Privacy Policy

Effective Date: July 24, 2024

Last Updated: Thursday, August 20, 2026

Entity: 1000951406 Ontario Inc. (o/a Australia Experiences) 56a Mill Street East, Unit 701, Acton, L7J 1H3, Ontario, Canada

1. SCOPE AND STATUTORY COMPLIANCE

1.1 Purpose. This Privacy Policy describes how Australia Experiences (the "Company," "we," "us") collects, uses, and discloses your personal information in connection with the Australia Experiences website, platform, and services (collectively, the "Platform").

1.2 Legal Framework. This Policy is drafted to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada and the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), in Australia.

1.3 Legal Basis for Collection. We collect and process personal information on the following legal bases, depending on the type of information and the context in which it is collected:

• (a) Consent. Where you have actively provided your information — for example, by subscribing to our newsletter, submitting your banking details for payment, or executing an agreement with us.
• (b) Contract Performance. Where collection is necessary to deliver the services you have requested — for example, processing payments, coordinating campaigns, and managing collaborations.
• (c) Legitimate Business Interest. Where collection is reasonably necessary for our business operations — for example, platform security, fraud prevention, and service analytics.
• (d) Legal Obligation. Where we are required to retain or disclose information by applicable law — for example, financial records retention under Canadian and Australian tax law.

2. INFORMATION WE COLLECT

2.1 Personal Data. We collect information that identifies you, including your full legal name, email address, mobile number, social media profiles and handles, date of birth, and physical or work addresses.

2.2 Banking and Financial Data. We collect bank account details and BSB/SWIFT codes solely to process Creator payments and manage Client billing ("Banking Data").

2.3 Technical Data and Log Files. We automatically collect log and device data including IP addresses, browser types, device identifiers, operating systems, screen sizes, Internet Service Providers (ISP), date and time stamps, and referring and exit pages.

2.4 Social Media and Audience Data. For Creators, we collect social media profile, content, audience, and performance information, together with brand partnership history. The categories available to us vary by platform and by the permissions you grant, and may change as platforms change what they make available.

We collect this information to confirm that audience metrics are genuine, to match Creators to Campaigns that suit them, to assess whether a Creator's audience and content are appropriate for a particular brand, and to report Campaign results accurately. Creators benefit through better-matched opportunities; Business Clients benefit through informed selection and greater confidence in the Creators they engage.

We obtain this information from you directly, from publicly available social media profiles, from a platform's official tools where you have connected your account and authorised that access, and from third-party analytics providers.

Where you connect an account, we use that access only to read information for the purposes described in this Policy. Platforms grant permissions in broad categories, so the access you approve may technically permit more than we use; we do not publish, edit, delete, respond to, or otherwise act on anything on your behalf. We do not collect your password. Information obtained through a platform's tools is used only in accordance with that platform's terms. You may disconnect at any time, as described in Section 12.

2.5 Program and Referral Data. Where you participate in our Ambassador Program, affiliate program, or any referral program, we collect relevant participation data including referral tracking information, commission records, and program-specific communications.

2.6 Chat Assistant Data. Our website offers an automated chat assistant. It is software, not a member of our team, and it is identified as an assistant at the point you begin a conversation. Where you use it, we collect the messages you send, the responses given, the pages you were viewing, and the technical data described in Section 2.3. If you choose to provide them so that we can follow up, we also collect your name, email address, and any business details you share. You are not required to provide personal information in order to use the assistant, and you should not enter banking details, government identifiers, health information, or any other sensitive information into it.

3. COOKIE POLICY

3.1 Usage. We use cookies and similar technologies (pixels, tags, and SDKs) to optimize Platform performance and understand user interaction.

3.2 Categories of Cookies Used.

• Essential. Required for core website functions and security, including retaining your chat assistant conversation while it is in progress. Cannot be disabled.
• Performance and Analytics. Used to measure site performance, understand user behaviour, and fix errors. Providers may include Google Analytics.
• Marketing and Measurement. Used to show relevant promotions and measure campaign effectiveness. Providers may include Google, Meta, and TikTok.
• Social Media Embeds. Set by third-party platforms including Instagram, TikTok, YouTube, and Meta when you interact with embedded content.

3.3 Retention Periods. Session cookies expire when you close your browser. Persistent analytics and marketing cookies typically last between six (6) months and two (2) years depending on the provider and your browser settings.

3.4 Management. You may manage or block cookies through your browser settings or through our cookie preference controls where available on the Platform. Blocking certain cookies may affect Platform functionality. We do not currently respond to "Do Not Track" signals.

4. BANKING DATA SECURITY PROTOCOLS

4.1 Restricted Access. Access to Banking Data is strictly limited to authorised financial personnel on a need-to-know basis for processing payouts and managing billing.

