Privacy Policy

This Privacy Policy outlines our commitment to protecting your personal information.

In this Privacy Policy, "we" and "us" refers to Tourism Media Pty Ltd, ACN 102 751 879, and "you" refers to any individual about whom we collect personal information.

This policy applies to our tourismmedia.com.au website ("our website") and to our business generally.

We comply with all relevant privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and relevant State laws. Where we handle personal information about people in the United Kingdom or the European Union, we also have obligations under the UK GDPR and the EU General Data Protection Regulation — see the section below on additional rights for individuals in the UK and Europe.

We are based in Australia.

This Privacy Policy explains the kinds of personal information we collect and why, and how we hold, use and disclose it.

Where we rely on your consent to collect or use your personal information, we will ask for it clearly, and you may withdraw it at any time by contacting us. Continuing to browse our website is not treated as consent to anything beyond the essential operation of the site.

We are a business-to-business media company, and we deliberately collect only what we need.

The types of personal information we collect depend on the circumstances, and may include:

• Your name and contact details, including email address, postal address and phone number
• Records of our communications and dealings with you, such as emails, calls and meetings
• Information about your use of our website — see the section below on our website, cookies and analytics
• Information about your use of or interest in our products and services
• For suppliers, contributors and business partners, the information we need to do business with you, engage you, credit your work and pay you. This may include payment details and an ABN.

We also collect information where we are required to do so by law.

We do not knowingly collect information from, or direct any of our content specifically to, children under the age of 18. If you are under 18, please do not use our website or provide your personal information to us.

We do not collect government identifiers such as tax file numbers, driver licence or passport numbers, except where the law requires us to.

When you use our website, our systems automatically collect information about your visit. This may include:

• Which pages you visit, and which articles, photographs and videos you view
• Server log information, including your IP address, browser type and language, device and operating system, the date and time of your visit, and the referring URL
• Approximate geographic region, derived from your IP address

Enquiry forms. If you contact us through a form on our website, we collect the information you enter — typically your name, email address and your message — so that we can respond.

Other than statistical information and user behaviour, we do not collect information about you through our website unless you voluntarily provide it.

Cookies and similar technologies

We use cookies and similar technologies, including pixel tags, local storage and server logs, to operate the site, remember your preferences and understand how the site is used.

Cookies are small files stored by your browser. You can set your browser to reject cookies, or delete individual cookies or all cookies, by following your browser's help instructions. Turning cookies off may disable some functions of this and other websites.

Google Analytics

We use Google Analytics to understand how visitors use our website so that we can improve it. Information collected by Google Analytics is transmitted to and stored by Google in accordance with Google's privacy practices. This involves a transfer of data outside Australia — see the section below on overseas disclosure.

You can opt out of Google Analytics at:

For information about Google's advertising systems:

To opt out of targeted advertising from Network Advertising Initiative members:

The Digital Advertising Alliance's opt-out portal is at:

Consent. We do not currently ask for your consent before setting analytics cookies. You can prevent or remove them at any time using your browser settings or the opt-out links above.

Other websites and Do Not Track

Our website may contain links to other websites. We are not responsible for the privacy practices or content of other websites, and their practices may differ substantially from ours. Please read the privacy policy of any website you visit.

We take reasonable steps to ensure our commercial partners protect personal information in accordance with the Privacy Act.

We do not currently alter our website's data collection practices in response to a Do Not Track signal from your browser.

Sensitive information includes information about your health, racial or ethnic origin, religious or political beliefs, sexual orientation and criminal record.

We do not usually collect sensitive information. If we need to, we will only collect it with your consent and where it is reasonably necessary for our functions, or where we are otherwise allowed or required by law.

Please do not send us sensitive information unless we have asked for it. If you do send us sensitive information we have not requested, we will consider whether we could have collected it lawfully, and if not, we will destroy or de-identify it where the law permits.

We collect personal information:

• Directly from you — when you contact us, enter your details on our website, enquire about or acquire our services, or supply content or services to us
• From your organisation, where a colleague provides your work contact details
• When you interact with our website and online content
• From publicly available sources, such as a company website or professional networking profile, where we are researching a business contact

Where it is reasonable and practicable, we collect personal information directly from you. If you choose not to provide information, we may be unable to supply our services to you.

We use personal information to:

• Provide our services and produce and distribute our content
• Respond to your enquiries and provide support
• Engage, credit and pay contributors, suppliers and contractors
• Manage our relationships with clients, partners and suppliers
• Operate, maintain, secure and improve our website
• Maintain and update our records
• Comply with our legal obligations, resolve disputes, and enforce our agreements
• Investigate or pursue a legal claim
• As otherwise required or authorised by law

We will only use or disclose your personal information for the purpose we collected it, for a directly related purpose you would reasonably expect, with your consent, or where the law requires or permits it.

Tourism Media does not send marketing or promotional emails. We do not operate a newsletter or mailing list.

