Privacy Policy

Cooby Reflections Pty Ltd Trading as Camp Cooby and Cooby Reflections

ABN: 39 610 886 194

Last Updated: 9 October 2026

Effective Date: 1 October 2026

1. Purpose of This Policy

1.1 Our Commitment

Cooby Reflections Pty Ltd (ABN 39 610 886 194) trading as Camp Cooby and Cooby Reflections (we, us, or our) is committed to protecting the privacy of individuals who interact with our brands. We have adopted this Privacy Policy to ensure we have clear standards in place to protect the Personal Information that we collect about individuals that is necessary and incidental to:

(a) Providing the services, facilities, and experiences that we offer;

(b) Communicating with individuals about our services, events, and offerings;

(c) Conducting marketing activities to share relevant information with those who have expressed interest in our brands; and

(d) The normal day-to-day operations of our business.

1.2 Legal Framework

This Privacy Policy follows the standards of the Australian Privacy Principles (APPs) set by the Australian Government for the handling of Personal Information under the Privacy Act 1988 (Cth) (Privacy Act).

This Privacy Policy also operates in conjunction with our obligations under:

(a) The Spam Act 2003 (Cth) regarding commercial electronic messages;

(b) The Do Not Call Register Act 2006 (Cth) where applicable; and

1.3 Transparency

By publishing this Privacy Policy, we aim to make it easy for our customers, prospects, and the public to understand:

(a) What Personal Information we collect and store;

(b) Why we collect this information;

(d) How we use and disclose that information;

(e) How we protect that information; and

(f) The rights an individual has with respect to their Personal Information in our possession.

1.4 Our Brands

This Privacy Policy applies to both of our brands:

(a) Camp Cooby – providing school camps, youth camps, sporting group facilities, and related services; and

(b) Cooby Reflections – providing wedding venues, corporate retreat facilities, event spaces, and related services for adult guests.

When you interact with either brand, your Personal Information is held by Cooby Reflections Pty Ltd and may be used to communicate with you about services relevant to your expressed interests.

2. Who and What This Policy Applies To

2.1 Definition of Personal Information

Our Privacy Policy deals with how we handle "personal information" as it is defined in the Privacy Act (Personal Information). Personal Information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether recorded in a material form or not.

2.2 Scope of Application

We handle Personal Information in our own right and also for and on behalf of our customers and users. This includes:

(a) Guests and visitors to our facilities;

(b) Individuals who enquire about our services;

(d) Individuals who enter competitions or promotions we conduct;

(e) Individuals who register for events we host or participate in;

(f) Suppliers and contractors who provide goods or services to us;

(g) Job applicants and employees; and

(h) Any other individuals who interact with our brands.

2.3 Business Information

Our Privacy Policy does not apply to information we collect about businesses or companies. However, it does apply to information about the individuals within those businesses or companies which we store.

2.4 Forms of Information

This Privacy Policy applies to all forms of information, physical and digital, whether collected or stored electronically or in hardcopy.

2.5 Information About Others

If, at any time, an individual provides Personal Information or other information about someone other than himself or herself, the individual warrants that:

(a) They have that person's consent to provide such information for the purpose specified;

(b) They have informed that person about this Privacy Policy and where to access it; or

(c) They have reason to suspect that person has or will engage in an unlawful activity or misconduct of a serious nature, and they will be using our services as part of taking appropriate action in relation to the matter.

2.6 Children's Information

Camp Cooby Services: We collect information about children (persons under the age of 18 years) in connection with school camps, youth camps, and family bookings. This information is collected with the consent of a parent, guardian, or authorised school representative and is used solely for the purpose of providing our camp services safely and effectively.

Cooby Reflections Services: Our wedding, corporate, and event services are primarily directed at adults. We do not knowingly collect Personal Information directly from children for marketing purposes.

Marketing Communications: Individuals must be 18 years or older to subscribe to our marketing communications or enter competitions and promotions.

