Privacy Policy

We respect your privacy

This Privacy Policy is issued by the Ovolo Hotels Group of Companies (collectively referred to as “Ovolo”, “OMG”, “Ovolo Hotels”, “we”, “us” or “our” in this policy), which includes the direct and indirect subsidiaries of Ovolo Group and covers information that we collect and use in the course of our business. When we mention “Ovolo”, “OMG”, “Ovolo Hotels”, “we”, “us” or “our”, we are referring to the relevant company in the Ovolo Hotels Group.

Ovolo respects your right to privacy and is committed to safeguarding the privacy and the rights of individuals in relation to their personal information, including our guests, clients, service providers and website visitors.

By using our services, you consent to us collecting, maintaining, using and disclosing your personal information in the way described in this Privacy Policy.

As we are an Australian based business, you acknowledge that our primary obligation is to adhere to the Australian Privacy Principles (APPs) established by the Privacy Act 1988 (Cth). We will also ensure that we comply with other privacy policies, laws or regulations where we are legally obliged to do so. This policy sets out how we collect and treat your personal information.

This Privacy Policy also applies to people in the European Union (EU), as required under the General Data Protection Regulation (GDPR).

The purpose of this Privacy Policy is to generally inform people of:

• how and when we collect personal information;
• how we use and disclose personal information;
• how we keep personal information secure, accurate and up-to-date;
• how an individual can access and correct their personal information; and
• how we will facilitate or resolve a privacy complaint.

If you have any concerns or complaints about the manner in which your personal information has been collected, used or disclosed by us, we have put in place an effective mechanism and procedure for you to contact us so that we can attempt to resolve the issue or complaint. Please see below for further details.

Collection of personal information

What is personal information?

The Privacy Act 1988 (Cth) defines “personal information” to mean any information or an opinion about an identified individual, or an individual who is reasonably identifiable:

• whether the information or opinion is true or not; and
• whether the information or opinion is recorded in a material form or not.

We collect personal information about you in order to provide our services and support. Our services and support are provided, advertised, or promoted through numerous platforms including but not limited to: websites, mobile applications, email, and telephone. The specific platform and product, service, or support you interact with may affect the personal data we collect.

Not all information requested, collected, and processed by us is “Personal Information” as it does not identify you as a specific natural person. This will include the majority of “User Generated Content” that you provide us with the intention of sharing with other users as well as aggregated data or material which is desensitized or which has had personal identifiers removed. Such “Non-Personal Information” is not covered by this Privacy Policy. However, as non-personal information may be used in aggregate or be linked with existing personal information, when in this form it will be treated as personal information. As such, this Privacy Policy will list both types of information for the sake of transparency.

In some situations, you may provide us with personal information inadvertently or without us asking for it. We will take reasonable steps to protect this data. However, if you have bypassed our systems, processes, and control, the information provided may not be governed by this Privacy Policy.

In some situations, you may provide us with personal information over platforms that are outside our control or maintained by 3rd party providers, for example through social media or messaging services. Whilst any information collected by us is governed by this Privacy Policy, the platform will be governed by its own Privacy Policy.

We will only use or disclose your personal information for the primary purpose for which it was collected or as consented to by you.

At or around the time we collect personal information from you, we will endeavour to provide you with a notice which details how we will use and disclose that specific information.

How we collect personal information

Information that you specifically give us

In order to use our services, you may be asked to provide certain types of personal information. This might happen in one or more ways, including through our website, mobile applications, apps/plugins, online chat systems, telephone, paper forms, or in-person meetings. Our Collection Notice will explain how we will use the personal information we collect. The notice may be written or verbal.

We may request, collect, or process various information, including but not limited to the following:

• Contact Details – email address, phone number, mobile number.
• Location Details – physical address, billing address.
• Details – of nationality, ethnicity, travel information including visa/passport details.
• Account Details – financial institution, account number.
• Details of family members, emergency contact, and next of kin.
• Identity Details – as required to establish your identity including for verification of identity.
• User Generated Content – which may include position details, company profiles, ACN, ABN and the like.

If you do not provide some of the information requested or any other information we require in order for us to provide our services to you, we may be unable to provide our services to you in an effective manner, or at all.

Collection from you

We will endeavour to collect personal information about you directly from you. In some circumstances, it may be necessary for us to verify the information which you provide to us and to:

• obtain copies of documents
• contact third parties to obtain documents or information

How do we collect personal information from other sources?

