1. Definitions
APPs means the Australian Privacy Principles in Schedule 1 of the Privacy Act.
De-identified information means information from which all personal identifiers have been removed such that it is not reasonably practicable to re-identify the individual.
Guest means an individual who accesses or uses the Platform to search for, enquire about or book camping experiences.
Host means a person or entity that lists a property, site or camping experience on the Platform.
NextCamp, we, us, our means NextCamp Pty Ltd (ABN 60 696 892 127, ACN 696 892 127) and any related bodies corporate.
OAIC means the Office of the Australian Information Commissioner.
Personal information has the meaning given in the Privacy Act, including names, contact details, IP addresses, device identifiers, location data and cookie identifiers.
Platform means the NextCamp website, mobile application and associated digital services, APIs and tools.
Privacy Act means the Privacy Act 1988 (Cth) as amended.
Sensitive information has the meaning given in the Privacy Act, including health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal record and biometric data.
2. About this Policy
This Policy governs the collection, use, holding and disclosure of personal information by NextCamp in connection with the Platform.
NextCamp is an APP entity bound by the Privacy Act and the APPs.
By accessing or using the Platform you acknowledge that you have read this Policy. Where this Policy states that we rely on your consent for a particular activity, that consent is captured separately and expressly, not by your use of the Platform.
This Policy applies to Guests, Hosts and any other visitor to the Platform. Clause 21 sets out how this Policy interacts with the other NextCamp platform documents.
3. Anonymity and pseudonymity
Where lawful and practicable we will let you interact with the Platform anonymously or by pseudonym. It is not practicable for the following functions:
- creating an account or a Host listing
- making, receiving or managing a Booking
- processing payments or receiving payouts
- verifying identity as required by law
- raising a support request or complaint
Browsing public listings may be possible without identifying yourself, subject to the cookie practices in clause 11.
4. What we collect
From Guests
- Full name, email address, phone number and date of birth
- Profile information and photograph
- Billing address and payment instrument details, processed via third party providers
- Booking history, search queries and wishlist data
- Reviews, ratings and other submitted content
- Communications with Hosts and with NextCamp
- Identity verification documents where required
- Device identifiers, IP addresses, browser type and usage data
- Location data where permitted by your device settings
- Travel preferences, party composition and pet information
From Hosts
- Full name, trading name, ABN or ACN and contact details
- Bank account details for payouts
- Property and listing information, including photographs and descriptions
- Availability, pricing and calendar data
- Insurance certificates and compliance evidence required under the Host Terms of Service
- Tax related information where required by law, see clause 10
- Communications with Guests and with NextCamp
- Performance metrics, response rates and review scores
- Identity verification documents
Automatically
- Browsing behaviour, clickstream data and session duration
- Referral source and advertising attribution data
- Device and operating system information
- Cookies and similar technologies, see clause 11
Sensitive information. We do not intentionally collect sensitive information unless it is reasonably necessary for our functions, you have consented, or we are required or authorised by law. If you voluntarily provide sensitive information, such as an accessibility requirement relevant to a Booking, you consent to us using and disclosing it solely to facilitate that Booking.
5. Unsolicited personal information
If we receive personal information we did not solicit, we will within a reasonable period determine whether it could have been collected under APP 3. If it could, we may retain and use it under this Policy. If it could not, we will destroy or de-identify it as soon as practicable, where lawful.
6. How we collect
We collect directly from you when you register, create or update a listing, make or manage a Booking, contact support, submit reviews, respond to surveys, or otherwise use the Platform.
We may also collect from third parties including identity verification providers, payment processors, social login platforms, analytics providers, advertising partners and publicly available sources. Where we do, we take reasonable steps to ensure we have complied with the APPs.
If you provide personal information about another person, such as a fellow traveller, you warrant that you have their consent and have informed them of this Policy.