2.7 Websites and Digital Platforms

This Privacy Policy applies to the following websites and digital platforms operated by us:

(a) coobyreflections.com.au

(b) campcooby.com.au

(d) Our social media pages and profiles; and

(e) Any mobile applications we may operate.

3. The Information We Collect

3.1 Categories of Personal Information

In the course of business, it is necessary for us to collect Personal Information. This information allows us to identify who an individual is for the purposes of our business, contact the individual in the ordinary course of business, provide our services, and communicate relevant information. The types of information we may collect include:

(a) Identity Information

Personal details such as an individual's name, date of birth, gender, nationality, occupation, and other information that allows us to identify who the individual is.

(b) Contact Information

Information such as an individual's email address, telephone number, mobile number, residential address, business address, postal address, social media handles, and other information that allows us to contact the individual.

(c) Financial Information

Financial information related to an individual such as bank account details, credit card details, billing address, and other information necessary to process transactions and provide services.

(d) Booking and Service Information

Details about bookings, reservations, event requirements, dietary requirements, accessibility needs, group composition, and preferences related to our services.

(e) Marketing and Communication Preferences

Information about an individual's communication preferences, marketing consent status, areas of interest (e.g., school camps, weddings, corporate events), and engagement history with our communications.

(f) Competition and Promotion Information

Information submitted when entering competitions or promotions, including entry details, responses to competition questions, and any content submitted as part of an entry.

(g) Event Registration Information

Information provided when registering for events, including attendance preferences, session selections, and related details.

(h) Feedback and Correspondence

Any personal correspondence that an individual sends us, including enquiries, feedback, complaints, reviews, and survey responses, or that is sent to us by others about the individual's activities.

(i) Statistical and Analytical Information

Information about an individual's online preferences, browsing behaviour, engagement with our digital content, and other information for statistical and analytical purposes.

(j) Device and Technical Information

Information about the devices and technology an individual uses to access our websites and digital platforms, including IP address, browser type, operating system, device identifiers, and location data (where permitted).

3.2 Sensitive Information

We generally do not collect sensitive information (as defined in the Privacy Act) unless it is necessary for providing our services. Where we do collect sensitive information, such as:

(a) Health information relevant to camp activities or accessibility requirements;

(b) Dietary requirements that may indicate religious beliefs or health conditions; or

we will only collect such information with explicit consent and will handle it with additional care and security measures.

3.3 Non-Personal Information

We may also collect non-Personal Information about an individual, such as aggregated data, de-identified data, and statistical information. Where non-Personal Information is collected, the Australian Privacy Principles do not apply.

4. How Information Is Collected

4.1 Collection Methods

We collect Personal Information through various methods, depending on how an individual interacts with our brands. Information is likely to be collected as follows:

(a) Direct Enquiries and Contact

When an individual contacts us via telephone, email, our website contact forms, social media, or in person at our facilities.

(b) Bookings and Reservations

When an individual makes a booking, reservation, or enquiry about our services, whether directly or through a third-party booking platform. Booking information is managed through our booking system (Venue360) for service delivery and record-keeping purposes.

(c) Account Registration

When an individual creates an account or profile with us to manage bookings or access services.

(d) Marketing Subscriptions

When an individual subscribes to our newsletters, marketing communications, or updates through:

Website subscription forms
Landing page opt-in forms
Pop-up subscription requests
Event registration forms where marketing consent is provided

(e) Landing Pages and Lead Generation Forms

When an individual submits their details through dedicated landing pages created for specific campaigns, offers, or downloadable resources. These pages clearly identify the purpose of data collection and obtain explicit consent.

(f) Social Media Lead Advertisements

When an individual submits their details through lead generation advertisements on social media platforms, including but not limited to:

Facebook Lead Ads
Instagram Lead Ads
LinkedIn Lead Gen Forms

When submitting information through these platforms, individuals are subject to both this Privacy Policy and the privacy policies of the relevant social media platform.

(g) Competition and Promotion Entries

When an individual enters a competition, giveaway, or promotion conducted by us, whether through our website, social media platforms, or at our venues. Competition entries will clearly state the terms of entry and how Personal Information will be used.