4.2 Storage and Encryption. Banking Data is transmitted via Secure Socket Layer (SSL) technology and stored in encrypted environments.

4.3 Secure Deletion. Upon account termination or written request, Banking Data will be purged from active systems within sixty (60) days, unless retention is mandated by applicable tax, audit, or regulatory obligations.

5. HOW WE USE YOUR INFORMATION

5.1 Operational Use. To create and manage user accounts, coordinate campaigns, process payments, and provide customer support.

5.2 Marketing and Communication. To send newsletters, promotional materials, and campaign opportunities, provided you have given express opt-in consent. You may withdraw consent at any time.

5.3 Analytics and Service Improvement. To understand how the Platform is used, measure campaign performance, and improve our services.

5.4 Portfolio and Marketing Use. To use anonymised campaign performance data, and — where you have provided written consent — identified campaign outcomes, for our own portfolio, case studies, and business development purposes, as further described in Section 15 of our Terms of Service.

5.5 Ambassador and Referral Program Administration. To manage participation in our Ambassador Program and any referral or affiliate programs, including tracking referrals, calculating and issuing commissions, and managing program communications.

5.6 Protection and Legal. To enforce our Terms of Service, resolve disputes, prevent fraud, and comply with applicable legal obligations.

5.7 Creator Matching and Content Suitability. To confirm that audience metrics are genuine, to assess whether a Creator's audience and content are a suitable match for a particular Campaign or brand, and to report Campaign performance. This includes automated analysis of a Creator's content, audience information, and the classifications applied by the platform itself, which informs our Creator selection and Campaign matching decisions.

5.8 Chat Assistant. To answer your questions about our services, to route your enquiry to the right part of our business, to follow up where you have asked us to, and to review conversations so that we can improve the accuracy of the assistant and the information published on our website. The assistant answers only from information we have published, and it does not make decisions about you.

6. DATA SHARING AND THIRD PARTIES

6.1 Authorised Disclosure. We share personal information with third-party service providers who assist in our operations, including:

• Payment processors and banking service providers
• Analytics and advertising measurement providers (including Google, Meta, and TikTok)
• Legal advisors and professional service providers
• Operational contractors who assist in campaign coordination and service delivery
• Cloud hosting, storage, and infrastructure providers
• Artificial intelligence service providers that process information on our instructions, both as part of our internal operations and to operate the chat assistant described in Section 2.6

6.2 Operational Contractors. We engage independent contractors to assist in delivering our services. These contractors may access personal information — including creator and client contact details and campaign information — as part of their service delivery role. All contractors are bound by written confidentiality and data handling obligations consistent with this Policy and applicable privacy law.

6.3 Contractual Protections. All third parties and contractors are required to use personal information only for the purpose for which it was transferred and to maintain security standards at least equivalent to those described in this Policy.

6.4 Cross-Border Transfers. As we operate across multiple jurisdictions, your personal information may be stored or processed in countries outside your home jurisdiction. Some of these countries may not have privacy laws equivalent to those in Australia or Canada. By using our Platform and services, you acknowledge and expressly consent to this overseas disclosure. We take reasonable steps to ensure that all overseas recipients — including operational contractors — handle your personal information in a manner consistent with the Australian Privacy Principles and PIPEDA, including through written contractual obligations binding those recipients to equivalent data protection standards.

6.5 Business Transfer. If the Company is acquired by, merged with, or transferred to another entity, your personal information may be transferred as part of that transaction. We will take reasonable steps to ensure that the acquiring entity maintains privacy protections consistent with this Policy.

6.6 Legal Disclosure. We may disclose personal information where required by applicable law, court order, or regulatory authority, or where necessary to protect the rights, property, or safety of the Company, our users, or the public.

6.7 Disclosure to Business Clients. Where you have connected a social media account or otherwise provided audience information, we may disclose information from it to a Business Client in connection with a Campaign you have applied to, been selected for, or completed. We disclose only what is relevant to that Campaign, and we do not disclose your login credentials or private communications. You authorise this disclosure when you connect an account and when you apply to a Campaign, and may withdraw it at any time by disconnecting the account.

7. MINORS AND PROTECTED CONTENT

7.1 Account Restrictions. The Platform is intended strictly for users aged 18 and older. We do not knowingly collect personal information from individuals under the age of 18.

7.2 Accidental Collection. If we become aware that personal information has been collected from a person under the age of 18 without appropriate parental consent, we will take prompt steps to delete that information from our systems. If you believe a minor has provided personal information through our Platform, please contact us at hello@australiaexperiences.com.

7.3 Content Featuring Minors. For any Content featuring a person under 18, the Creator must provide a signed Parental Consent Form authorising commercial use. This requirement is set out in our Terms of Service and Creator Content & Collaboration Agreement.

7.4 Sensitive Handling. Information relating to minors is treated as sensitive information and is never used for profiling or targeted advertising.