7. Why we use it
- To create and manage accounts and verify identity
- To facilitate Bookings between Guests and Hosts, including payments and payouts
- To communicate about Bookings, enquiries and account activity
- To display and improve listings, search results and recommendations
- To enforce the platform documents, resolve disputes and protect community safety
- To detect, investigate and prevent fraud or illegal activity
- To comply with legal obligations and respond to regulatory requests
- To send transactional communications including confirmations, receipts and account notices
- To send direct marketing where permitted under clause 12
- To analyse Platform usage and improve our products and services
- To conduct research and generate de-identified statistical insights
- To manage business operations including taxation, accounting, insurance and legal proceedings
Secondary purposes. We may use or disclose personal information for a secondary purpose where it is directly related to the primary purpose and you would reasonably expect it, or where you have consented. De-identified or aggregated information may be used for any purpose.
8. Disclosure
We do not sell personal information.
Other Platform users
When a Booking is confirmed, relevant contact and booking details are disclosed between the Guest and the Host so the stay can be delivered. Hosts must handle Guest information in accordance with the APPs and use it only to fulfil the Booking, as required by clause 10 of the Host Terms of Service.
Service providers
We engage providers including payment processors, cloud hosting, customer support platforms, email and SMS delivery, identity verification, analytics and advertising platforms. They access personal information only as necessary to provide services to NextCamp and are bound by contractual obligations to handle it in accordance with applicable privacy laws.
Business partners
We may share information with tourism bodies, parks and reserves authorities, camping associations and co-marketing partners where relevant to facilitating or improving your experience, subject to appropriate protections.
Legal and safety
We may disclose where required or authorised by law, in response to a court order, warrant, subpoena or regulatory requirement, to law enforcement, to protect the rights, property or safety of NextCamp, our users or the public, or in connection with fraud prevention.
Business transfers
In a merger, acquisition, sale of assets or restructure, personal information may be transferred to a successor entity, provided that entity agrees to be bound by obligations no less protective than this Policy. We will notify you where required by law.
Third party links
The Platform may link to third party sites. We are not responsible for their privacy practices. This Policy applies only to the NextCamp Platform.
9. Overseas disclosure
9.1 Some of our service providers are located or store data outside Australia, including in the United States, the European Economic Area, Singapore and other jurisdictions.
9.2 Where we have expressly informed you of the consequences and you then consent under APP 8.2(b), APP 8.1 does not apply to that disclosure. That consent is captured by a separate, unbundled tick box. It is not given by using the Platform, and it is not bundled with acceptance of this Policy or any other document. You can withdraw it at any time in your account settings.
9.3 Before you give that consent, we show you the following, at the point of the tick rather than by link:
9.4 Where you have not given that consent, or you withdraw it, we do not rely on APP 8.2(b). In that case we take reasonable steps to ensure overseas recipients are bound by enforceable obligations no less protective than the APPs, or we rely on another exception under APP 8.2, and we remain accountable under APP 8.1.
9.5 Declining or withdrawing this consent does not prevent you using the Platform.
10. Government related identifiers
We will not adopt, use or disclose a government related identifier, such as a Tax File Number, Medicare number or driver licence number, as our own identifier of an individual, except as permitted under APP 9.
Where we collect government related identifiers, for example tax information from Hosts for payout and ATO reporting, that information is used only for the purpose for which it was collected or as required by law.
12. Direct marketing
We may send you promotional communications about NextCamp where you have consented, or where you are an existing user and we are marketing similar goods or services and you have not opted out, consistent with section 7(2) of the Spam Act 2003 (Cth).
You may opt out at any time using the unsubscribe mechanism in any marketing communication, your notification preferences, or by contacting us. We action opt-out requests as soon as reasonably practicable. Opting out does not affect transactional or account communications.
13. Data retention
- Account information: duration of the account plus seven years after closure, for dispute resolution, fraud prevention and legal compliance
- Transaction and booking records: minimum seven years, consistent with taxation and consumer protection requirements
- Communications and support records: up to five years
- Identity verification records: as required by applicable legislation
- Analytics and usage data: retained indefinitely in de-identified or aggregated form
We may retain information longer where required by a legal hold, regulatory investigation or litigation, or to exercise or defend a legal claim. After the retention period, information is securely destroyed or de-identified.
14. Security
We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Our measures include encryption in transit and at rest, access controls and multi-factor authentication, regular security assessments and vulnerability management, and documented incident response procedures.
If you suspect unauthorised access to your account, notify us immediately at privacy@nextcamp.com.au.