(h) Event Registrations

When an individual registers for events we host, sponsor, or participate in, including open days, expos, information sessions, and community events.

(i) QR Code Interactions

When an individual scans a QR code at our venues or on our marketing materials and submits their details through the linked form or landing page. QR codes will direct to pages that clearly explain the purpose of data collection.

(j) Venue Visits

When an individual visits our facilities, we may collect information for:

Site tours and inspections
Visitor registration and safety purposes
Wi-Fi access (if provided)
Feedback and testimonial collection

(k) Supplier and Contractor Relationships

When an individual or their employer supplies us with goods or services.

(l) Employment Applications

When an individual applies for employment or volunteer positions with us.

(m) Third-Party Referrals

When we receive an individual's details from:

Event organisers where the individual has consented to their information being shared with exhibitors or sponsors
Referral partners where the individual has provided consent
Schools or organisations making group bookings on behalf of individuals

We do not purchase Personal Information from third-party data brokers or list providers.

4.2 Cookies and Tracking Technologies

When an individual accesses our websites and digital platforms, we may collect information using:

(a) Cookies

Small text files stored on an individual's device that help us recognise returning visitors, remember preferences, and understand how our websites are used. Individuals can adjust their browser settings to accept or reject cookies, though this may affect website functionality.

(b) Pixel Tags and Web Beacons

Small graphic images that enable us to:

Track email opens and engagement
Understand how individuals interact with our emails
Measure the effectiveness of our communications

(c) Analytics Services

We use analytics services (such as Google Analytics) to collect information about website usage, including pages visited, time spent on pages, and navigation patterns. This information helps us improve our websites and services.

(d) Remarketing and Advertising Technologies

We use remarketing technologies provided by third parties, including:

Meta (Facebook/Instagram) Pixel:

We use the Meta Pixel on our websites to:

Measure the effectiveness of our advertising
Understand actions people take on our websites
Build audiences for advertising purposes
Deliver relevant advertisements to people who have visited our websites

Google Ads Remarketing:

We use Google Ads remarketing to:

Show relevant advertisements to people who have previously visited our websites
Measure advertising effectiveness
Build audiences for advertising purposes

Individuals can opt out of personalised advertising through:

Their Google Ad Settings (adssettings.google.com)
Their Facebook Ad Preferences (facebook.com/ads/preferences)
The Digital Advertising Alliance opt-out page (optout.aboutads.info)
Their device settings for mobile advertising

4.3 Awareness of Collection

We will endeavour to ensure that an individual is always aware of when their Personal Information is being collected. Collection points will include clear notices about:

(a) What information is being collected;

(b) The purpose of collection;

(d) How to access this Privacy Policy.

4.4 Unsolicited Information

Where we obtain Personal Information without an individual's knowledge (such as by accidental acquisition from a client or unsolicited correspondence), we will either:

(a) Delete or destroy the information if we could not have collected it legitimately; or

(b) Inform the individual that we hold such information and how we intend to use it;

in accordance with the Australian Privacy Principles.

5. When Personal Information Is Used and Disclosed

5.1 Primary Principle

The primary principle is that we will not use any Personal Information other than for the purpose for which it was collected, other than with the individual's permission or as permitted by law. The purpose of collection is determined by the circumstances in which the information was collected and/or submitted.

5.2 How We Use Personal Information

We use Personal Information to enable us to operate our business and provide services to individuals. This includes:

(a) Service Delivery

Processing bookings and reservations
Providing our camp, venue, and event services
Managing guest experiences and requirements
Communicating about bookings and services
Maintaining booking records in our booking system (Venue360) for service delivery and business record-keeping

(b) Identity Verification

Verifying an individual's identity
Confirming booking and payment details
Ensuring appropriate authorisation for group bookings

(c) Transactional Communications

Sending booking confirmations and reminders
Providing invoices and receipts
Communicating service-related updates and changes

(d) Marketing Communications

Where an individual has provided consent, we may use their Personal Information to:

