Privacy Policy

Effective Date: July 24, 2024

Last Updated: Thursday, July 23, 2026

Entity: 1000951406 Ontario Inc. (o/a Australia Experiences) 56a Mill Street East, Unit 701, Acton, L7J 1H3, Ontario, Canada

1. SCOPE AND STATUTORY COMPLIANCE

1.1 Purpose. This Privacy Policy describes how Australia Experiences (the "Company," "we," "us") collects, uses, and discloses your personal information in connection with the Australia Experiences website, platform, and services (collectively, the "Platform").

1.2 Legal Framework. This Policy is drafted to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada and the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), in Australia.

1.3 Legal Basis for Collection. We collect and process personal information on the following legal bases, depending on the type of information and the context in which it is collected:

  • (a) Consent. Where you have actively provided your information — for example, by subscribing to our newsletter, submitting your banking details for payment, or executing an agreement with us.
  • (b) Contract Performance. Where collection is necessary to deliver the services you have requested — for example, processing payments, coordinating campaigns, and managing collaborations.
  • (c) Legitimate Business Interest. Where collection is reasonably necessary for our business operations — for example, platform security, fraud prevention, and service analytics.
  • (d) Legal Obligation. Where we are required to retain or disclose information by applicable law — for example, financial records retention under Canadian and Australian tax law.

2. INFORMATION WE COLLECT

2.1 Personal Data. We collect information that identifies you, including your full legal name, email address, mobile number, social media profiles and handles, date of birth, and physical or work addresses.

2.2 Banking and Financial Data. We collect bank account details and BSB/SWIFT codes solely to process Creator payments and manage Client billing ("Banking Data").

2.3 Technical Data and Log Files. We automatically collect log and device data including IP addresses, browser types, device identifiers, operating systems, screen sizes, Internet Service Providers (ISP), date and time stamps, and referring and exit pages.

2.4 Social Media and Audience Data. For Creators, we collect social media metrics and audience data — including follower counts, reach, engagement metrics, audience demographics (such as the age, gender, country, and city breakdown of a creator's followers or engaged audience), and past brand partnership history — for the purposes of vetting, campaign matching, and performance reporting. This information may be provided directly by the Creator, sourced from publicly available social media profiles, obtained through the official business tools and APIs of social media platforms (including Meta's Instagram Creator Marketplace API and TikTok's creator tools), or supplied by third-party analytics providers. Data obtained from a platform's API is collected and processed in accordance with that platform's terms, is used only for the purposes described in this Section, and may be deleted on request as described in Section 11.

2.5 Program and Referral Data. Where you participate in our Ambassador Program, affiliate program, or any referral program, we collect relevant participation data including referral tracking information, commission records, and program-specific communications.

3. COOKIE POLICY

3.1 Usage. We use cookies and similar technologies (pixels, tags, and SDKs) to optimize Platform performance and understand user interaction.

3.2 Categories of Cookies Used.

  • Essential. Required for core website functions and security. Cannot be disabled.
  • Performance and Analytics. Used to measure site performance, understand user behaviour, and fix errors. Providers may include Google Analytics.
  • Marketing and Measurement. Used to show relevant promotions and measure campaign effectiveness. Providers may include Google, Meta, and TikTok.
  • Social Media Embeds. Set by third-party platforms including Instagram, TikTok, YouTube, and Meta when you interact with embedded content.

3.3 Retention Periods. Session cookies expire when you close your browser. Persistent analytics and marketing cookies typically last between six (6) months and two (2) years depending on the provider and your browser settings.

3.4 Management. You may manage or block cookies through your browser settings or through our cookie preference controls where available on the Platform. Blocking certain cookies may affect Platform functionality. We do not currently respond to "Do Not Track" signals.

4. BANKING DATA SECURITY PROTOCOLS

4.1 Restricted Access. Access to Banking Data is strictly limited to authorised financial personnel on a need-to-know basis for processing payouts and managing billing.

4.2 Storage and Encryption. Banking Data is transmitted via Secure Socket Layer (SSL) technology and stored in encrypted environments.

4.3 Secure Deletion. Upon account termination or written request, Banking Data will be purged from active systems within sixty (60) days, unless retention is mandated by applicable tax, audit, or regulatory obligations.

5. HOW WE USE YOUR INFORMATION

5.1 Operational Use. To create and manage user accounts, coordinate campaigns, process payments, and provide customer support.

5.2 Marketing and Communication. To send newsletters, promotional materials, and campaign opportunities, provided you have given express opt-in consent. You may withdraw consent at any time.

5.3 Analytics and Service Improvement. To understand how the Platform is used, measure campaign performance, and improve our services.

5.4 Portfolio and Marketing Use. To use anonymised campaign performance data, and — where you have provided written consent — identified campaign outcomes, for our own portfolio, case studies, and business development purposes, as further described in Section 15 of our Terms of Service.

5.5 Ambassador and Referral Program Administration. To manage participation in our Ambassador Program and any referral or affiliate programs, including tracking referrals, calculating and issuing commissions, and managing program communications.

5.6 Protection and Legal. To enforce our Terms of Service, resolve disputes, prevent fraud, and comply with applicable legal obligations.