Notifiable data breaches. In the event of an eligible data breach, being one likely to result in serious harm as defined in Part IIIC of the Privacy Act, we will take prompt remediation steps and notify affected individuals and the OAIC as required by the Notifiable Data Breaches scheme.
15. Content you post
Content you submit, including reviews, photographs, messages and listing descriptions, may be visible to other users or to the public. Do not include sensitive personal information in publicly visible content.
The licence you grant NextCamp over that content is set out in clause 5.2 of the Host Terms of Service if you are a Host, and clause 10 of the Guest Terms if you are a Guest. This Policy grants no licence over your content.
16. Access and correction
You may request access to the personal information we hold about you, and request correction if it is inaccurate, out of date, incomplete, irrelevant or misleading.
Contact our Privacy Officer using the details in clause 22. We acknowledge requests and respond within the periods required by applicable privacy law. If a request is complex or requires clarification, we will explain the next step through the contact channel you used.
We require identity verification before processing a request, to protect against unauthorised disclosure.
We may charge a reasonable fee to cover the cost of providing access, but not for a correction. We will advise you of any fee before processing.
We may refuse access or correction in the limited circumstances permitted by APP 12 or APP 13. If we refuse, we will give written reasons and information about how to seek review.
17. Children
The Platform is not directed at, and we do not knowingly collect personal information from, individuals under 18 without verifiable parental or guardian consent. A person under 18 may stay at a Site as part of a booking party led by a responsible adult, as set out in clause 1 of the Guest Terms.
If we become aware that we have collected information from a person under 18 without appropriate consent, we will take steps to delete or de-identify it as soon as reasonably practicable.
18. Changes to this Policy
We may update this Policy. We will notify you of material changes by posting the updated Policy with a revised effective date and, where the change materially affects how we handle your personal information, by email at least 30 days before it takes effect.
Where a change relies on your consent, we will seek that consent separately rather than treating continued use as agreement.
The current effective date is displayed at the top of this Policy. NextCamp retains prior published versions as part of its document-control record.
19. Privacy complaints
If you believe we have breached the APPs or mishandled your personal information, contact our Privacy Officer first. We assess complaints according to their urgency and respond within the periods required by applicable privacy law.
If you are not satisfied with our response, you may lodge a complaint with the OAIC at www.oaic.gov.au, on 1300 363 992, or by post to GPO Box 5218, Sydney NSW 2001.
20. General
Governing law. This Policy is governed by the laws of New South Wales, Australia, and you submit to the non-exclusive jurisdiction of its courts.
Severability. If any provision is invalid or unenforceable, it is severed and the rest continues in full force.
No waiver. A failure to enforce a provision is not a waiver of the right to enforce it later.
21. Document precedence
(a) The NextCamp platform documents are the Platform Terms of Use, the Host Terms of Service, the Guest Terms, the Guest Code of Conduct, the Dispute Resolution Policy and the Privacy Policy (together, the Platform Documents). This document is the Privacy Policy.
(b) If there is any inconsistency between Platform Documents, the following order of precedence applies, with the higher ranked prevailing to the extent of the inconsistency:
(i) the Privacy Policy, but only in relation to the collection, use, holding, disclosure and security of personal information;
(ii) the Host Terms of Service, in relation to a Host and the operation of a Site;
(iii) the Guest Terms, in relation to a Guest and a Booking;
(iv) the Guest Code of Conduct, in relation to Guest conduct;
(v) the Dispute Resolution Policy, in relation to the process for resolving a dispute, but not in relation to any substantive right, liability or entitlement to money;
(vi) the Platform Terms of Use, in relation to all other matters.
(c) Despite paragraph (b), no Platform Document operates to exclude, restrict or modify any right or remedy under the Australian Consumer Law, the Privacy Act 1988 (Cth) or any other law to the extent it cannot lawfully be excluded.
(d) A Platform Document that is silent on a matter is not inconsistent with another Platform Document that deals with that matter.
22. Contact our Privacy Officer
Entity: NextCamp Pty Ltd (ABN 60 696 892 127, ACN 696 892 127)
Privacy Officer: privacy@nextcamp.com.au