Send newsletters and updates about our services
Share information about special offers and promotions
Invite participation in competitions and giveaways
Provide information about events and experiences
Send communications relevant to their expressed interests (e.g., school camps, weddings, corporate events)

(e) Personalisation and Improvement

Personalising communications based on expressed interests
Improving our services based on feedback and usage patterns
Developing new services and offerings
Conducting market research and analysis

(f) Advertising and Remarketing

Where an individual has interacted with our websites or provided consent:

Creating custom audiences for advertising on social media platforms
Delivering relevant advertisements through remarketing
Measuring advertising effectiveness
Excluding existing customers from acquisition campaigns where appropriate

(g) Competitions and Promotions

Administering competitions and promotions
Contacting winners and facilitating prize delivery
Publishing winner announcements (with consent where required)

(h) Compliance and Protection

Investigating complaints about or made by an individual
Addressing suspected breaches of our terms and conditions
Investigating suspected unlawful activity
Complying with legal obligations

5.3 Disclosure to Third Parties

We may disclose Personal Information to third parties in the following circumstances:

(a) Service Providers

We engage third-party service providers to assist with our business operations. These providers are contractually required to protect Personal Information and only use it for the purposes we specify. Our service providers include:

Service Provider	Purpose	Location
GoHighLevel (HighLevel Inc.)	Customer relationship management, marketing automation, landing pages, forms, and communications	United States of America
Google (Google LLC)	Email (Gmail), analytics, advertising, and remarketing	United States of America
Meta (Meta Platforms, Inc.)	Social media advertising, remarketing, and lead generation	United States of America
Mailchimp (The Rocket Science Group LLC)	Email marketing communications	United States of America
Stripe, Inc.	Payment processing	United States of America
Amazon Web Services, Inc.	Website hosting	Australia / United States of America
Venue360	Booking management and customer records for service delivery (not used for marketing purposes)	Australia

(b) Professional Advisors

We may disclose Personal Information to our professional advisors, including accountants, auditors, lawyers, and business consultants, where necessary for them to provide their services to us.#### (c) Schools and Organisations

For Camp Cooby services, we may share relevant information with schools, youth organisations, or sporting groups who have made bookings on behalf of individuals, where necessary for the safe and effective delivery of our services.

(d) Event Partners

Where we participate in events, expos, or collaborative promotions, we may share information with event partners where an individual has consented to such sharing.

(e) Business Transfers

In the event of a sale, merger, or acquisition of our business, Personal Information may be transferred to the new owner. We will notify affected individuals of any such transfer and the new owner will be bound by this Privacy Policy until a new policy is communicated.

5.4 No Sale of Personal Information

We will not sell, rent, or trade an individual's Personal Information to unrelated third parties under any circumstances.

5.5 Required Disclosures

There are some circumstances in which we must or may disclose an individual's information:

(a) Where we reasonably believe that an individual may be engaged in fraudulent, deceptive, or unlawful activity that a governmental authority should be made aware of;

(b) As required by any law, regulation, or court order;

(d) To protect the rights, property, or safety of our business, our customers, or others; and/or

(e) In order to sell our business (in that we may need to transfer Personal Information to a prospective or new owner).

5.6 Overseas Disclosure

We will take reasonable steps to ensure that any disclosure to an entity outside of Australia will not be made until that entity has agreed in writing with us to safeguard Personal Information in accordance with the Australian Privacy Principles, or is subject to a law or binding scheme that provides comparable protections.

As noted in section 5.3(a), several of our service providers are located in the United States of America. These providers are subject to privacy frameworks and contractual obligations that provide appropriate protections for Personal Information.

5.7 Data Retention

We will retain Personal Information for the period necessary to fulfil the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law.

Specifically:

(a) Customer and booking records: Retained for 7 years after the last transaction for taxation and legal compliance purposes. Booking records maintained in Venue360 are retained for this period.

(b) Marketing contacts who become customers: Retained in accordance with customer record requirements above.

