Privacy Policy

1.1 This Privacy Policy explains how Everything Kids handles personal information across the Everything Kids website, platform, parent experience, provider experience, booking flow, membership flow, reward program and support channels.

1.2 This Privacy Policy is issued by Everything Kids Australia Pty Ltd, ABN 35 167 762 727 and ACN 167 762 727 (Everything Kids, EK, we, us, our), which acts as the Australian payment collection, GST/compliance and local administration entity for the Everything Kids platform. EK is the APP entity responsible for personal information handled under this Privacy Policy.

1.3 The Everything Kids platform is currently owned or operated by TechQuarters AI FZCO (Registration No. 81876, Dubai Silicon Oasis, Dubai, UAE). If a future Everything Kids group owner/operator replaces that entity, EK will update the relevant terms and notices before relying on the change. TechQuarters personnel provide platform development, engineering, operations, support, marketing, data hosting and management services for the platform. Personal information may be accessed or processed by TechQuarters and its authorised personnel and service providers outside Australia, as described in Section 7 (Overseas disclosure). EK remains accountable for the handling of personal information by TechQuarters and its subcontractors as required by the Australian Privacy Principles.

1.4 This policy applies to parents, caregivers, children where relevant, activity providers, provider staff, reward partners, website visitors, applicants, support contacts and other users of the platform.

1.5 EK will update this Privacy Policy if its company structure or data handling practices materially change.

2.1 From parents and caregivers, we may collect names, email addresses, phone numbers, account details, suburb/location, booking history, membership status, billing records, marketing preferences, support messages, reviews, complaints and communications with providers or EK.

2.2 From or about children, we collect limited booking-related information provided by a parent or caregiver. This may include first name, age or date of birth, activity suitability details, attendance needs and any health, medical, accessibility, allergy, behavioural or support information the parent chooses to provide so the activity can be delivered safely and appropriately.

2.2A Health, medical, allergy, behavioural and accessibility information about children is sensitive information within the meaning of the Privacy Act. EK will only collect this sensitive information with the parent’s or caregiver’s express, informed opt-in consent, obtained at the point of collection (for example, during the booking or enquiry form). The consent will: (a) be separate from general terms and conditions acceptance; (b) clearly identify the types of sensitive information being collected; (c) explain the purpose (activity safety, suitability, safe delivery); (d) state that consent is voluntary and that the parent may decline to provide sensitive information, though doing so may limit the provider’s ability to safely accommodate the child; and (e) explain how to withdraw consent and request deletion. Parents and caregivers may provide booking information without including sensitive health information, but should be aware that providers may need relevant safety information to deliver the activity safely.

2.3 From activity providers, provider staff and business contacts, we may collect business name, ABN, ACN, GST registration status, business address, venue details, contact names, email addresses, phone numbers, staff contacts, insurance, licences, Working with Children Check details, listing content, photos, schedules, pricing, booking records, payout records, complaints, support records and compliance declarations.

2.4 From reward partners, we may collect business details, contact details, offer terms, offer codes, redemption reports, brand assets, marketing approvals, campaign performance information, support records and compliance information.

2.5 From payments and payment partners, including Stripe, we may receive payment status, transaction amounts, dates, refund/chargeback records, payout status, identity verification status, last four card digits and related billing metadata. EK does not collect or store full card numbers.

2.6 From use of the platform, we may collect device information, IP address, browser type, pages viewed, search activity, clicks, booking/enquiry activity, analytics data, cookie data, fraud and security signals, error logs and attribution data.

2.7 We may also receive information from public registers, government databases, provider websites, listing sources, analytics tools, advertising tools, support tools, professional advisers and users who contact us.

3.1 We use personal information to operate the platform, create accounts, process enquiries, bookings, payments, refunds and payouts, manage parent memberships, support child safety and activity suitability, verify providers, display listings, connect parents with providers, provide support, investigate disputes and manage reward offers.

3.2 We use personal information to send service messages such as booking confirmations, reminders, payment notices, membership notices, provider onboarding messages, policy updates, support replies and safety or compliance notices.

3.3 We use personal information to improve search, recommendations, reporting, listing quality, campaign performance, user experience, fraud detection, security, product features and platform reliability.

3.4 We use personal information to send marketing where permitted by law or with consent. Users can unsubscribe from marketing. We do not send marketing communications to children.

3.5 We use personal information to comply with legal, tax, accounting, regulatory, child safety, consumer law, payment, dispute, fraud prevention and record-keeping obligations.