8. ANTI-SPAM AND ADVERTISING DISCLOSURES

8.1 Express Consent (CASL & Spam Act). We comply with Canada's Anti-Spam Legislation (CASL) and Australia's Spam Act 2003. We only send marketing communications to those who have affirmatively opted in. You may unsubscribe at any time using the link provided in our communications.

8.2 Affiliate and Sponsored Content. Any affiliate links or sponsored content in our communications will be clearly disclosed at the point of use using labels such as "#Ad," "Sponsored," or "Paid Partnership," in compliance with Australian ACCC guidelines and Canadian ASC guidelines.

9. DATA RETENTION

9.1 General Retention. We retain personal data for the duration of your relationship with the Company and for a period of up to two (2) years following account deletion, termination, or the conclusion of your last engagement with us, in accordance with our bona fide retention policies and procedures, including any archival and back-up processes we maintain.

9.2 Financial Records. Notwithstanding Section 9.1, all records relating to financial transactions and payments are retained for seven (7) years to satisfy Canadian and Australian tax and corporate law requirements.

9.3 Cookie Data. Cookie data is retained only as long as necessary for the purposes described in Section 3, consistent with the retention periods set out in Section 3.3.

9.4 Contract and Consent Records. Notwithstanding Section 9.1, records evidencing acceptance of our Terms of Service, signed agreements, campaign confirmations, and related consents — including the identity of the accepting party and the time and manner of acceptance — may be retained for as long as reasonably necessary to establish, exercise, or defend legal claims, including for the duration of applicable limitation periods under Ontario and Australian law.

9.5 Connected Account Information. If you disconnect a social media account, or withdraw our access directly with the platform, we will cease collecting information from that account and will delete information previously obtained from it within thirty (30) days. We may retain aggregated or de-identified Campaign performance data and any records we are required to keep under Sections 9.2 and 9.4.

9.6 Chat Assistant Conversations. Conversations with the chat assistant are retained for twelve (12) months, after which they are deleted. Where a conversation is or may become relevant to a complaint, dispute, or legal claim, it is retained under Section 9.4. Where you have given us your contact details through the assistant, those details and the enquiry they relate to are retained under Section 9.1 as part of your relationship with us.

10. DATA BREACH NOTIFICATION

10.1 Notifiable Data Breaches — Australia. In the event of an eligible data breach under Australia's Notifiable Data Breaches (NDB) scheme — that is, a breach likely to result in serious harm to any individual whose information is involved — the Company will assess the breach and, where required, notify the Office of the Australian Information Commissioner (OAIC) within thirty (30) days of becoming aware of the potential breach, as required by law. Affected individuals will be notified directly, or via a published Platform notification where direct notification is not practicable.

10.2 Mandatory Breach Reporting — Canada. In the event of a breach of security safeguards involving personal information that creates a real risk of significant harm, the Company will notify the Office of the Privacy Commissioner of Canada (OPC) as soon as feasible, and will notify affected individuals as required under PIPEDA.

10.3 Internal Response. Upon becoming aware of a potential data breach, the Company will promptly take steps to contain the breach, assess the risk of harm, and implement measures to prevent recurrence.

11. YOUR RIGHTS AND CONTACT INFORMATION

11.1 Rights of Access. Depending on the law that applies to you, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate or incomplete information
• Request erasure of your personal information, subject to legal retention obligations
• Withdraw consent to processing where processing is based on consent
• Request restriction of processing in certain circumstances
• Lodge a complaint with a regulatory authority

11.2 Regulatory Complaints. If you are located in Australia and believe we have breached the Australian Privacy Principles, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au. If you are located in Canada, you may lodge a complaint with the Office of the Privacy Commissioner of Canada (OPC) at www.priv.gc.ca.

11.3 How to Exercise Your Rights. To exercise any of the above rights, please contact our Privacy Officer at: hello@australiaexperiences.com. We will respond to all requests within thirty (30) days of receipt, in accordance with applicable law.

12. CONNECTED SOCIAL MEDIA PLATFORMS

12.1 Scope. Where you connect a social media account, we access information through that platform's official tools. Our handling of that information is governed by this Policy, and our access is additionally subject to the terms and policies of the platform concerned. The platforms we support may change from time to time.

12.2 YouTube. The Platform uses YouTube API Services. Information obtained through YouTube API Services is additionally handled in accordance with the Google Privacy Policy, available at http://www.google.com/policies/privacy.

12.3 Withdrawing Access. You may disconnect a connected account at any time in your account settings, or withdraw our access directly with the platform. Access granted to Google and YouTube may be withdrawn at https://security.google.com/settings/security/permissions; other platforms provide equivalent controls in their own settings. Information from a disconnected account is deleted as set out in Section 9.5.