Privacy Policy

From time to time, we may revise or update this Privacy Policy or our information handling practices. If we do so, the revised Privacy Policy will be published on the Platform.

We may collect personal information in order to conduct our business, to provide and market our services and to meet our legal obligations. By using the Platform or our services, or by providing any personal information to us, you consent to the collection, use and disclosure of your personal information as set out in this Privacy Policy.

The types of personal information we collect and hold

The types of personal information we may collect, and hold includes (but is not limited to) personal information about:

• your name, address, contact telephone number and other contact details such as your email address;
• payment information (such as credit card or bank details);
• other personal information required to provide our services in specific cases; and
• details of your use of our products or services.

You are not obliged to provide personal information to us. However, in many cases, if you do not provide personal information to us, we may not be able to supply the relevant functionality of the Platform.

In some circumstances, you may provide to us, and we may collect from you, personal information about a third party. Where you provide the personal information of a third party, you must ensure that the third party is aware of this Privacy Policy, understands it and agrees to accept it. If you are providing us with personal or sensitive information on behalf of a person who is under the age of 18 that you are the parent or guardian of, you understand that you are consenting to this Privacy Policy on their behalf as their legal guardian.

If it is necessary to provide specific services to you, we may collect sensitive information about you. However, we will only collect sensitive information from you if you agree to provide it to us, you authorise us to obtain it from a third party or where the collection of the information is required or authorised by or under an Australian law or a Court/Tribunal order or otherwise where the collection is not prohibited under Australian law.

How personal information is collected and held by us

We collect personal information in the following ways:

• when you fill in and return to us a signed client form;
• when you submit personal information through the Platform (such as when you send us a message or fill out an online form);
• in person, for example, when you engage with our employees, agents, or customer service representatives; and
• in the course of providing services to you.

We store personal information in computer storage facilities and paper-based files. We take steps to protect your personal information against loss, unauthorised access, use modification or disclosure. Some examples of the steps we take to protect your personal information include:

• ensuring there are suitable password protection measures and access privileges in place to monitor and control access to our IT systems;
• imposing restrictions on physical access to paper files;
• requiring any third parties engaged by us to provide appropriate assurances to handle your personal information in a manner consistent with Australian law; and
• taking reasonable steps to destroy or de-identify personal information after we no longer need it for our business or to comply with the law.

Collection of personal information through activity

Information that may identify you as a user may be gathered during your access with the Platform.

The Platform may include pages that use 'cookies'. A cookie is a unique identification number that allows the server to identify and interact more effectively with your computer or device. The cookie assists us in identifying what our users find interesting on the Platform.

A cookie may be allocated each time you use the Platform. The cookie does not identify you as an individual in our data collection process, however it does identify your Internet Service Provider.

You can configure your access to the Platform to refuse cookies. If you do so, you may not be able to use all or part of the Platform.

Further details on our use of cookies are available within our Cookies Policy and can be found at https://dazhboards.com/cookies-policy.

Contacting customers for additional information

From time to time, we may contact your customers or clients to request additional information that is necessary for the proper use and functionality of the Platform. This may include, but is not limited to, requests for details such as the country of origin, contact information, or any other necessary data. We handle any personal information collected from your customers or clients in accordance with this Privacy Policy. You are responsible for ensuring that your customers or clients are aware of this Privacy Policy and have consented to the collection, use, and disclosure of their personal information as described herein.

Collection and use of customer data from booking systems

We may extract customer data from your booking system to facilitate the provision of our services. This data extraction is performed in accordance with our Privacy Policy and applicable data protection laws. If you set up any emails or other forms of communication to be sent to your customers through our platform, you must ensure that all such communications comply with our Privacy Policy and any applicable data protection laws. This includes, but is not limited to, obtaining any necessary consents from your customers for the processing and use of their personal data.

SMS and Messaging Data

When you use Dazhboards as a tour or activity operator, traveller mobile phone numbers and SMS opt-in records flow through our platform so we can deliver booking-related messages on your behalf. This section explains how we handle that data.

What we collect

• Traveller mobile phone numbers, sourced from your booking system (Rezdy, FareHarbor, or your own checkout) at the time of booking
• The exact consent text shown to the traveller, the timestamp of consent, and the IP address from which consent was given
• Message content, delivery status, and any inbound replies from the traveller
• Records of opt-out requests (STOP, UNSUBSCRIBE) and help requests (HELP)

How we use it

We use SMS data only to deliver and operate the messaging service: sending booking confirmations, pre-tour reminders, reschedule and cancellation notices, customer-support replies, and post-tour review requests on behalf of the operator the traveller has booked with. Aggregate, de-identified message metadata may be used to monitor and improve service performance (delivery rates, response times, error rates).