4.1 EK is designed for parents and caregivers to find, compare, enquire about and book children activities. Children do not create EK accounts.

4.2 Parents or caregivers must have authority to provide child-related information and must only provide information that is reasonably needed for the booking, enquiry, safety or activity delivery purpose.

4.3 EK aims to collect the minimum child-related information needed to support safe and suitable activity delivery. We do not ask for children email addresses, phone numbers, social media profiles or direct marketing preferences.

4.4 Child-related information is shared only where needed, including with the relevant provider for enquiry, booking, attendance, suitability, safety, incident handling or lawful operational purposes.

4.5 Providers must use child-related information only for the relevant booking, activity delivery, safety, support or lawful operational purpose. Providers must not use child-related information for their own marketing unless they have a separate lawful basis and consent where required.

4.6 EK does not use child-related information for behavioural advertising or marketing to children. Any recommendation or suitability use must be directed at the parent/caregiver account and must be limited to platform service, safety, quality or suitability purposes.

4.7 Parents can request access to, correction of or deletion of child-related information, subject to legal retention, dispute, safety, tax, accounting and fraud-prevention requirements.

4.8 EK will review and update its child-related privacy practices as Australian children’s privacy requirements change.

5.1 EK may use rules, scores, models or automated tools to support search ranking, recommendations, provider quality checks, provider fit, parent appeal, lead scoring, trust and safety, fraud prevention, reward product screening, campaign eligibility, badges, listing placement and operational prioritisation.

5.2 These tools may affect how providers, listings, offers or activities are displayed, prioritised, recommended, reviewed, flagged or included in campaigns.

5.3 EK will not make high-impact or final adverse decisions solely by automation where human review is reasonably required. Providers or users can contact EK support if they believe ranking, moderation, campaign eligibility, account status or listing decisions are wrong or unfair.

5.4 EK does not use personal information to train artificial intelligence (AI) or machine learning (ML) models. Personal information is not used as training data for any AI/ML system. Where automated tools or models are used (as described in section 5.1), they operate on live platform data for operational purposes and do not extract or store personal information for model training.

6.1 We may share personal information with activity providers, parents/caregivers, reward partners, Stripe and payment processors, hosting providers, software providers, email and messaging tools, analytics and advertising tools, support tools, security and fraud tools, professional advisers, insurers, regulators, law enforcement, affiliates, group companies and business successors.

6.2 Activity providers receive only the information reasonably needed for enquiries, bookings, attendance, suitability, safety, activity delivery, support, refunds, disputes and lawful operational purposes.

6.3 Reward partners should receive only limited information needed to administer a reward offer, verify eligibility or redemption, support a user, prevent misuse or comply with law. EK should not share child health/accessibility information with reward partners unless absolutely required, disclosed and approved.

6.4 We do not sell personal information. We do not share personal information with third parties for their own marketing unless the user has consented or the law otherwise permits it.

6.5 If EK is involved in a restructure, sale, merger, acquisition, financing, transfer or business continuity arrangement, personal information may be transferred as part of that process where lawful.

7.1 The platform is operated, developed and supported by teams located outside Australia. Personal information will be accessed or processed by our platform development, operations, support, finance and management teams located in the United Arab Emirates, Lebanon, Sri Lanka and the Philippines. Personal information is stored on cloud infrastructure (AWS) and accessed by authorised personnel through the platform administration system. Access is restricted to authorised personnel based on role and function.

7.2 Overseas locations include the United Arab Emirates, where the platform operating and service company for Everything Kids (TechQuarters AI FZCO, Dubai Silicon Oasis) is located, plus countries where EK uses hosting, software, payment, analytics, communications, support, finance, legal, development or operational service providers.

7.3 EK discloses personal information to overseas recipients as described in this section. Where EK discloses personal information to an overseas recipient, EK: (a) will take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles (APP 8.1); (b) remains accountable for the acts and practices of the overseas recipient (APP 8.1); (c) requires the recipient to handle personal information only for the permitted purposes described in this Privacy Policy; and (d) will take reasonable steps to cease disclosure or remediate if the recipient breaches these requirements.

7.3A For sensitive information (including children’s health, medical, allergy, behavioural and accessibility information), EK will obtain separate, express consent for overseas disclosure at the time of collection, in addition to any general consent under section 7.3. This layered consent approach ensures that parents and caregivers are informed about the specific countries and entities that may access sensitive information and can make an informed decision.

