Privacy Policy

1. Who we are

This policy applies to Wanderlust Travel and Adventure Pty Ltd (ACN 636 612 523, ABN 34 636 612 523), trading as Wanderlust Travel & Adventure ("we", "us", "our"). Our registered office is [REGISTERED OFFICE ADDRESS]. You can contact us at hello@wanderlusttravel.com.au.

We are an Australian travel agency. This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs).

2. What we collect

We only collect information that's necessary to help you plan or book a trip. That includes:

• Identity & contact: name, email, phone, country of residence, date of birth (when required by operators or visa rules).
• Trip details: travel dates, destinations, group size, dietary requirements, accessibility needs, passport details (only when required for a specific booking).
• Payment information: card details are entered directly into our payment processor (Square) — we never see or store full card numbers. We retain only the transaction ID, last 4 digits, and amount, for reconciliation.
• Account & usage: any messages you send us via chat, the contact form, or the AI itinerary planner; your wishlist of saved trips; your newsletter subscription status.
• Technical: IP address, browser type, device, pages visited, referrer — collected via standard server logs and cookies (see §7).

If you choose not to provide information we ask for, we may not be able to complete your booking.

3. Why we collect it (purpose)

We use your information to:

• Confirm bookings with our tour operator partners and share the details required to fulfil the trip (your name, dates, dietary/accessibility needs).
• Process payments via Square and reconcile funds with operators.
• Respond to questions you send by chat, email, contact form, or AI assistant.
• Send transactional emails (booking confirmation, itinerary, pre-departure info, follow-up after trip).
• Send marketing emails — only if you've opted in. You can unsubscribe at any time via the link in every email.
• Improve the site (anonymous usage analytics, error monitoring).
• Meet our legal obligations (tax records, anti-money-laundering checks where applicable, responding to lawful requests).

4. Who we share it with

We share personal information only with the parties below, and only what's necessary for the purpose:

• Tour operators & suppliers: the operator running your trip receives your name, dates, group details, dietary/accessibility needs. They handle this information under their own privacy policies.
• Square (Block, Inc., USA): processes card payments. Card data goes directly to Square; we receive only the transaction outcome. See Square's privacy notice.
• Anthropic (USA): powers our AI chat widget, itinerary planner and customer-concierge auto-reply. Anything you type into those tools is sent to Anthropic's API for processing. Anthropic does not use API inputs for model training. See Anthropic's privacy policy.
• Brevo (France): sends our transactional and marketing emails. See Brevo's privacy policy.
• Netlify (USA): hosts the website and runs our backend functions. See Netlify's privacy policy.
• Formspree (USA): forwards contact-form submissions to our email.
• Affiliate partners: if you click an affiliate link to a partner (Jucy, Britz, Hostelworld, Booking.com, Skyscanner, etc.), they may set their own cookies and collect their own information. We never share your personal info directly with them.
• Government & legal: where required by law (e.g. tax authorities, lawful court orders).

We do not sell your personal information to anyone, and we don't share it for third-party marketing.

5. Overseas data transfers

Some of our processors (Square, Anthropic, Netlify, Formspree) are based in the United States; Brevo is in France. By using our site you consent to your information being transferred to and processed in those countries. We take reasonable steps to ensure each processor protects your information to a standard comparable to the APPs (typically via contractual data-processing agreements).

6. How long we keep it

• Booking records: 7 years after the trip completes (Australian tax record-keeping requirements).
• Chat & itinerary-planner transcripts: 90 days, then deleted unless tied to an active booking.
• Newsletter subscribers: until you unsubscribe.
• Wishlist data: 12 months from your last visit, then deleted.
• Server logs & analytics: 12 months.

7. Cookies & tracking

We use a small number of cookies to make the site work (remember currency preference, wishlist contents, that you've passed the access gate). We don't use third-party advertising cookies. We do use privacy-respecting analytics to count page views and detect errors. You can disable cookies in your browser, but the site may not work properly without them.

8. Your rights

Under the APPs you have the right to:

• Access the personal information we hold about you.
• Correct it if it's wrong.
• Unsubscribe from marketing (one click in any email).
• Make a complaint about how we've handled your information (see §10).
• Request deletion — we'll comply unless we're legally required to keep it (e.g. tax records).

Email hello@wanderlusttravel.com.au and we'll respond within 30 days.

9. Security

We use HTTPS everywhere, encrypted storage for any sensitive data, and access controls so only the people who need to see your information can. No system is 100% secure — if a data breach occurs that's likely to cause you serious harm, we'll notify you and the Office of the Australian Information Commissioner (OAIC), as required by the Notifiable Data Breaches scheme.

10. Complaints

Not happy with how we've handled your information? Email hello@wanderlusttravel.com.au first — we'll investigate and reply within 30 days.

Not satisfied with our response? You can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or 1300 363 992.

11. Children

Our service is intended for travellers aged 18 and over. We don't knowingly collect personal information from children under 16. If you're a parent or guardian and believe we have, email us and we'll delete it.

12. Changes to this policy

We may update this policy as our business evolves. Material changes will be highlighted on the site for at least 30 days before they take effect. The "Last updated" date at the top reflects the current version.

13. Contact