Sharing and third parties

We share traveller phone numbers and SMS data only with the carrier-grade messaging providers required to deliver messages — currently Twilio Inc., acting as a sub-processor under our Data Processing Agreement. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing to sub-processors is permitted only for the purpose of operating the messaging service. All other categories of data sharing exclude mobile opt-in data and consent.

Retention

SMS records are retained for the duration of the operator's subscription plus 24 months for compliance and audit purposes, after which they are deleted or de-identified. Travellers may request earlier deletion at any time via the operator they booked with, or by contacting us at privacy@dazhboards.com.

Your rights

You can opt out of SMS at any time by replying STOP to any message. You can request access to or deletion of your SMS data by contacting the operator you booked with, or by emailing privacy@dazhboards.com. Where applicable under GDPR, the Australian Privacy Act, or other regional law, you also have the right to lodge a complaint with the relevant data protection authority.

Analytics and Anonymisation

We may use Google Analytics, a web analytics service provided by Google, Inc. (Google). Google Analytics uses cookies (see above), to help us analyse how users use the Platform. Although Google Analytics records data such as your geographical location, device, internet browser and operating system, none of this information personally identifies you with us.

The information generated by the cookie about your use of the Platform will be transmitted to and stored by Google on servers in your country of residence. Google will use the information on behalf of us for the purpose of evaluating your use of the Platform, compiling reports on activity for us and providing us with other services relating to activity and internet usage. The IP address that your browser conveys within the scope of Google Analytics will not be associated with any other data held by Google. You may refuse the use of these cookies. You can also opt out of being tracked by Google Analytics in the future by downloading and installing Google Analytics Opt-out Browser Add-on for your current web browser: http://tools.google.com/dlpage/gaoptout?hl+en

We partner with Microsoft Clarity and Microsoft Advertising to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization, fraud/security purposes, and advertising. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

The purposes for which we collect, hold, use and disclose personal information

We collect, hold, use and disclose personal information for a variety of business purposes including:

• to provide the products or services you have requested from us;
• to improve our business, products and services;
• to promote our business to you;
• to market our other services or products to you;
• to handle and respond to your enquiries, complaints or concerns; and
• to provide personal information to third parties as set out in this Privacy Policy.

Affiliate network and data disclosure

We maintain an affiliate network which includes the collection and use of personal information about our affiliates (Affiliate Network). This information may include, but is not limited to, names, contact details, and other information as required.

As part of our business operations, we may provide the personal information of affiliates to our customers. This disclosure is conducted in accordance with this Privacy Policy and applicable data protection laws.

To the extent that you participate in the Affiliate Network, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy. If you do not wish for your information to be shared with tour operators, you may opt out by contacting us at support@dazhboards.com.

This clause does not apply to Google user data. Google user data obtained through Google Workspace or Google Photos APIs is never disclosed to marketing, affiliate, advertising or data broker recipients, is never combined with data from other sources for marketing purposes, and is never used for direct marketing. See section Use of Google Workspace APIs and Google user data.

Direct marketing

We also collect, hold, use and disclose your personal information to:

• notify you about the details of new services and products offered by us;
• send you our newsletters and other marketing publications;
• administer our databases for client service, marketing and financial accounting purposes; and
• to comply with our legal requirements regarding the collection and retention of information concerning the products and services that we provide.

If you do not wish to disclose your personal information for the purpose of direct marketing or you would like to opt-out of receiving direct marketing communications, you can do so by contacting us using the contact details set out below, or by following the instructions to unsubscribe which are contained in a communication that you receive from us.

This clause does not apply to Google user data. Google user data obtained through Google Workspace or Google Photos APIs is never disclosed to marketing, affiliate, advertising or data broker recipients, is never combined with data from other sources for marketing purposes, and is never used for direct marketing. See section Use of Google Workspace APIs and Google user data.

Third Party Service Providers

We may disclose your personal information to third parties who work with us in our business to promote, market or improve the services that we provide, including:

• providers of customer relations management database services and marketing database services;
• marketing consultants, promotion companies and website hosts;
• partnered businesses; and
• consultants and professional advisers.

We may also combine your personal information with information available from other sources, including the entities mentioned above, to help us provide better services to you.

Where we do share information with third parties, we require that there are contracts in place that only allow use and disclosure of personal information to provide the service and that protect your personal information in accordance with Australian law. Otherwise, we will disclose personal information to others if you've given us permission, or if the disclosure relates to the main purpose for which we collected the information, and you would reasonably expect us to do so.

This clause does not apply to Google user data. Google user data obtained through Google Workspace or Google Photos APIs is never disclosed to marketing, affiliate, advertising or data broker recipients, is never combined with data from other sources for marketing purposes, and is never used for direct marketing. See section Use of Google Workspace APIs and Google user data.

