1. Scope

This Privacy Policy applies to the collection, holding, use and disclosures of personal and sensitive information provided about individuals to EVEDA through the use of the website, https://www.eveda.com.au/ (“the website”), other applications related to EVEDA, and any services offered or provided by EVEDA (“services”). In this Privacy Policy, we also explain how you can contact us if you have a query about any personal or sensitive information that we may be holding about you. If you are an EU Individual, please refer to sections 17 and 18, which deals with matters specific to EU Individuals.

2. Acknowledgement

By continuing to use the website and/or services or when you purchase services from Eveda, you acknowledge that you have had the opportunity to read this Privacy Policy. You also acknowledge and consent to Eveda collecting, holding, and disclosing personal information supplied by you and retaining and/or using your personal information subject to the terms of this Privacy Policy, the website, any terms and conditions that apply to any services that we provide to you, and any other applicable contracts or laws. If you provide us with personal and/or sensitive information of a third party individual, you will be responsible for bringing the existence of this Privacy Policy to their attention and obtaining their consent for their personal or sensitive information to be provided to Eveda for the purposes indicated in this Privacy Policy or as otherwise indicated at the time of collection.

3. Purpose

The purpose of this Privacy Policy is to:

• clearly communicate the personal and sensitive information handling practices of Eveda;
• enhance the transparency of Eveda’s information collection processes;
• and to give individuals a better understanding of the sort of personal information that Eveda collects, and the way Eveda handles and stores that information.

4. Personal Information

In this Privacy Policy, “personal information” has the same meaning as defined by section 6 of the Privacy Act 1988 (Cth), as amended: information or an opinion about an identified individual, or an individual who is reasonably identifiable: a) whether the information or opinion is true or not; and b) whether the information or opinion is recorded in material form or not. Personal information may include your name, address (including previous addresses), information about you (including medical information), contact telephone number(s), e-mail addresses, bank account and credit card details, and/or other information that is necessary for the delivery of our services to you.

5. Sensitive Information

In this Privacy Policy, “sensitive information” has the same meaning as defined by section 6 of the Privacy Act, and may include details or an opinion about your health information. We will only collect your sensitive information with your consent and where information is reasonably necessary for one or more of our services. We will only use and disclose your sensitive information for the primary purpose for which it was collected or a purpose that is directly related to this primary purpose and is reasonably expected. You consent to the use and disclosure on this basis. If for example we have collected information about any medical conditions you are suffering, then you consent to us disclosing this information to our service providers if they reasonably have a need to know such information in order to safely supply services for your benefit. We will not otherwise collect, use or disclose sensitive information about you unless required to do so by law.

6. Collection of personal information

In the course of our regular business activities, and in order to use the website and/or our services, Eveda will from time to time require the collection of your personal and/or sensitive information. If you do not want any of your personal and/or sensitive information collected, you can stop using the website and/or our services at any time (subject to applicable contracts). However, we may not be able to provide our services to you. Eveda collects personal and/or sensitive information from individuals in numerous ways, including when an individual:

• visits or uses the website or social media channels;
• contracts or corresponds with Eveda in person or via telephone, email, mail or directly through our website;
• makes a purchase(s) from Eveda;
• pays an invoice; or
• provides us with personal and/or sensitive information, including by allowing information on social media to be shared with us, signing up for a promotion or competition, or when you subscribe to receive marketing from us (e.g., signing up to receive Eveda’s newsletter).

We may also collect personal and/or sensitive information about you from third parties or where Eveda is required to do so by law. Eveda does not generally take steps to:

• verify personal and/or sensitive information about any individual disclosed to it; or
• seek additional personal and/or sensitive information about any individual on the basis of information disclosed to it,

except in circumstances where it is reasonably necessary for us to do so or as may be required by law, including (but not limited to) confirming the identity of an individual seeking access to personal and/or sensitive information. We note that in certain circumstances, if you do not consent to the use of your personal and/or sensitive information as outlined in this Privacy Policy or at the time of collection, you may not have access to our services, and we might not be able to provide you with our services.

7. Cookies

Cookies are small blocks of data created by a web server while a user is browsing a website and placed on the user’s computer or other device by the user’s web browser. Cookies are placed on the device used to access a website, and more than one cookie may be placed on a user’s device during a session. To ensure we are meeting the needs and requirements of our website users, and to continue to develop our online services, we may collect aggregated information through the use of cookies. We may use cookies to collect data about your visit and to allow you to navigate from page to page without having to reload each time. You may control, refuse and/or delete cookies by using the appropriate setting on your browser as you wish, however, if you do so you may be unable to access portions of our website.

8. Use of personal information

Any personal information collected by Eveda will be used for the purpose for which it was given to Eveda, for purposes which are directly related, for purposes which you have otherwise consented to, or otherwise in accordance with the law or this Privacy Policy.

9. Direct marketing communications

We may contact you using the contact details which you provide to us to provide you with direct marketing communications about our services (in accordance with the permitted limits of the law). You may opt out of receiving direct marketing communications from us at any time by contacting us using the details set out below or by functionality within such communications.