(c) Marketing contacts who do not become customers: Retained for a maximum of 36 months from last engagement (email open, click, form submission, or other interaction). After this period, we will either seek renewed consent or delete the information.

(d) Competition entries: Retained for 12 months after the competition concludes, unless the individual has separately consented to ongoing marketing communications.

(e) Employment applications: Retained for 12 months after the recruitment process concludes, unless the applicant consents to longer retention for future opportunities.

5.8 Notification of Disclosure

If it is necessary for us to disclose an individual's Personal Information to third parties in a manner compliant with the Australian Privacy Principles in the course of our business, we will inform the individual that we intend to do so, or have done so, as soon as practical, unless such notification is not required by law.

6. Marketing Communications and Your Choices

6.1 Consent for Marketing

We will only send marketing communications to individuals who have provided explicit consent to receive such communications. Consent may be obtained through:

(a) Ticking a consent checkbox on a form (not pre-ticked);

(b) Actively subscribing to a newsletter or mailing list;

(d) Submitting a lead form on social media where marketing use is clearly disclosed; or

(e) Scanning a QR code and completing a form where marketing consent is clearly requested.

6.2 What Marketing Communications May Include

Marketing communications from us may include:

(a) Newsletters and updates about our services and facilities;

(b) Information about special offers, packages, and promotions;

(d) Competition and giveaway announcements;

(e) Industry news and insights relevant to our services;

(f) Surveys and requests for feedback; and

(g) Information about new services or facility developments.

6.3 Brand-Specific Communications

Where an individual has indicated interest in a specific brand or service type, we will endeavour to send communications relevant to that interest. For example:

(a) Individuals interested in Camp Cooby will primarily receive information about school camps, youth programs, sporting group facilities, and related offerings.

(b) Individuals interested in Cooby Reflections will primarily receive information about weddings, corporate retreats, events, and related offerings.

However, from time to time, we may send communications about our other brand where we believe it may be relevant to the individual's interests.

6.4 Opting Out of Marketing

An individual may opt out of receiving marketing communications at any time by:

(a) Clicking the "unsubscribe" link included in every marketing email;

(b) Replying "STOP" to any SMS marketing message;

(d) Updating their preferences through any preference centre we provide.

We will process opt-out requests within 5 business days. Please note that opting out of marketing communications will not affect:

(a) Transactional communications related to bookings or services;

(b) Important notices about changes to our terms, conditions, or policies; or

6.5 Opting Out of Remarketing

An individual may opt out of seeing our remarketing advertisements by:

(a) Adjusting their Google Ad Settings at adssettings.google.com;

(b) Adjusting their Facebook Ad Preferences at facebook.com/ads/preferences;

(d) Adjusting advertising settings on their mobile device; or

(e) Using browser extensions that block tracking technologies.

6.6 Opting Out of All Collection

An individual may opt to not have us collect their Personal Information at all. This may prevent us from offering them some or all of our services and may terminate their access to some or all of the services they access with or through us.

If an individual believes that they have received information from us that they did not consent to receive, they should contact us using the details in section 12.

7. The Safety and Security of Personal Information

7.1 Privacy Officer

We have appointed a Privacy Officer to oversee the management of this Privacy Policy and compliance with the Australian Privacy Principles and the Privacy Act. This officer may have other duties within our business and may also be assisted by internal and external professionals and advisors.

7.2 Security Measures

We will take all reasonable precautions to protect an individual's Personal Information from unauthorised access, misuse, loss, modification, or disclosure. This includes:

(a) Physical security: Appropriately securing our physical facilities, including locked storage for physical records;

(b) Electronic security: Using SSL/TLS encryption for data transmission, secure password protocols, firewalls, and access controls for electronic systems;

(c) Access controls: Limiting access to Personal Information to authorised personnel who require it for their duties;

(d) Staff training: Training our staff on privacy obligations and data handling procedures;

(e) Third-party security: Requiring our service providers to maintain appropriate security measures; and

(f) Regular review: Periodically reviewing and updating our security measures.

