensitive information about a guest under 18 is different. Where we would need health or accessibility information about a young person, we will deal with a parent, guardian or other person legally able to act for them, unless the young person is able to decide for themselves and does so. We assess that according to the individual's age and understanding.

We do not knowingly market directly to people under 18.

24Changes to this Policy

From time to time it may be necessary for us to review and revise this Policy. We reserve the right to change this Policy at any time. Where we do, the amended Policy will be posted on our website and replaces the version before it.

We will take reasonable steps to bring significant changes to your attention. The version published here is the one that applies.

We keep a dated record of each version of this Policy. If you ever need to know what this Policy said at the time you dealt with us, ask us using the details in section 22 and we will give you that version.

Changes apply from the date they are published, and not backwards. Updating this Policy does not change the basis on which we collected or used information before the update. Where a new practice requires us to give you a fresh notice or obtain your consent, we will do that before we rely on it, rather than treating a policy update as your agreement.

This Policy is a statement of how we handle personal information. It is not a contract and it is not a warranty, and reading it or using our website does not create an agreement between us. The terms that govern a booking are our Terms and Conditions.