10. Disclosure

We may disclose personal and/or sensitive information we hold to:

• our directors, officers, employees and other associated companies or related entities or organisations;
• our contracted service providers;
• credit card providers, credit reporting and fraud checking agencies;
• government, regulatory and law enforcement agencies where the disclosure is required or authorised by law;
• our professional advisors, including our accountants, auditors and lawyers;
• third party suppliers of products or services which you have selected (such as airlines, ground operators, hotels and insurance providers);
• our online booking facility operator and host and others who assist in providing these services;
• third party sponsors or co-sponsors of promotions on our website (only information collected during a promotion will be disclosed to these parties);
• third parties when we contract out some of our functions and activities, such as call centre operators.

In these circumstances, we prohibit third parties from using your personal information, except for the specific purpose for which we supply it.

11. Overseas Disclosure

We may disclose personal and/or sensitive information to overseas recipients in order to provide services. Generally, we will only disclose your personal information to these overseas recipients in connection with our services such as facilitation or fulfilment of your travel booking and/or to enable the performance of administrative and technical services by them on our behalf.

12. Access to personal information

If you would like access to your personal and/or sensitive information, you can contact our office directly via the contact details found below under “Contact”.

13. Correction of personal information

If Eveda holds personal and/or sensitive information about you and you believe that any of the information we hold about you is inaccurate, out of date, incomplete, please make a request to our office for correction. Contact details can be found below.

14. Storage and Security

Eveda will take reasonable steps to protect the personal and/or sensitive information we hold from misuse, interference, loss and unauthorised access, modification or disclosure. Eveda may store personal information physically and/or electronically.

15. Links – external websites

Please note that our website may contain links to other external websites. These links are provided as a convenience to you. Eveda is not affiliated with these sites and accordingly has no control over, and is not responsible for, their content, activities, privacy practice or other policies. Links to external websites are not covered by this Privacy Policy.

16. General – Change to Privacy Policy

This is our current Privacy Policy. Please note that we reserve the right to amend, modify, remove, or vary this Privacy Policy at any time and without notice. You should check this page regularly to take notice of any changes we may have made to this Policy. To obtain a current version of our privacy policy, please contact Eveda via the contact details below.

17. GDPR compliance

If you are a resident of the European Union (or following Brexit, you are a resident of the UK and the UK has laws equivalent to the GDPR in effect), you have certain rights and protections under the GDPR (or the UK equivalent) regarding the processing of your personal data. This section sets out the additional information that we are required to provide to you under the GDPR. Please note that references to the GDPR also includes references to any UK equivalent. Where the GDPR applies, the meaning of “personal information” has the same meaning as “personal data” and the meaning of “sensitive information” will apply as information concerning the processing of special categories of personal information (“sensitive data”) under the GDPR. For the purposes of the GDPR we will either be the “data processor” or “data controller” for any personal information you provide to us in connection with our relationship. The precise role we will be assuming is dependent on the context of our relationship with you and the purpose of the processing being undertaken. Under the GDPR, use of personal information must be based on a legal basis, and we are required to provide you with information about this use. We rely on lawful means of processing your personal data, including the following:

• where it is necessary to fulfil a contract with you. This includes where we collect your personal data to enable us to provide you with our services;
• where you have given us valid consent to use your personal data. We will rely on that consent and only use the personal data for the specific purpose for which you have given consent;
• where it is to further our legitimate interests which could include usage statistics, analytics, and internal analysis so we can improve our services to you.

We note that we may process your personal data for more than one lawful ground, depending on the specific purpose for which we are using your data. If you need details about the specific legal ground Eveda is relying on to process your personal data, please contact Eveda.

18. Your right as a European Union of UK resident

Under certain circumstances or if you are a resident of the European Union or UK, you have various rights under the GDPR in relation to your personal information, including the right to:

• be informed;
• access information;
• rectification;
• object/ withdraw consent;
• restriction of processing;
• erasure or to be forgotten;
• data portability; and
• not be subject to automated processing.

To exercise any of these rights please contact Eveda via the contact details set out below under “Contact”.

19. Withdrawing your consent

You can withdraw your consent to our collection or processing of your personal data. You can do so by contacting us or by opting out of email newsletter communications by following the instructions in those emails or by clicking unsubscribe. If you withdraw your consent to the use of your personal data, you may not have access to our services, and we might not be able to provide you with our services. In some circumstances, where we have a legal basis to do so, we may continue to process your information after you have withdrawn consent. For example, if it is necessary to comply with an independent legal obligation or if it is necessary to do so to protect our legitimate interest in keeping our services secure.

20. Contact

If you have any questions or concerns about how we handle your personal or sensitive information, or if you wish to access or amend personal and/or sensitive information we hold about you, please make a request in writing. All correspondence should be directed to: Attention: Eveda Operation Manager Post: Suite 11/397, Smith St, Fitzroy, Victoria, Australia 3065 Email: info@eveda.com.au Phone: +61 3 9900 8888 If you decide to contact us for any of the reasons above, we request that you provide us with sufficient details regarding your reason for getting in touch with us. We note that, if necessary, we will ask you to provide us with a copy of your ID, passport or other valid identity document.

21. Complaints

If you have any enquiries about this Privacy Policy or wish to make a complaint about a matter relating to privacy, please contact us using the details set out above. We will investigate and consider any complaint received by us, and a response will be provided to the complainant as soon as practicable.