7.3 Data Encryption

Our websites use SSL (Secure Sockets Layer) encryption to protect Personal Information during transmission. Our CRM and marketing systems (including GoHighLevel) use encryption for data storage and transfer. Payment information processed through Stripe is handled in accordance with PCI DSS (Payment Card Industry Data Security Standard) requirements.

7.4 Limitations

Despite our security measures, the security of online transactions and communications sent by electronic means or by post cannot be guaranteed. Each individual that provides information to us via the internet or by post does so at their own risk. We cannot accept responsibility for misuse or loss of, or unauthorised access to, Personal Information where the security of information is not within our control.

7.5 Third-Party Security

We are not responsible for the privacy or security practices of any third party (including third parties that we are permitted to disclose an individual's Personal Information to in accordance with this policy or any applicable laws), except to the extent that we have contractual arrangements requiring them to protect Personal Information.

The collection and use of an individual's information by third-party platforms (such as social media platforms) when interacting with our content on those platforms may be subject to separate privacy and security policies.

7.6 Reporting Security Concerns

If an individual suspects any misuse or loss of, or unauthorised access to, their Personal Information, they should let us know immediately using the contact details in section 12.

7.7 Data Breach Response

In the event of an eligible data breach (as defined in the Privacy Act), we will:

(a) Take immediate steps to contain the breach and mitigate any harm;

(b) Assess the breach to determine whether it is likely to result in serious harm to any individuals;

(c) If serious harm is likely, notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable; and

(d) Keep records of the breach and our response.

7.8 Liability

We are not liable for any loss, damage, or claim arising out of another person's use of the Personal Information where we were authorised to provide that person with the Personal Information.

8. How to Access and/or Update Information

8.1 Updating Your Information

Individuals can update their Personal Information by:

(a) Contacting us via our website at coobyreflections.com.au or campcooby.com.au;

(b) Emailing us at info@coobyreflections.com.au;

(d) Updating their preferences through any preference centre or account portal we provide.

8.2 Accessing Your Information

Subject to the Australian Privacy Principles, an individual has the right to request from us the Personal Information that we hold about them. We have an obligation to provide them with such information within 30 days of receiving their written request.

To request access to your Personal Information, please contact us using the details in section 12. We may require you to verify your identity before providing access.

8.3 Correcting Your Information

If an individual believes that the Personal Information we hold about them is inaccurate, incomplete, out-of-date, or misleading, they may request that we correct it.

We will correct any errors in the Personal Information we hold about an individual within 14 days of receiving written notice from them about those errors, unless we disagree that the information requires correction. If we disagree, we will provide written reasons and, if requested, attach a statement to the information noting the individual's view that it is inaccurate.

8.4 Refusing Access or Correction

We may refuse to provide access to, or correct, Personal Information in certain circumstances permitted by the Privacy Act, including where:

(a) Providing access would pose a serious threat to the life, health, or safety of any individual;

(b) Providing access would have an unreasonable impact on the privacy of other individuals;

(d) The information relates to existing or anticipated legal proceedings;

(e) Providing access would prejudice negotiations with the individual;

(f) Providing access would be unlawful; or

(g) Denying access is required or authorised by law.

If we refuse a request, we will provide written reasons for the refusal.

8.5 Accuracy of Information Provided

It is an individual's responsibility to provide us with accurate and truthful Personal Information. We cannot be liable for any information that is provided to us that is incorrect.

8.6 Fees

We may charge a reasonable fee for our costs incurred in meeting requests to access Personal Information we hold. We will inform the individual of any applicable fee before processing their request.

9. Complaints and Disputes

9.1 Making a Complaint

If an individual has a complaint about our handling of their Personal Information, they should address their complaint in writing to the Privacy Officer using the contact details in section 12.

Please include:

(a) Your name and contact details;

(b) A clear description of your complaint;

(d) The outcome you are seeking.

9.2 Our Response

We will:

(a) Acknowledge receipt of your complaint within 5 business days;

(b) Investigate your complaint and keep you informed of progress;

(d) Provide reasons for our decision and any actions we will take.

