Privacy Policy

1.Background and scope

This Privacy Notice (“Notice”) sets out how Xplore Australia Pty Ltd(from here on refereed as Xplore Australia) processes and protects the privacy of your personal information.

Xplore Australia Pty Ltd is an inbound tour operator. We are required to collect, use and disclose personal information in order to perform our business functions and activities, including making and managing travel bookings on behalf of our customers. We are firmly committed to protecting the privacy and confidentiality of personal information and to maintaining various physical, electronic and procedural safeguards to protect personal information in our care.

2. What personal information do we collect?

Generally, the type of personal information we collect about you is the information that is needed to facilitate your travel arrangements and bookings and to arrange travel related services and/or products on your behalf.

We therefore typically process the following types of personal information about you:

• contact information (such as name, residential/mailing address, telephone number, email address);

• payment account information (credit/debit card details, including card type, card number, security number and expiry date);

• passport details;

• loyalty program / frequent flyer details;

• health information such as your dietary requirements and health issues (if any); and

• Other details relevant to your travel arrangements or required by the relevant travel service provider(s) (e.g. airlines and accommodation or tour providers).

We also collect online identifiers such as your IP address and data regarding your device and the network you are using to connect with us.

3. How do we collect personal information?

We will only collect personal information in compliance with your local data protection laws. We usually collect your personal information directly from you during the course of your relationship with us. We will collect this information directly from you unless it is unreasonable or impracticable to do so.

Generally, this collection will occur:

• when you deal with us either in person, by telephone, letter, email;

• when you visit any of our websites; or

• when you connect with us via social media.

We may collect personal information about you:

• when you purchase or make enquiries about travel arrangements or other products and services;

• when you enter competitions or register for promotions;

• when you subscribe to receive marketing from us (e.g. e-newsletters);

• when you request itineraries or other information from us; or

• when you provide information, or use our services, on social media.

In some circumstances, it may be necessary for us to collect personal information about you from a third party. This includes where a person makes a travel booking on your behalf which includes travel arrangements to be used by you (e.g. a family or group booking or a travel booking made for your travel agent). Where this occurs, we will rely on the authority of the person making the travel booking to act on behalf of any other traveller on the booking.

Where you make a travel booking on behalf of another person (e.g. a family or group booking or travel booking made by your travel agent), you agree to have obtained the consent of the other person for Xplore Australia to collect, use and disclose the other person’s personal information in accordance with this Notice and that you have otherwise made the other person aware of this Notice.

You should let us know immediately if you become aware that your personal information has been provided to us by another person without your consent or if you did not obtain consent before providing another person’s personal information to us.

4. How do we use your personal information?

We will only process your information, where:

• you have given your consent to such processing (which you may withdraw at any time, as detailed at section 8 below);

• the processing is necessary to provide our services to you;

• the processing is necessary for compliance with our legal obligations; and/or

• the processing is necessary for our legitimate interests or those of any third party recipients that receive your personal information (as detailed in sections 5 and 6 below).

In detail: Where you contact us in relation to a travel booking or query, the purpose for which we collect your personal information is generally to provide you with travel advice and/or to assist you with booking travel and/or travel related products and services. However, the purpose for collection may differ depending on the particular circumstances as disclosed in this Notice (e.g. collection of your personal information for the purpose of your participation in a competition, provision of feedback, etc.).

When you book or otherwise arrange travel related products and services through us, we usually act as an agent for the relevant travel service providers (e.g. for a hotel). In this case, we process your personal information as necessary so as to provide the services you requested from us. This usually includes collecting personal information about you both for our internal purposes as described in this Notice and for the travel service provider for whom we act as agent (e.g. to provide you with the booked services). For example, if you book a hotel through us, then we use your personal information to enable your hotel to be booked and disclose it to the Accommodation provider to enable the hotel to provide the rooms to you.

We may therefore share your information with our travel service providers such as hotel, activities operator, car rental, or other providers, who fulfil your travel bookings. Please note that these travel service providers also may use your personal information as described in their respective privacy policy and may contact you as necessary to obtain additional information about you, facilitate your travel reservation, or provide you with your requested services. We encourage you to review the privacy policies of any third-party travel service providers whose products you purchase through us. We act as agent for or on behalf of many thousands of travel service providers around Australia, so it is not possible for us to set out in this Notice all of the travel service providers for whom we act or their locations.