We may collect personal information about you from other sources where permitted by the Act. We will only collect personal information from other sources where it is reasonably necessary for us to do so in relation to, or in connection with, any services we are supplying in connection with accommodation services. Examples of such sources of personal information include:

• from family members when you stay or attend as part of a group at a property;
• from public registers;
• from third party operators and providers of travel deals, travel agents, booking and accommodation services providers and websites, including some providers which have offices or services located overseas.

Information we collect as you use our service

How do we collect personal information from you?

We offer a range of services including, without limitation, providing accommodation in our properties, restaurant and food/beverage services, conducting functions, events, conferences and the like, conducting inspections, arranging and completing maintenance and property management (Services).

The following circumstances in which we may collect personal information from you include:

• if you wish to stay in a property, then we will collect personal information from you in order to identify you and the members of your group;
• if you are a guest at (including of a guest) any property, then we may collect personal information from you to make a booking/reservation, or when you attend the property;
• if you apply to book or make a reservation in a property, then we will collect personal information from you, usually on booking and/or at reception or check-in and from supporting documentation that you supply; and
• if you are a service provider then we will collect personal information from you, usually prior to the performance of services.

We maintain records of the interactions we have with others. This includes the interactions our users have with our platform such as when a user has viewed a page or clicked a button.

When we are contacted we may collect personal information that is intrinsic to the communication. For example, if we are contacted via email, we will collect the email address used. Other examples may include:

• Metadata – IP address, computer and connection information, referring web page, standard web log information, language settings, time zone, etc.
• Device Information – device identifier, device type, device plugins, hardware capabilities, etc.
• Actions – pages viewed, buttons clicked, time spent viewing, search keywords, etc.

Other Information We Collect

We collect information that personally identifies you, which may include your full name, job status and title, company name, address, phone and fax numbers, email address, mobile number, age, date of birth, gender, property details, payment details, proof of identity (e.g. driver licence or passport number), interest areas and other preferences. We may collect additional personal information from time to time.

We may also collect credit-related personal information to assess your creditworthiness.

We may need to collect sensitive information about employees or prospective employees including ethnicity, criminal record, tax file number, disabilities and employment history.

We do not otherwise generally collect sensitive information about you, unless it is voluntarily provided to Ovolo in the course of carrying out our services.

You don’t have to give us the information requested. However, if you do not provide us with some or all of the personal information requested, we may not be able to provide you with services or satisfy your request, to the requested standard or at all, and you may also miss out on receiving valuable information about Ovolo. In some cases, it is a legal requirement to obtain information from you and if you do not provide that information we may need to cease acting or terminate our relationship.

Cookies and IP Addresses

If you use our website, we may utilise “cookies” which enable us to monitor traffic patterns, trends, and to serve you more efficiently if you revisit our website. In most cases, a cookie does not identify you personally but may identify your internet service provider or computer.

We may gather your IP address as part of our business activities and to assist with any operational difficulties or support issues with our services. This information does not identify you personally.

However, in some cases, cookies may enable us to aggregate certain information with other personal information we collect and hold about you. We extend the same privacy protection to your personal information, whether gathered via cookies or from other sources, as detailed in this Privacy Policy.

You can set your browser to notify you, accept or reject, or disable cookies. However, if you do so, you may not be able to access certain areas of our website or take advantage of the improved website experience that cookies offer.

Cookie Data Policy

Data

Where we obtain any data as a result of your use of our website or through any information which you may provide to us, you acknowledge that we will own the data and all rights which may subsist in relation thereto. Such data will generally be collected and maintained in an aggregated form, without any personal details which would otherwise identify you.

Collection Notification Statement

Links to other sites

On our website, you will encounter links to third party websites. These links may be from us, or they may appear as content generated by other users. These linked sites are not under our control and thus we are not responsible for their actions. Before providing your personal information via any other website, we advise you to examine the terms and conditions of using that website and its privacy policy.

Personal information about other people

If you give us personal information about any other person, including in relation to, or in connection with, the rental/lease or sale of any property:

• we are entitled to assume that you have sought their consent to the disclosure of such personal information to us;
• we have collected their personal information for the purposes set out in this Privacy Policy;
• we may exchange their personal information with other organisations for the purposes set out in this Privacy Policy; and
• we will handle their personal information in the same way as set out in this Privacy Policy.

Consent to Collection and Use

By using the Ovolo website and services, providing information to us via any medium (including engaging with us through any social media channel), applying for a job with us or entering into an arrangement or other agreement with us, you are consenting to the collection and use of your personal information in accordance with this Privacy Policy.