6. DATA SHARING AND THIRD PARTIES

6.1 Authorised Disclosure. We share personal information with third-party service providers who assist in our operations, including:

  • Payment processors and banking service providers
  • Analytics and advertising measurement providers (including Google, Meta, and TikTok)
  • Legal advisors and professional service providers
  • Operational contractors who assist in campaign coordination and service delivery
  • Cloud hosting, storage, and infrastructure providers
  • Artificial intelligence service providers that process information on our instructions as part of our internal operations

6.2 Operational Contractors. We engage independent contractors to assist in delivering our services. These contractors may access personal information — including creator and client contact details and campaign information — as part of their service delivery role. All contractors are bound by written confidentiality and data handling obligations consistent with this Policy and applicable privacy law.

6.3 Contractual Protections. All third parties and contractors are required to use personal information only for the purpose for which it was transferred and to maintain security standards at least equivalent to those described in this Policy.

6.4 Cross-Border Transfers. As we operate across multiple jurisdictions, your personal information may be stored or processed in countries outside your home jurisdiction. Some of these countries may not have privacy laws equivalent to those in Australia or Canada. By using our Platform and services, you acknowledge and expressly consent to this overseas disclosure. We take reasonable steps to ensure that all overseas recipients — including operational contractors — handle your personal information in a manner consistent with the Australian Privacy Principles and PIPEDA, including through written contractual obligations binding those recipients to equivalent data protection standards.

6.5 Business Transfer. If the Company is acquired by, merged with, or transferred to another entity, your personal information may be transferred as part of that transaction. We will take reasonable steps to ensure that the acquiring entity maintains privacy protections consistent with this Policy.

6.6 Legal Disclosure. We may disclose personal information where required by applicable law, court order, or regulatory authority, or where necessary to protect the rights, property, or safety of the Company, our users, or the public.

7. MINORS AND PROTECTED CONTENT

7.1 Account Restrictions. The Platform is intended strictly for users aged 18 and older. We do not knowingly collect personal information from individuals under the age of 18.

7.2 Accidental Collection. If we become aware that personal information has been collected from a person under the age of 18 without appropriate parental consent, we will take prompt steps to delete that information from our systems. If you believe a minor has provided personal information through our Platform, please contact us at hello@australiaexperiences.com.

7.3 Content Featuring Minors. For any Content featuring a person under 18, the Creator must provide a signed Parental Consent Form authorising commercial use. This requirement is set out in our Terms of Service and Creator Content & Collaboration Agreement.

7.4 Sensitive Handling. Information relating to minors is treated as sensitive information and is never used for profiling or targeted advertising.

8. ANTI-SPAM AND ADVERTISING DISCLOSURES

8.1 Express Consent (CASL & Spam Act). We comply with Canada's Anti-Spam Legislation (CASL) and Australia's Spam Act 2003. We only send marketing communications to those who have affirmatively opted in. You may unsubscribe at any time using the link provided in our communications.

8.2 Affiliate and Sponsored Content. Any affiliate links or sponsored content in our communications will be clearly disclosed at the point of use using labels such as "#Ad," "Sponsored," or "Paid Partnership," in compliance with Australian ACCC guidelines and Canadian ASC guidelines.

9. DATA RETENTION

9.1 General Retention. We retain personal data for the duration of your relationship with the Company and for a period of up to two (2) years following account deletion, termination, or the conclusion of your last engagement with us, in accordance with our bona fide retention policies and procedures, including any archival and back-up processes we maintain.

9.2 Financial Records. Notwithstanding Section 9.1, all records relating to financial transactions and payments are retained for seven (7) years to satisfy Canadian and Australian tax and corporate law requirements.

9.3 Cookie Data. Cookie data is retained only as long as necessary for the purposes described in Section 3, consistent with the retention periods set out in Section 3.3.

9.4 Contract and Consent Records. Notwithstanding Section 9.1, records evidencing acceptance of our Terms of Service, signed agreements, campaign confirmations, and related consents — including the identity of the accepting party and the time and manner of acceptance — may be retained for as long as reasonably necessary to establish, exercise, or defend legal claims, including for the duration of applicable limitation periods under Ontario and Australian law.

10. DATA BREACH NOTIFICATION

10.1 Notifiable Data Breaches — Australia. In the event of an eligible data breach under Australia's Notifiable Data Breaches (NDB) scheme — that is, a breach likely to result in serious harm to any individual whose information is involved — the Company will assess the breach and, where required, notify the Office of the Australian Information Commissioner (OAIC) within thirty (30) days of becoming aware of the potential breach, as required by law. Affected individuals will be notified directly, or via a published Platform notification where direct notification is not practicable.

10.2 Mandatory Breach Reporting — Canada. In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm, the Company will notify the Office of the Privacy Commissioner of Canada (OPC) as soon as feasible, and will notify affected individuals as required under PIPEDA.

10.3 Internal Response. Upon becoming aware of a potential data breach, the Company will promptly take steps to contain the breach, assess the risk of harm, and implement measures to prevent recurrence.

11. YOUR RIGHTS AND CONTACT INFORMATION

11.1 Rights of Access. Depending on the law that applies to you, you may have the right to:

  • Access the personal information we hold about you
  • Request correction of inaccurate or incomplete information
  • Request erasure of your personal information, subject to legal retention obligations
  • Withdraw consent to processing where processing is based on consent
  • Request restriction of processing in certain circumstances
  • Lodge a complaint with a regulatory authority

11.2 Regulatory Complaints. If you are located in Australia and believe we have breached the Australian Privacy Principles, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au. If you are located in Canada, you may lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca.

11.3 How to Exercise Your Rights. To exercise any of the above rights, please contact our Privacy Officer at: hello@australiaexperiences.com. We will respond to all requests within thirty (30) days of receipt, in accordance with applicable law.