Further purposes for which we process personal information include:

• providing you with services and tools you choose to use (for example, saving travel preferences on our websites to a wish list or saving personal information to allow for pre-population of online forms);

• identification of errors;

• protecting against, deterring, detecting and investigating fraudulent, unauthorised or illegal activities;

• regulatory reporting and compliance;

• developing and improving our products and services and those of our related entities;

• servicing our relationship with you by, among other things, creating and maintaining a customer profile to enable our brands to service you better or presenting options on our website we think may interest you based on your browsing and preferences;

• involving you in market research, gauging customer satisfaction and seeking feedback regarding our relationship with you and/or the service we have provided;

• to facilitate your participation in loyalty programs;

• for research and analysis in relation to our business and services, including but not limited to trends and preferences in sales and travel destinations and use of our websites;

• internal accounting and administration;

• to comply with our legal obligations, including complying with law enforcement or government authority requests, and any applicable customs/immigration requirements relating to your travel; and

• other purposes as authorised or required by law (e.g. to prevent a threat to life, health or safety, or to enforce our legal rights).

Where permitted by local data protection laws, we may use your personal information to send you targeted marketing activities relating to our products and services (and those of third parties) that we think may interest you, unless you have requested not to receive such information. These may include, but are not limited to, mail outs, electronic marketing and notifications as described below, and telephone calls). We will only use your personal information to send electronic marketing materials to you (including e-newsletters, email, SMS, MMS and iM) if you have opted-in to receive them or not opt-ed out of receiving them, depending upon the applicable law. You can subscribe to receive e-newsletters and other electronic promotional/marketing materials by following the relevant links on our website or requesting one of our consultants to do so for you.

Should you no longer wish to receive promotional/marketing material from us, participate in market research or receive other types of communication from us. You can unsubscribe from receiving electronic marketing materials by following the unsubscribe prompt in your email, SMS, MMS, iM or other form of electronic marketing. Please also see the “Your rights” section of this Notice to learn about your ability, at any time, to opt out or limit the use of your browsing behaviour for online behavioural advertising purposes(section 8 below).

5. Is personal information disclosed to third parties?

We do not and will not sell, rent out or trade your personal information. We will only disclose your personal information to third parties in the ways set out in this Notice and, in particular, as setout below, and in accordance with your local data protection laws. Note that, in this Notice, where we say “disclose”, this includes to transfer, share (including verbally and in writing), send, or otherwise make available or accessible your personal information to another person or entity.

Your personal information may be disclosed to the following types of third parties:

• our independent contractors, suppliers and service providers, including without limitation: or in each of the circumstances set out in section 4 (“How do we use your personal information?”);

  • suppliers of IT based solutions that assist us in providing products and services to you (such as any external data hosting providers we may use);

  • publishers, printers and distributors of marketing material;

  • event and expo organisers;

  • marketing, market research, research and analysis and communications agencies;<

  • mailing houses, freight services, courier services; and

  • external business advisers (such as lawyers, accountants, auditors and recruitment consultants);

• our related entities and brands;

• travel service providers such as travel wholesalers, tour operators, airlines, hotels, car rental companies, transfer handlers and other related service providers;

• any third party to whom we assign or novate any of our rights or obligations;

• financial institutions such as banks, when processing financial transactions;

• a person making your travel booking on your behalf, where you are travelling on a booking made on your behalf by another person (for example, a family member, friend or work colleague);

• your employer, where you are an employee of one of our corporate, business or government clients and you are participating in an event or travelling for work purposes;

• a person who can verify to us that they have a relationship with you (e.g. a family member) where you are not contactable, the person correctly answers our required security questions and the request is, in our opinion, in your interest (for example, where the person is concerned for your welfare or needs to undertake action on your behalf due to unforeseen circumstances);

• as required or authorised by applicable law, and to comply with our legal obligations;

• customs and immigration to comply with our legal obligations and any applicable customs/immigration requirements relating to your travel;

• government agencies and public authorities to comply with a valid and authorised request, including a court order or other valid legal process;

• various regulatory bodies and law enforcement officials and agencies, including to protect against fraud and for related security purposes;

• enforcement agencies where we suspect that unlawful activity has been or may be engaged in and the personal information is a necessary part of our investigation or reporting of the matter: and

• third-party services or applications when you use these to log into your account (e.g., if you use a third-party service or application (e.g., Facebook, Google) to log into your Xplore Australia account, we share certain personal information with that third party).