You consent to us collecting sensitive information which you provide to us voluntarily.

How we hold your personal information

Once we collect your personal information, we will either hold it securely and store it on infrastructure owned or controlled by us or with a third-party service provider who has taken reasonable steps to ensure they comply with the Privacy Act 1988 (Cth).

We provide some general information on our security measures below.

How we use personal information

The information we request, collect, and process is primarily used to provide users with the product or service they have requested. More specifically, we may use your personal information for the following purposes:

• to undertake our activities/services;
• to provide the service or product you have requested including to 3rd parties where requested or directed by you;
• to answer enquiries about our services, or to respond to a complaint;
• to promote our other programs, products or services which may be of interest to you (unless you have opted out from such communications);
• to allow for debugging, testing and otherwise operate our platforms;
• to conduct data analysis, research and otherwise build and improve our platforms;
• for billing and debt collection purposes;
• to undertake market research;
• to comply with legal and regulatory obligations;
• if otherwise permitted or required by law; or
• for other purposes with your consent, unless you ‘opt out’ or withdraw your consent for these purposes.

You acknowledge that we may also use your personal information:

• to provide a product or service that you have requested, for example, if you have requested information from the Ovolo website, via telephone or in person;
• to identify and/or verify the identity of any guest, client or provider;
• to process and assess any booking application received in relation to a property;
• to advertise, market and promote any property;
• to manage any property including the collection of fees and service charges;
• to ensure the safety and security of other guests;
• to provide our insurer with information relating to or connected with any property;
• to comply with any applicable law;
• to exchange information with other providers/properties which operate under the Ovolo banner including for ease of reference with bookings and check-ins as well as in relation to rewards programs and/or special offers;
• to inform and conduct marketing activities, unless you tell us not to;
• where you work for us, or apply to us for a job or work experience; and
• to maintain our records and comply with our legal obligations.

The ‘lawful processing’ grounds on which we will use personal information include (but are not limited to):

• when you have given consent;
• when necessary for the performance of a contract to which you are a party;
• processing is necessary for compliance with our legal obligations;
• processing is necessary in order to protect the interests of a natural person;
• processing is done in pursuing our legitimate interests, where these interests do not infringe on the rights of others.

When we disclose personal information

Sharing personal information with third parties

We may seek and use personal information about you from, and use or disclose personal information about you to, third parties in relation to or in connection with your booking of accommodation or the potential or actual rental of premises relating to hotel accommodation and/or function and event services. These third parties may include:

• if you are a venue hirer or guest, your referees, including in any booking application that you submit;
• government and/or regulatory bodies including (without limitation) immigration for overseas visitors. In some cases, these organisations may share information with foreign authorities;
• third party service providers including those which collect or aggregate data, which assist us to communicate with you;
• if we enter into, or propose to enter into, any agreement or arrangement with any party for the purpose of, or in connection with, the acquisition of our business (including any part of our business that includes personal information), that party (including its legal, financial and other professional advisers) to provide personal information in relation to or in connection with those arrangements; and
• service providers including IT and data consultants, agents, contractors and advisers that assist us to conduct our business.

Sharing personal information with related companies

We may share personal information about you with booking websites, travel agents and similar third party providers as well as the owners of properties under our management and our related companies for any of the purposes described above.

Our third party service providers

Your personal information may be held or processed on our behalf outside Australia, including ‘in the cloud’, by our third party service providers. Our third party service providers include offshore entities which undertake administrative work under our direction and instruction. They are bound by contract to only use your personal information on our behalf, under our instructions.

Our third party service providers may also include:

• Companies with whom you may choose to deal (and their representatives);
• Delivery partners and/or contractors;
• Cloud hosting, storage, networking and related providers;
• Payment, banking and credit rating providers;
• Marketing and analytics providers;
• Security providers; or
• Professional advisors, including lawyers, accountants and auditors.

Other disclosures and transfers

We may also disclose your personal information to third parties for the following purposes:

• if necessary to provide the service or product you have requested including to 3rd parties;
• we receive court orders, subpoenas or other requests for information by law enforcement;
• if otherwise permitted or required by law; or
• for other purposes with your consent.

Provision of informed consent

By submitting your personal information to us, you expressly agree and consent to the use of your personal information for the purposes set out above, as well as for the disclosure, transfer, storing, or processing of your personal information outside of Australia.