9.3 Resolution

If we have a dispute regarding an individual's Personal Information, we will first attempt to resolve the issue directly with the individual.

9.4 External Complaints

If an individual is not satisfied with our response to their complaint, they may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

Office of the Australian Information Commissioner GPO Box 5218 Sydney NSW 2001

Phone: 1300 363 992 Email: enquiries@oaic.gov.au Website: www.oaic.gov.au

9.5 Data Breach Notification

If we become aware of any unauthorised access to an individual's Personal Information, we will inform them at the earliest practical opportunity once we have established what was accessed and how it was accessed, in accordance with our obligations under the Privacy Act.

10. Contacting Individuals

10.1 Important Notices

From time to time, we may send an individual important notices, such as:

(a) Changes to our terms, conditions, and policies;

(b) Changes to our services that affect existing bookings;

(d) Information required by law.

Because this information is important to the individual's interaction with us, they may not opt out of receiving these communications.

10.2 Booking and Service Communications

Individuals who have made bookings or are receiving services from us will receive transactional communications related to those bookings or services. These are not marketing communications and cannot be opted out of while the booking or service relationship is active.

11. Cookies Policy

11.1 What Are Cookies?

Cookies are small text files that are placed on your device when you visit our websites. They help us provide you with a better experience by remembering your preferences and understanding how you use our websites.

11.2 Types of Cookies We Use

Cookie Type	Purpose	Duration
Essential Cookies	Required for website functionality, security, and basic features	Session or persistent
Analytics Cookies	Help us understand how visitors use our websites (e.g., Google Analytics)	Up to 2 years
Marketing Cookies	Used to deliver relevant advertisements and measure campaign effectiveness (e.g., Meta Pixel, Google Ads)	Up to 2 years
Preference Cookies	Remember your preferences and settings	Up to 1 year

11.3 Managing Cookies

You can manage cookies through your browser settings. Most browsers allow you to:

(a) See what cookies are stored and delete them individually;

(b) Block third-party cookies;

(d) Delete all cookies when you close your browser.

Please note that blocking or deleting cookies may affect the functionality of our websites.

11.4 Third-Party Cookies

Some cookies on our websites are placed by third parties, including:

(a) Google (Analytics and Advertising)

(b) Meta (Facebook/Instagram Pixel)

These third parties have their own privacy policies governing the use of cookies.

12. Contacting Us

If you have any questions about this Privacy Policy, wish to make a complaint, or want to exercise any of your rights regarding your Personal Information, please contact us:

The Privacy Officer Cooby Reflections Pty Ltd Trading as Camp Cooby and Cooby Reflections

Email: info@coobyreflections.com.au

Phone: 07 4696 6244

Postal Address: 121 West Street Newtown Toowoomba QLD 4350 Australia

We recommend contacting the Privacy Officer by email in the first instance for the fastest response.

13. Changes to This Policy

13.1 Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, services, legal requirements, or for other operational, legal, or regulatory reasons.

13.2 Notification of Changes

When we make changes to this Privacy Policy:

(a) We will update the "Last Updated" date at the top of this policy;

(b) We will post the updated policy on ourwebsites at coobyreflections.com.au/privacy and campcooby.com.au/privacy;

(c) For material changes that significantly affect how we handle Personal Information, we will take reasonable steps to notify affected individuals, which may include email notification or prominent notices on our websites.

13.3 Review

We encourage individuals to periodically review this Privacy Policy to stay informed about how we are protecting Personal Information.

13.4 Continued Use

Continued use of our services or websites after changes to this Privacy Policy constitutes acceptance of those changes, except where explicit consent is required by law.

13.5 Additional Compliance

We may do things in addition to what is stated in this Privacy Policy to comply with the Australian Privacy Principles, and nothing in this Privacy Policy shall deem us to have not complied with the Australian Privacy Principles.

14. Definitions

In this Privacy Policy:

Australian Privacy Principles (APPs) means the privacy principles set out in Schedule 1 of the Privacy Act.

