Privacy

Website Privacy Policy

This Privacy Policy applies to all personal information collected by Eco Suites Australia Pty Ltd (we, us or our) via the website located at www.ecosuitescanberra.com.au (Website).

1. What information do we collect?

The kind of Personal Information that we collect from you will depend on how you use the website. The Personal Information which we collect and hold about you may include:

name
phone number
address
email address
payment details
login credentials

2. Types of information

The Privacy Act 1998 (Cth) (Privacy Act) defines types of information, including Personal Information and Sensitive Information.

Personal Information means information or an opinion about an identified individual or an individual who is reasonably identifiable:

(a) whether the information or opinion is true or not; and

(b) (ii) whether the information or opinion is recorded in a material form or not.

If the information does not disclose your identity or enable your identity to be ascertained, it will in most cases not be classified as “Personal Information” and will not be subject to this privacy policy.

Sensitive Information is defined in the Privacy Act as including information or opinion about such things as an individual's racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record or health information.

Sensitive Information will be used by us only:

(a) for the primary purpose for which it was obtained;

(b) for a secondary purpose that is directly related to the primary purpose; and

(c) with your consent or where required or authorised by law.

3. How we collect your Personal Information

(a) We may collect Personal Information from you whenever you input such information into the Website, related app or provide it to Us in any other way.

(b) We may also collect cookies from your computer which enable us to tell when you use the Website and also to help customise your Website experience. As a general rule, however, it is not possible to identify you personally from our use of cookies.

(c) We use different types of cookies including essential cookies for Website functionality, analytical cookies to improve user experience, and marketing cookies that may be set by third parties. These cookies are retained for up to 28days and can be managed through your browser settings. Third-party cookies are subject to their respective privacy policies, which we encourage you to review.

(d) Before using our Website, you will be presented with a cookie consent banner that distinguishes between essential cookies (required for Website functionality), analytical cookies (to improve user experience), and marketing cookies (set by third parties for targeted advertising). You may withdraw consent at any time through your browser settings or by contacting Us.

(e) We use Google reCAPTCHA Essentials to protect the email subscription form from automated abuse. reCAPTCHA may collect device and usage information and set cookies from Google. This processing is required for the subscribe form to work. See Google's Privacy Policy and Terms of Service.

(f) We generally don't collect Sensitive Information, but when we do, we will comply with the preceding paragraph.

(g) Where reasonable and practicable we collect your Personal Information from you only. However, sometimes we may be given information from a third party, in cases like this we will take steps to make you aware of the information that was provided by a third party.

(h) Our online digital guest portal, online booking engine, digital registration card collects information to facilitate your booking and enhance your experience.

(i) Our Eco Suites Canberra location operates CCTV system for the safety an security of guests and property. Footage is collected and stored in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

4. Purpose of collection

(a) We collect Personal Information to provide you with the best service experience possible on the Website and keep in touch with you about developments in our business.

(b) We customarily only disclose Personal Information to our service providers who assist us in operating the Website including our booking engine owned and operated by SiteMinder Ltd. Your Personal Information may also be exposed from time to time to maintenance and support personnel acting in the normal course of their duties.

(c) We require all service providers handling Personal Information to execute Data Processing Agreements mandating: (a) compliance with Australian Privacy Principles; (b) implementation of security measures equivalent to our own standards; (c) notification of any data breach within 48 hours; (d) deletion of Personal Information upon contract termination; and (e) annual security audits. Service providers remain contractually liable for breaches of these obligations, and we maintain a register of all service providers and their data handling practices available upon request.

(d) By using our Website, you consent to the receipt of direct marketing material. We will only use your Personal Information for this purpose if we have collected such information direct from you, and if it is material of a type which you would reasonably expect to receive from use. We do not use sensitive Personal Information in direct marketing activity. Our direct marketing material will include a simple means by which you can request not to receive further communications of this nature, such as an unsubscribe/ opt-out button link and/or manage your preferences.

(e) You can manage your marketing preferences through the unsubscribe function in the marketing material or by contacting privacy@ecosuitesaustralia.com.au. We will process opt-out requests within 14 business days and maintain records of your preferences. If you choose to opt-out, we will retain minimal Personal Information necessary to ensure compliance with your request.

(f) All Data Processing Agreements must specify: (a) permitted uses limited to providing booking engine and website services; (b) security obligations including encryption, access controls, and incident response procedures; (c) breach notification within 24 hours of discovery; (d) deletion of Personal Information within 7 days of contract termination; (e) annual third-party security audits (SOC 2 Type II or equivalent); (f) our audit rights to verify compliance; (g) liability allocation whereby service providers are liable for direct damages resulting from breach of Data Processing Agreement obligations, capped at fees paid in the 12 months preceding the breach; and (h) indemnification for unauthorised disclosure or security failures. Any service provider breach will be reported to affected individuals within 7 business days and to the Office of the Australian Information Commissioner where required by law.

(g) We will only send direct marketing material where you have explicitly opted-in to receive such communications by ticking a clearly labelled consent checkbox at the point of collection, separate from your acceptance of this Privacy Policy. Every marketing communication will include: (a) a clear unsubscribe link; (b) identification of Eco Suites Australia as the sender; (c) your name and contact details; and (d) a valid physical address, in compliance with the Spam Act 2003 (Cth). We do not rely on implied consent arising from Website use as a basis for sending commercial electronic messages.