You acknowledge that Ovolo has premises globally and that Ovolo will share information within the various entities within its group which provide services under its banner. You expressly acknowledge and consent to the sharing of information amongst group entities for those purposes including for related purposes such as loyalty club and/or the provision of marketing information to you such as in relation to special offers.

In providing this consent, you understand and acknowledge that countries outside Australia do not always have the same privacy protection obligations as Australia in relation to personal information. However, we will take steps to ensure that your information is kept securely by any 3rd party and in accordance with the terms of this Privacy Policy.

The Privacy Act 1988 requires us to take such steps as are reasonable in the circumstances to ensure that any recipients of your personal information outside of Australia do not breach the privacy principles contained within the Privacy Act 1988. By providing your consent, under the Privacy Act 1988, we are not required to take such steps as may be reasonable in the circumstances. However, despite this, we acknowledge the importance of protecting personal information and have taken reasonable steps to ensure that your information is used by third parties securely and in accordance with the terms of this Privacy Policy.

If you do not consent

If you do not agree to the disclosure of your personal information outside Australia by us, you should tell us that you do not consent. To do this, either elect not to submit the personal information to us or contact us via the details set out in this document.

Accessing, correcting, or downloading your personal information

You have the right to request access to the personal information Ovolo holds about you. Unless an exception applies, we must allow you to see the personal information we hold about you, within a reasonable time period, and without unreasonable expense for no charge. Most personal information can be accessed by logging into your account. If you wish to access information that is not accessible through our website, or wish to download all personal information we hold on you in a portable data format, please contact us.

You also have the right to request the correction of the personal information we hold about you. All your personal information can be updated through the user settings pages. If you require assistance, please contact us.

Exercising your other rights

You have a number of other rights in relation to the personal data Ovolo holds about you. However, there may be restrictions on how you may exercise the rights. This is largely due to the nature of the products and services we provide. Much of the data we collect is in order to facilitate product/service enquiries, facilitate payments, and provide protection for the legitimate users of our Services – who are entitled to protection through the following:

• opt-out of direct marketing, and profiling for marketing
• erasure or deletion of personal information
• temporary restriction of processing.

Direct marketing and profiling

You can also control what email or notifications you receive through your settings page.

Express informed consent

You give your express and informed consent to us using your personal information to provide you with information and to tell you about our products, services, or events or any other direct marketing activity (including third party products, services, and events) which we consider may be of interest to you, whether by post, email, SMS, messaging applications and telephone (Direct Marketing Communications).

Opt-Out

If at any time you do not wish to receive any further Direct Marketing Communications from us or others, you may ask us not to send you any further information about services and not to disclose your information to other organisations for that purpose. You may do this at any time by using the “unsubscribe” facility included in the Direct Marketing Communication or by contacting us via the details set out in this document.

Anonymity and pseudo-anonymity

We will endeavour to provide you with the option of dealing with us on an anonymous basis or through the use of a pseudonym. However, there may be circumstances in which it is no longer practicable for us to correspond with you in this manner and your personal information may be required in order to provide you with our services or to resolve any issue you may have.

Erasure

Most personal information and user-generated content cannot be deleted as they are used to support contracts, document financial transactions, and are used in providing protection for other legitimate users of the marketplace. In the case of non-personal data that can be linked with personal data, it will either be erased or otherwise anonymised from the personal data.

Notwithstanding the above, we will take reasonable steps to:

• make sure that the personal information we collect, use, or disclose is accurate, complete, and up-to-date;
• protect your personal information from misuse, loss, unauthorised access, modification, or disclosure both physically and through computer security methods; and
• destroy or permanently de-identify personal information if it is no longer needed.

Data Breach

In the event that we become aware of any unauthorised access to our system which results in a genuine expectation that your personal information has been obtained by an unauthorised 3rd party, or in the event of any other breach or failure of our system which results in your personal information becoming available to, or being provided to any 3rd party then we will:

• take all reasonable steps to recover or otherwise secure your personal information;
• limit access to your personal information;
• minimise the risk of harm; and
• take such other steps as we may decide would be prudent for us to take in the circumstances.

We will also notify you of any breach in the event that we, acting reasonably, form the view that the breach cannot be reasonably contained and is likely to result in any serious harm.

Temporary restriction to processing

Under certain circumstances, you may exercise this right, in particular if you believe that the personal data we have is not accurate, or you believe that we do not have legitimate grounds for processing your information. In either case, you may exercise this right by contacting us.

Unless stated above, users may exercise any of the above rights by contacting us.