Camp Cooby means the brand operated by Cooby Reflections Pty Ltd providing school camps, youth camps, sporting group facilities, and related services.

Cookies means small text files placed on a device when visiting a website.

Cooby Reflections means the brand operated by Cooby Reflections Pty Ltd providing wedding venues, corporate retreat facilities, event spaces, and related services.

CRM means Customer Relationship Management system.

Personal Information has the meaning given in the Privacy Act, being information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether recorded in a material form or not.

Privacy Act means the Privacy Act 1988 (Cth).

Privacy Officer means the person appointed by us to oversee privacy compliance.

Sensitive Information has the meaning given in the Privacy Act, and includes information about an individual's racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record, and health information.

Spam Act means the Spam Act 2003 (Cth).

We, us, our means Cooby Reflections Pty Ltd (ABN 39 610 886 194).

15. Competition and Promotion Terms

15.1 Privacy Notice for Competitions

When we conduct competitions, giveaways, or promotions, the following additional privacy terms apply:

(a) Entry information will be used to administer the competition and contact winners;

(b) Winner names and general location (e.g., suburb/city) may be published in accordance with competition terms;

(d) Competition entries will be retained for 12 months after the competition concludes;

(e) Specific competition terms and conditions will be provided at the time of entry and will prevail over this general policy to the extent of any inconsistency.

15.2 Social Media Competitions

For competitions conducted on social media platforms:

(a) Entries may be collected through the platform's native features or through links to our landing pages;

(b) Information collected is subject to both this Privacy Policy and the platform's privacy policy;

16. Specific Collection Notices

16.1 QR Code Data Collection

When you scan a QR code at our venues or on our marketing materials:

(a) You will be directed to a landing page or form;

(b) The landing page will clearly state what information is being collected and why;

(d) You can close the page without submitting information if you do not wish to provide your details.

16.2 Social Media Lead Form Collection

When you submit your details through a lead advertisement on social media:

(a) The form will display a link to this Privacy Policy;

(b) Your information will be transferred to our CRM (GoHighLevel) for follow-up;

(d) You may opt out of marketing at any time using the methods described in section 6.4.

16.3 Event Registration Collection

When you register for an event we host or participate in:

(a) Your information will be used to manage your registration and attendance;

(b) Marketing consent will be separately requested and is optional;

(c) Where we are participating in a third-party event, your information may be shared with event organisers in accordance with their privacy policy.

16.4 Booking System Records

When you make a booking with us:

(a) Your booking information is stored in our booking management system (Venue360) for the purpose of managing your booking and delivering our services;

(b) This information is retained for business record-keeping, taxation, and legal compliance purposes;

(d) You may request access to or correction of your booking records by contacting us using the details in section 12.

Schedule A: Third-Party Service Providers

The following table provides details of the third-party service providers we use that may have access to Personal Information:

Provider	Service	Data Processed	Location	Privacy Policy
GoHighLevel (HighLevel Inc.)	CRM, marketing automation, landing pages, forms, SMS, email	Contact details, marketing preferences, engagement data, booking enquiries	USA	highlevel.com/privacy-policy
Google LLC	Gmail, Google Analytics, Google Ads	Email communications, website analytics, advertising data	USA	policies.google.com/privacy
Meta Platforms, Inc.	Facebook, Instagram advertising and lead generation	Advertising audiences, lead form submissions, pixel data	USA	facebook.com/privacy/policy
The Rocket Science Group LLC (Mailchimp)	Email marketing	Email addresses, engagement data	USA	mailchimp.com/legal/privacy
Stripe, Inc.	Payment processing	Payment details, transaction records, billing information	USA	stripe.com/au/privacy
Amazon Web Services, Inc.	Website hosting	Website data, visitor information	Australia / USA	aws.amazon.com/privacy
Venue360	Booking management system	Customer booking records, contact details, service delivery information	Australia	venue360.com.au/privacy (or applicable URL)

Note: This schedule will be updated as service providers change.

End of Privacy Policy