5. Security, Access and correction

(a) We store your Personal Information in a way that reasonably protects it from unauthorised access, misuse, modification or disclosure. All sensitive payment information collected to process your request will be compliant with CPI DSS requirements. When we no longer require your Personal Information for the purpose for which we obtained in, we will take reasonable steps to destroy and anonymise or de-identify it. Most of the Personal Information that is stored in our client files and records will be kept for a maximum of 7 years to fulfill our record keeping obligations.

We implement industry-standard security measures including encryption, access controls, and secure data centers to protect your Personal Information. When deletion is required, we use secure erasure methods including digital shredding and physical destruction of storage media. For digital records, we employ 30 day retention periods for active data and 7 years for archived data, after which automated purge protocols permanently remove the information using government-approved secure deletion standards.

(b) The Australian Privacy Principles:

(i) permit you to obtain access to the Personal Information we hold about you in certain circumstances (Australian Privacy Principle 12); and

(ii) allow you to correct inaccurate Personal Information subject to certain exceptions (Australian Privacy Principle 13).

(c) Where you would like to obtain such access, please contact us in writing on the contact details set out at the bottom of this privacy policy.

6. Complaint procedure

If you have a complaint concerning the manner in which we maintain the privacy of your Personal Information, please contact us as on the contact details set out at the bottom of this policy. All complaints will be considered by us and we may seek further information from you to clarify your concerns. If we agree that your complaint is well founded, we will, in consultation with you, take appropriate steps to rectify the problem. If you remain dissatisfied with the outcome, you may refer the matter to the Office of the Australian Information Commissioner.

7. Documentation and Response Timeline

We will acknowledge receipt of your complaint within 2 business days and provide you with a reference number. Our privacy team will investigate your complaint and maintain detailed records of all communications and findings. We aim to resolve all privacy complaints within 5 business days. If additional time is required, we will notify you in writing. All complaint documentation will be retained for 12 months following resolution. If the matter requires escalation, our Privacy Officer will personally review your case within 7 business days of the escalation request.

8. Overseas transfer

Your Personal Information may be transferred to recipients located overseas in countries including but not limited to United States of America, Netherlands. United States of America, Netherlands has data protection laws which protect Personal Information in a way which is at least substantially similar to the Australian Privacy Principles, and there will be mechanisms available to you to enforce protection of your Personal Information under that overseas law. In the circumstances, we do not require the overseas recipients to comply with the Australian Privacy Principles and we will not be liable for a breach of the Australian Privacy Principles if your Personal Information is mishandled.

9. GDPR

In some circumstances, the European Union General Data Protection Regulation (GDPR) provides additional protection to individuals located in Europe. The fact that you may be located in Europe does not, however, on its own entitle you to protection under the GDPR. Our website does not specifically target customers located in the European Union and we do not monitor the behaviour of individuals in the European Union, and accordingly the GDPR does not apply.

In some circumstances, the European Union General Data Protection Regulation (GDPR) provides additional protection to individuals located in Europe. Where our website collects or processes Personal Information of individuals located in the European Union, we will: (a) obtain your explicit consent prior to processing; (b) provide clear notice of the purposes for which your information is used; (c) ensure any overseas transfers of your Personal Information are subject to appropriate safeguards; and (d) honour all applicable GDPR rights upon request. You may withdraw consent at any time by contacting us at privacy@ecosuitesaustralia.com.au. Our reservation system including the property management system (RMS Cloud) stores data outside the EU or EEA for the purpose of processing, backup, and disaster recovery.

If you are located in the European Union and the GDPR applies to the processing of your Personal Information, you have the right to: (a) access and obtain a copy of your Personal Information; (b) request rectification of inaccurate data; (c) request erasure in certain circumstances; (d) object to processing based on legitimate interests; (e) request restriction of processing; (f) data portability; and (g) lodge a complaint with your national data protection authority.

10. How to contact us about privacy

If you have any queries, or if you seek access to your Personal Information, or if you have a complaint about our privacy practices, you can contact us through: privacy@ecosuitesaustralia.com.au.

11. Breach Remedies and External Review Rights

If we substantiate a privacy breach affecting your personal information, we will notify you within 5 business days and provide a detailed breach report. Available remedies include data correction, deletion of affected information, or credit toward future bookings as appropriate to the breach severity. You retain the right to lodge a formal complaint with the Office of the Australian Information Commissioner if dissatisfied with our resolution. For disputes involving compensation or significant breaches, we offer independent mediation before external escalation. We maintain a privacy breach register and implement corrective measures to prevent recurrence of substantiated breaches.

12. Policy review and updates

This Privacy Policy is reviewed annually and updated to reflect changes in privacy laws, our business practices, or service provider arrangements. Material changes (including new overseas transfers, changes to data retention periods, or new service providers) and non-material updates (such as clarifications or formatting changes) will be posted on our website. Guests may request a copy of our policy by contacting privacy@ecosuitesaustralia.com.au.