To contact us

If you have an enquiry or a complaint about the way we handle your personal information, or to seek to exercise your privacy rights in relation to the personal information we hold about you, you may contact us electronically or by post. Contact information is available on our website http://www.ovolohotels.com.

While we endeavour to resolve complaints quickly and informally, if you wish to proceed to a formal privacy complaint, we request that you make your complaint in writing to us, by mail or email. We will acknowledge your formal complaint within 10 working days of receipt.

If we do not resolve your privacy complaint to your satisfaction, you may lodge a complaint with the authority in the respective country/countries.

Consent, modifications, and updates

Interaction of this Policy with contracts

This Privacy Policy is a compliance document prescribed by law rather than a legal contract between two or more persons. However, we will ask for your consent, consistent with the terms of this policy and certain contracts may incorporate all, or part, of this Privacy Policy into the terms of that contract. In such instances, we may incorporate the terms of this policy such that:

• certain sections or paragraphs in this policy are incorporated into that contract, but in such a way that they do not give rise to contractual obligations onto us, but do create contractual obligations on the other party to the contract; and
• the consents provided in this policy become terms of the contract.

Acknowledgement

By using our website, or in otherwise obtaining a service from us, where you have been provided with a copy of our Privacy Policy or had a copy of our Privacy Policy reasonably available to you, you acknowledge and agree:

• to provide the consents given by you in this Privacy Policy; and
• that you have been informed of all of the matters in this Privacy Policy.

Modification and Updates

We operate in a dynamic business environment. We reserve the right to modify our Privacy Policy as our business needs require. We will take reasonable steps to notify you of such changes (whether by direct communication or by posting a notice on our website). If you do not agree to our continued use of your personal information due to the changes in our Privacy Policy, please cease providing us with your personal information and contact us via the details set out in this document.

Credit Reporting Policy

We may also be bound by the credit reporting provisions of the Privacy Act and the Credit Reporting Code registered under the Privacy Act. For instance, where we provide services to you on credit (that is, you will pay for those services after we start providing them to you), we are a credit provider for the purposes of the Privacy Act.

This Credit Reporting Policy describes how we manage credit-related information about individuals (credit information). It does not apply to the collection or use of credit-related information about corporations.

We will ensure that all personal information (including credit information) which we handle is managed in accordance with the Privacy Act and other applicable laws protecting privacy.

Collection of credit information

We may collect, hold, and use certain credit-related information about you. We will generally only obtain this information from you. We will not routinely collect or exchange information with credit reporting bodies and other credit providers unless you authorise us to do so. We use credit-related information to assist us in determining whether we will provide or continue to provide services to you on credit and to manage our relationship with you. Credit-related information includes your name and contact details, your credit history (including any repayments or late repayments you have made), any credit rating or credit assessment score that we calculate; and details of any credit-related court proceedings or insolvency applications that relate to you.

We will securely store all credit-related information that we collect or hold about you.

Disclosure of credit information

Unless otherwise required by law, we will only disclose your credit-related information to third parties in limited circumstances as permitted by the Privacy Act. We may disclose your credit-related information to parties that provide credit-related services to us such as debt collectors, credit management agencies, and our agents. We may also disclose your credit-related information to a third party that you or we request act as a guarantor in relation to any credit provided to you. We may also disclose credit information to credit reporting bodies where there has been a default in payment. We will provide at least 14 days’ notice of our intention to disclose default information to a credit reporting body before making any such disclosure. We will not directly disclose any credit information to any recipient located outside of Australia.

Other circumstances where we may disclose your credit-related information include where required by law or the order of a court or tribunal and where you otherwise expressly consent to the use or disclosure.

Access & Corrections

Consistent with our Privacy Policy, you may request access to any credit-related information that we hold about you.

If you request that we correct any credit-related information that we hold about you, we will endeavour to respond to that request within 21 days (or such longer period as you may agree) and correct any credit-related information that we hold about you that we are satisfied is inaccurate, out-of-date, incomplete, irrelevant or misleading.

Complaints

You may complain about any failure by us to comply with Part IIIA of the Privacy Act or the Credit Reporting Code. If your complaint relates to our failure to provide access to or to correct any credit-related information that we hold about you, you may lodge a complaint directly with the authority in the respective country/countries. If your complaint does not relate to these matters, you must first lodge a complaint with us in accordance with the procedure set out in our Privacy Policy, which sets out how we will deal with such complaints.

A complaint may be lodged by contacting us directly.