Privacy Policy

This policy explains what personal information Venuboost collects, why we collect it, how we use it, who we share it with, and the choices you have. It applies to the Venuboost platform, our mobile and kiosk apps, our public website, and any service that links to this policy.

We have written it in plain language so you can understand it without legal training. If a short summary and a longer section say different things, the longer section is the one that applies.

Venuboost is the trading name of the entity that operates the Venuboost platform. In this policy, "Venuboost", "we", "us" and "our" refer to that entity and its controllers.

When a venue uses Venuboost to run its business, the venue is the controller of the personal data it enters about its own customers and staff. We are a processor for that venue, which means we handle that data on the venue's instructions. If you are a guest or customer of a venue, your direct relationship is with that venue, and most requests about your data should go to the venue first.

We collect personal information in three ways.

1. Information you give us. This includes the name, email address, phone number, date of birth and postal address you enter when you create an account, make a booking, sign a waiver, or contact support. Venues may also enter these details on your behalf at the counter.
2. Information collected automatically. When you use our website or apps, we receive standard technical data such as your device type, operating system, browser version, approximate location derived from your IP address, and the pages you view. We also receive a referrer address when you arrive from a link.
3. Information collected during your visit or event. If you take part in a karting session or timed activity, the venue may record your lap times, race results and grid position. If you sign a waiver, the venue stores a record of that waiver, the signature, the date and the expiry. If you make a payment, we process the transaction record without storing your full card number.

We use personal information for these purposes:

• To provide the booking, scheduling and point of sale service a venue has signed up for.
• To let you book, pay, sign a waiver and take part in an activity.
• To time races, record results and publish lineups and standings.
• To confirm your identity and age where an activity requires it.
• To send you booking confirmations, reminders, receipts and follow up messages about a booking you made.
• To detect, prevent and respond to fraud, abuse and security incidents.
• To maintain and improve the platform, fix faults and measure performance.
• To meet legal, tax and regulatory obligations that apply to us or to the venue.

Where we rely on your consent, you can withdraw it at any time. Withdrawing consent does not affect processing that already took place.

For users in jurisdictions with a formal lawful basis requirement, we process personal information on one or more of the following bases:

• Performance of a contract, so we can deliver the booking or service you asked for.
• Compliance with a legal obligation, such as tax record keeping.
• Our legitimate interests in running, securing and improving the platform.
• Your consent, for activities that are not covered above, such as optional marketing.

Payment processing is handled by third party payment providers such as Stripe and Linkly. We never receive or store your full card number, card verification code or the full contents of your bank account. We receive a transaction reference, an approval status and the last few digits of the card used, which is enough to reconcile a sale and show it on a receipt without exposing the card.

We do not sell your personal information. We share it only in these situations:

• With the venue that operates the booking, waiver or event you are part of, so it can run its business.
• With service providers who help us operate the platform, such as hosting, database, email delivery, SMS delivery and payment providers. These providers process data on our instructions and are bound by their own confidentiality and security obligations.
• When we are required to by law, court order, or a legitimate request from a law enforcement or government authority with the power to compel disclosure.
• In connection with a sale, merger, restructure or transfer of all or part of our business, subject to the buyer agreeing to honour this policy.

Venuboost and its providers may process personal information in countries other than the one you live in. Where that happens, we rely on safeguards such as standard contractual clauses or another lawful transfer mechanism, and we keep the protections of this policy in place.

We keep personal information for as long as the account is active, for as long as we need it to provide the service, and for as long as the law requires. Booking, payment, tax and waiver records are typically kept for the period required by local tax and consumer law, which can be several years after the booking. When information is no longer needed, we delete it or anonymise it so it can no longer be linked to you.

We protect personal information with industry standard measures, including encryption in transit and at rest, strict access controls, role based permissions, audit logging and isolated per venue data separation. No system can be guaranteed to be perfectly secure, so we also maintain monitoring and incident response procedures. If a breach occurs that is likely to result in a risk to your rights, we will notify you and the relevant regulator where the law requires it.

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Ask us to correct information that is wrong or out of date.
• Ask us to delete your personal information, subject to legal retention obligations.
• Object to or restrict certain processing.
• Receive a copy of your information in a portable format.
• Withdraw consent for processing that relied on it.
• Opt out of marketing communications at any time, using the unsubscribe link in an email or by contacting us.

If you are a guest of a venue, please ask the venue first, because it controls most of the data about your visit. To exercise a right against us directly, or to complain about how a venue handled your data, contact us using the details at the end of this policy. You also have the right to lodge a complaint with your local data protection authority.

Venuboost is a business platform used by venues that host families and minors. The venue is responsible for obtaining valid parental or guardian consent where an activity involves a minor, such as a waiver signed on behalf of a child. We do not knowingly collect personal information directly from children outside of a booking or waiver that a parent or guardian has authorised. If you believe a child has provided us with personal information without consent, contact us and we will delete it.

We use cookies and similar technologies to keep you signed in, remember your preferences, measure how the site is used and keep the platform secure. We do not use cookies to sell your data to advertisers. You can control or delete cookies through your browser settings, but some parts of the platform may not work correctly if they are disabled.

Our platform may contain links to third party services such as payment providers, map providers and social media. This policy does not cover those services. We encourage you to read the privacy policy of any third party service you use.

We may update this policy from time to time. When we make a material change, we will update the date at the top of this page and, where appropriate, notify you through the platform or by email. Continued use of Venuboost after a change takes effect means you accept the updated policy.

If you have a question about this policy or want to exercise a right, contact us at hello@venuboost.com.au. We aim to respond within a reasonable time, and no later than the period required by the law that applies to you.