Other than the above, we will not disclose your personal information without your consent unless we reasonably believe that disclosure is necessary to lessen or prevent a threat to life, health or safety of an individual or to public health or safety or for certain action to be undertaken by an enforcement body (e.g. prevention, detection, investigation, prosecution or punishment of criminal offences), or where such disclosure is authorised or required by law (including applicable privacy / data protection laws).

On our websites, you may choose to use certain features that can be accessed through, or for which we partner with, other entities that are not otherwise affiliated with us. These features, which include social networking and geo-location tools, are operated by third parties, including social networks, and are clearly identified as such. These third parties may use or share personal information in accordance with their own privacy policies. We strongly suggest you review the third parties’ privacy policies if you use the relevant features.

6. Is personal information transferred overseas?

We may disclose your personal information to certain over seas recipients, as set out below. We will ensure that any such international transfers are either necessary for the performance of a contract between you and the overseas recipient or are made subject to appropriate or suitable safeguards as required by your local data protection laws (e.g. GDPR, China cybersecurity law, etc.).

It is possible that information will be transferred to an over seas recipient (other than any of our overseas related entities) located in a jurisdiction where you will not be able to seek redress under your local data protection laws and that does not have an equivalent level of data protection as in your jurisdiction. To the extent permitted by your local data protection laws, we will not be liable for how these overseas recipients handle, store and process your personal information.

(a) Our overseas related entities

Your personal information may be disclosed to our overseas related entities in connection with facilitation of your travel booking and/or to enable the performance of administrative, advisory and technical services, including the storage and processing of such information. This includes enabling “single sign-on” allowing you to login to a shared account across our brands using a single set of log-in credentials, which allows us to, for example, show your reservations and bookings made through the websites, applications, and services of our group companies on your account page, and allow our group companies to show information in your respective account(s)with them.

(b) Our third party service providers located overseas

We may also disclose your personal information to third parties located overseas for the purpose of performing services for us, including the storage and processing of such information. Generally, we will only disclose your personal information to these overseas recipients in connection with facilitation of your travel booking and/or to enable the performance of administrative and technical services by them on our behalf.

We use key service providers located in India, Philippines and Australia. We also deal with many different service providers allover the world, so it is not possible for us to set out in this Notice all of the different countries to which we may send your personal information. However, if you have any specific questions about where or to whom your personal information will be sent, please refer to the “Feedback / Complaints / Contact” section below(section14).

7. Security of information

We are committed to safeguarding and protecting personal information and will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to protect any personal information provided to us from accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal information transmitted, stored or otherwise processed..

We will destroy or de-identify personal information once we no longer require it for our business purposes, or as required by law.

8. Yourrights in relation to the personal information we collect

If you wish to make a Subject Access Request to:

• access, update, modify, rectify, erase, object to, or obtain a copy of the personal information that we hold on you; or

• restrict or stop us from using any of the personal information which we hold on you, including by withdrawing any consent you have previously given to the processing of such information; or

• where any personal information has been processed on the basis of your consent or as necessary to perform a contract to which you are a party, request a copy of such personal information in a suitable machine-readable format or have that personal information transmitted by us to another controller

You can request this by contacting us. You will receive acknowledgement of your request.

We endeavour to respond to such requests within a month or less, although we reserve the right to extend this period for complex requests or as otherwise permitted by applicable law.

We reserve the right to deny you access for any reason permitted under applicable laws. Such exemptions may include national security, corporate finance and confidential references. If we deny access or correction, we will provide you with written reasons for such denial unless it is unreasonable to do so and, where required by local data protection laws, will note your request and the denial of same in our records.

You have the right to lodge a complaint with a relevant supervisory authority.

To the extent permissible by law, we reserve the right to charge you a reasonable administrative fee for any manifestly unfounded or excessive requests concerning your access to your personal information, and for any additional copies of the personal information you request from us.