7.3B General consent to overseas disclosure of non-sensitive personal information is provided by the user’s continued use of the platform after being informed of the overseas disclosure practices in this section. Users may contact privacy@everythingkids.com.au for further information about overseas recipients before providing information.

7.4 EK takes reasonable steps to ensure that overseas recipients handle personal information in accordance with the Australian Privacy Principles, including by using contracts, access controls, security restrictions and accountability measures with affiliates, group companies and service providers. EK remains accountable for the acts and practices of overseas recipients where required by APP 8.1.

7.5 Overseas recipients must only use personal information for the permitted platform, payment, support, safety, compliance, legal, tax, accounting, development, security or business purpose for which it is shared.

7.6 EK will update this Privacy Policy if its overseas recipient locations or service-provider arrangements materially change.

8.1 Stripe processes card payments, payment methods, identity verification, refunds, chargebacks and provider payouts. Stripe may collect information directly from parents, providers or EK.

8.2 EK does not store full card numbers. EK may receive transaction records, payment status, last four card digits, refund status, chargeback status, Stripe account status, KYC/verification status and payout status.

8.3 Stripe handles payment information under its own terms and privacy policy. EK manages Stripe Connect, KYC, delayed payout, refund and chargeback information in accordance with its payment provider arrangements and applicable law.

9.1 EK may use cookies, pixels, analytics tools and similar technologies for login, security, checkout, fraud prevention, preferences, performance, diagnostics, analytics, campaign measurement and retargeting where lawful.

9.2 More detail is provided in the Cookie and Tracking Notice when analytics, pixels, retargeting or advertising tracking are active.

9.3 Users can control some cookies through browser settings and any preference tools EK makes available. Blocking some cookies may affect login, checkout, security or platform functionality.

10.1 EK takes reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.

10.2 Security measures may include encryption in transit, access controls, authentication, secure hosting, monitoring, security reviews, staff training and incident response procedures.

10.3 No system is completely secure. If EK becomes aware of an eligible data breach that is likely to result in serious harm, EK will notify affected individuals and the Office of the Australian Information Commissioner where required by the Notifiable Data Breaches scheme.

11.1 EK keeps personal information as long as needed for platform operation, bookings, customer support, provider management, payment records, tax/accounting, disputes, refunds, chargebacks, safety, fraud prevention, legal compliance and legitimate business purposes.

11.2 When information is no longer needed, EK will take reasonable steps to destroy or de-identify it.

11.3 Retention periods:

Category	Retention period	Basis
Account information (parents, providers, reward partners)	Account life + 2 years post-closure	Customer service, dispute resolution
Booking, payment, refund, payout, tax records	7 years from end of financial year	ATO tax record-keeping requirements
Working with Children Check records	Duration of provider relationship + 2 years	Child safety, risk management
Marketing consent records	Duration of consent + 2 years	Spam Act evidence of consent
Support, complaint and dispute records	3 years from resolution (7 years if involving child safety incident)	Legal risk, safety, regulatory
Sensitive health/medical information (children)	Deleted upon activity completion or provider no longer needs it, maximum 12 months unless legally required	Data minimisation, APP 11
Analytics event data	Aggregated or de-identified within 90 days; cookie identifiers persist in accordance with the Cookie and Tracking Notice	Privacy best practice
CCTV or venue imagery	Not collected by EK	N/A

Retention periods may change where required by law, operational needs or updated EK policies.

12.1 Users may request access to or correction of personal information EK holds about them.

12.2 Users may request deletion of personal information, subject to legal, tax, accounting, fraud prevention, safety, dispute and platform integrity requirements.

12.3 EK aims to respond to privacy access and correction requests within 30 days. If EK refuses a request, EK will provide reasons where required and explain how to complain.

13.1 Privacy complaints can be sent to privacy@everythingkids.com.au.

13.2 EK will acknowledge privacy complaints promptly and investigate in a reasonable timeframe.

13.3 If unresolved, users may contact the Office of the Australian Information Commissioner.

14.1 EK may update this policy from time to time.

14.2 EK will communicate significant changes to affected registered users where reasonable, and will keep records of the document version accepted by users where acceptance is required.

Everything Kids Australia Pty Ltd ABN: 35 167 762 727 ACN: 167 762 727 Privacy contact: privacy@everythingkids.com.au Support contact: support@everythingkids.com.au

Data Breach Response Plan: EK maintains and periodically reviews an internal data breach response plan consistent with the Notifiable Data Breaches scheme.