Privacy

1. Introduction

Welcome to epyic. We (epyic pty ltd ACN 678 628 889) respect your privacy. This Privacy Policy explains how we collect, use, store and disclose personal information. We handle personal information in line with the Australian Privacy Principles. Capitalised terms used in this Privacy Policy have the meaning given to them in our Website Terms.

By using our website or providing personal information to us, you agree to this Privacy Policy. We may change this Privacy Policy from time to time by publishing the updated version on our website, and we encourage you to check it periodically.

2. Information We Collect

We collect personal information so we can provide our services, communicate with you and improve what we offer. We collect it through our website, when you contact us, and through analytics tools.

We may collect the following types of personal information:

• name;
• location;
• email address, telephone number and other contact details;
• age or date of birth;
• the activities and adventures you are interested in, based on information you give us, Events you have booked and your use of our website;
• your device ID, device type, geo-location information, computer and connection information, statistics on page views, traffic to and from the sites, ad data, IP address and standard web log information - this information helps us improve our website and your user experience;
• details of the services we have provided to you or that you have enquired about, including any additional information necessary to deliver those services and respond to your enquiries;
• any other information you provide to us through our website, by contacting us or through surveys.

If you choose not to provide certain information, you may not be able to use some features of our website.

Bookings and Guests: When a Lead Guest makes a Booking, they give us the names of the other Guests in the Booking, including a first name and age for any child, and may answer questions the Operator asks to run the Event (such as dietary requirements, medical conditions, or fitness level). Some of these answers are health information. We collect them with the Lead Guest’s consent at checkout, pass them only to that Operator, and delete them from our systems 30 days after the Event ends, unless an incident has been reported in relation to the Booking (see Retention below).

Operators may ask you for further information when you attend an Event. We do not control what Operators collect, or how they handle information once they have downloaded it from our systems. Operators are responsible for their own privacy practices, and we recommend you ask them if you have questions.

3. How We Use Your Information

We may collect, hold, use and disclose your personal information for the following purposes:

• to enable you to access and use our website;
• to pass your information, the details of the Guests in your Booking and your answers to checkout questions to the Operator of an Event you have booked, so they can run the Event;
• to operate, protect, improve and optimise our website, business and our users’ experience, including analytics and research;
• to send you service, support and administrative messages, reminders, technical notices, updates, security alerts, and information requested by you;
• to send you our own emails about epyic, such as new adventures, platform updates and recommendations. You can unsubscribe at any time using the link in the email;
• to personalise what you see and what we send you, including recommending adventures based on your activity and Bookings;
• to connect you with Operators: when you book, you follow the Operator and receive their updates through epyic. You can unfollow at any time;
• to send a one-off invitation on behalf of an Operator who has uploaded your contact details to invite you to follow them on epyic. We send one invitation and delete your details within 30 days if you do not join;
• to administer surveys, promotions or competitions run by us or with Operators; and
• to comply with our legal obligations, resolve any disputes that we may have with any of our users, and enforce our agreements with third parties.

We share aggregated, de-identified insights with Operators, such as the region and demographics of their Guests and which adventures are popular, to help them plan. No individual is identifiable in these insights.

We may disclose personal information for the purposes described in this Privacy Policy to:

• Operators, as described above;
• our employees and related bodies corporate;
• third party service providers, including hosting, email, analytics and payment processing providers;
• professional advisers and business partners;
• parties to whom we sell or transfer any part of our business;
• specific third parties authorised by you to receive information held by us; and
• other persons, including government agencies, regulatory bodies and law enforcement agencies, where required, authorised or permitted by law.

4. Data Security and Retention

We hold personal information electronically with third-party providers that use encryption, access controls and security audits. We take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.

Once an Operator has downloaded Guest information from our systems, it is held outside our systems and is the Operator’s responsibility. Our deletion of records from our systems does not reach information an Operator holds.

Retention: We keep personal information for as long as we need it for the purposes described in this Privacy Policy, including to meet legal requirements and for as long as a claim could be made in relation to a Booking. In particular:

• we keep Booking and financial records for the period required by tax and corporations law;
• we may keep waiver acceptances, condition affirmations and emergency contact details for a Booking until any relevant limitation period has expired;
• we delete answers to checkout questions from our systems 30 days after the Event ends;
• if an incident is reported to us in relation to a Booking, we keep that Booking’s records until the incident is resolved, even if you ask us to delete your account; and
• when we no longer need personal information, we generally delete or de-identify it.

Account deletion: You can delete your account at any time in your account settings or by contacting us. We will deactivate your account and anonymise your details, and keep only the records described above.

5. User Rights

• a. Access and Correction: You can ask to access or correct the personal information we hold about you by contacting us using the details below. We may need to verify your identity first. In some circumstances we may not be able to give you access to all of your information, and if so we will tell you why.

• b. Complaints: If you have any concerns about how we have handled your personal information, you can contact us at support@epyic.com or contact the Office of the Australian Information Commissioner.

6. Third-Party Links

Our website may contain links to websites we do not control. We are not responsible for their privacy practices.

7. Children's Privacy

Accounts are for people aged 18 and over. A child can only attend an Event as a Guest in an adult’s Booking. The only information we hold about a child is what the Lead Guest gives us for the Booking, and we handle it in the same way as the Lead Guest’s information.

8. Contact Information

If you have any questions or concerns about this Privacy Policy, please contact us at support@epyic.com