Use of Google Workspace APIs and Google user data

Dazhboards' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we affirm that:

• We do not use, transfer or sell Google Workspace or Google Photos user data, whether raw, aggregated, anonymised or derived, to develop, improve or train any generalised or foundational artificial intelligence or machine learning model.
• We do not transfer Google user data to any third party artificial intelligence or machine learning service that uses that data to train or improve its models.
• We do not transfer or sell Google user data to advertising platforms, data brokers or information resellers, and we do not use it for serving advertisements, including retargeting, personalised or interest-based advertising.
• Google user data is used solely to provide and improve the user-facing features of the Dazhboards platform that are visible and prominent in our user interface, and only for the purposes disclosed at the time of consent.
• Humans do not read Google user data except where you have given us explicit consent for a specific action such as support, where the data has been aggregated and anonymised for internal operations, for security purposes such as investigating abuse, or to comply with applicable law.

Use of third-party artificial intelligence services

Certain features of the Dazhboards platform use generative artificial intelligence to produce summaries, insights, recommendations, reports, drafted messages and website copy. To deliver these features we send the minimum content necessary to the third-party AI providers listed below. Each provider is engaged under commercial or enterprise API terms which contractually prohibit the use of our submitted content to train or improve their models.

In relation to these providers we confirm that:

• We use only paid commercial or enterprise application programming interfaces. We do not use free, trial or consumer versions of any of these services to process customer or Google user data, as consumer versions may permit provider model training.
• We do not permit any of these providers to use our content, or content derived from it, to develop, train, fine-tune or improve any generalised or foundational artificial intelligence or machine learning model.
• Content submitted to these providers is retained by them only for the limited period necessary for service delivery, security and abuse monitoring in accordance with their published terms, and is then deleted. Perplexity retains no content submitted through its Chat Completions API.
• We do not use these providers to make decisions that produce legal or similarly significant effects about an individual without human review.
• We maintain an internal register of artificial intelligence subprocessors and review it at least annually. Where we add a provider that would process personal information, we will update this policy before that provider is enabled.

Google user data. Data obtained through Google Workspace, Google Photos or Google Analytics APIs is never used to develop, improve or train any generalised or foundational artificial intelligence or machine learning model, whether in raw, aggregated, anonymised or derived form, and is never transferred to any third-party artificial intelligence service that would use it for such purposes. Google user data is not sent to Perplexity AI at any time; Perplexity is used solely for research against publicly available web sources. Our use and transfer of information received from Google APIs to any other application adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Data Retention and Deletion Policy

We affirm that Google user data obtained through Google Analytics is not used to develop, improve, or train generalised artificial intelligence or machine learning models. The data accessed or processed via Google Analytics is solely used to provide and enhance the functionality of our services on the Platform, specifically to offer insights and recommendations for business performance improvements.

We retain Google user data only for as long as necessary to fulfil the purposes for which it was collected or to comply with legal obligations. Users may request the deletion of their data at any time by contacting us at privacy@dazhboards.com. Upon receiving a valid request, we will delete the requested data from our systems in accordance with applicable privacy laws and Google's data deletion guidelines. We are committed to protecting the confidentiality and integrity of your data and handle all personal information in compliance with privacy regulations.

How we handle requests to access your personal information

You have a right to request access to your personal information which we hold about you and to request its correction. You can make such a request by contacting us using the contact details set out in this policy.

We will respond to any such request for access as soon as reasonably practicable. Where access is to be given, we will provide you with a copy or details of your personal information in the manner requested by you where it is reasonable and practicable to do so.

We will not charge you a fee for making a request to access your personal information. However, we may charge you a reasonable fee for giving you access to your personal information.

In some cases, we may refuse to give you access to the information you have requested or only give you access to certain information. If we do this, we will provide you with a written statement setting out our reasons for refusal, except where it would be unreasonable to do so.

How we handle requests to correct your personal information

We will take such steps (if any) as are reasonable in the circumstances to make sure that the personal information we collect, use or disclose is accurate, complete, up to date and relevant.

If you believe the personal information we hold about you is inaccurate, irrelevant, out of date or incomplete, you can ask us to update or correct it. To do so, please contact us using the contact details listed below.

How to contact us or make a complaint

If you have any questions about this Privacy Policy, if you wish to correct or update information we hold about you or if you wish to request access or correction of your personal information or make a complaint about a breach by us of our privacy obligations (including the way we have collected, disclosed or used your personal information), please contact:

Director

Unit 111, 101 Moray Street, South Melbourne, VIC 3205

support@dazhboards.com

We will acknowledge and investigate any complaint about the way we manage personal information as soon as practicable. We will take reasonable steps to remedy any failure to comply with our privacy obligations.