We may contact you directly about work we are doing with you, an enquiry you have made, or a business relationship we have with you. These are service-related communications rather than marketing.

We do not sell personal information, and we do not sell or rent any contact list.

If we introduce marketing communications in future, we will update this policy first, will only send them where you would reasonably expect it or have consented, will include a simple opt-out in every message, and will comply with the Spam Act 2003 (Cth).

We may disclose your personal information to:

• Our staff and contractors, on a need-to-know basis, under the "least privilege" approach set out in our Software Access and IT Security Policy
• Our service providers, including our cloud, email and file storage provider (Google Workspace), our password manager (Dashlane), our accounting and payroll provider (Xero), and our website hosting, content publishing and analytics providers
• Our related bodies corporate
• Our commercial partners, where you have consented
• Our professional advisers, such as accountants, auditors and lawyers
• Government agencies, regulators, law enforcement bodies, courts and tribunals, where required or authorised by law
• A person serving us with a subpoena or other legal document requiring disclosure
• Anyone who acquires or considers acquiring our business or assets, or part of it

We do not sell personal information.

Tourism Media operates internationally and engages contractors in Australia, the United States, Canada, the United Kingdom and Europe. Several of our service providers also store or process data outside Australia.

Your personal information is likely to be disclosed to, or accessible from, recipients in:

• The United States — our cloud, email and file storage provider (Google Workspace), our analytics provider (Google Analytics), our password manager (Dashlane), and contractors engaged on projects
• The United Kingdom, Europe and Canada — contractors engaged on projects who require access

Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it in a way consistent with the Australian Privacy Principles, as required by APP 8. Our contractor and supplier agreements are our primary mechanism for this and include data protection obligations. Where a contractor accesses personal data protected under EU or UK law, they also sign the relevant recognised transfer mechanism.

Where it is lawful and practicable, you have the option of dealing with us anonymously or using a pseudonym.

In most cases we will need your name and contact details to respond to an enquiry or do business with you, but you are welcome to contact us without identifying yourself if you would prefer.

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Our measures include:

• Named individual accounts — shared or generic logins are not permitted
• Multi-factor authentication on all business systems, and hardware security keys for access to our core applications and production environments
• A mandated password manager, with long, autogenerated passwords and breached-password monitoring
• A prohibition on storing business or customer data on personal devices or personal cloud storage
• Access limited to what each person needs to do their work, and revoked immediately when they leave
• Alignment with the Australian Cyber Security Centre's Essential Eight framework

We may store information in electronic or paper formats. Transmissions to and from our website are routinely monitored for quality control and systems administration.

No security measure is perfect. While we take these steps seriously, we cannot guarantee the security of information transmitted over the internet or stored electronically.

We have procedures for identifying, containing and assessing suspected data breaches.

If a data breach occurs that is likely to result in serious harm to affected individuals, we will notify those individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

Where a breach affects personal data protected under EU or UK law, we will also notify the relevant supervisory authority within the timeframes those laws require.

We keep personal information only for as long as we need it for the purposes described in this policy, or for as long as we are required to keep it by law — for example, tax and financial records must be retained for seven years.

When we no longer need personal information and are not required to retain it, we destroy it or de-identify it.

You have the right to access, update and correct the personal information we hold about you.

To request access, email privacy@tourismmedia.com.au. We will:

• Ask you to verify your identity
• Provide a copy of your personal information within a reasonable period, usually within 30 days
• Never charge you a fee for making a request, though we may charge a reasonable fee for providing access. If a fee applies, we will tell you before we provide access.

We take reasonable steps to ensure the personal information we hold is accurate, complete, up to date, relevant and not misleading. To request a correction, email the Privacy Officer at the same address.

If we refuse access or a correction, we will give you a written explanation of our reasons (unless it would be unreasonable to do so) and tell you how you can complain about that decision.

If you are in the United Kingdom or the European Union, the UK GDPR or EU GDPR may give you additional rights in relation to personal data we hold about you, including the right to erasure, the right to restrict or object to processing, the right to data portability, and the right to withdraw consent.

You also have the right to lodge a complaint with your local supervisory authority.

To exercise any of these rights, email privacy@tourismmedia.com.au.

If you would like more information, or wish to complain about our handling of your personal information, email privacy@tourismmedia.com.au.

We take complaints seriously. We will:

1. Acknowledge your complaint within 5 business days
2. Investigate and respond to you, ordinarily within 30 days. If we need longer, we will tell you why and keep you updated.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner:

For general information about the Privacy Act, visit www.oaic.gov.au

We review this Privacy Policy and our privacy practices at least annually.

From time to time we will change this policy. If we do, we will publish the updated policy on our website, and the changes take effect on publication. If the changes are significant, we will aim to notify customers by email where we hold your email address.

Please check our website from time to time to understand how the current version applies to you.

Email: privacy@tourismmedia.com.au

Last updated: 22 September 2026