Privacy Policy for BarBike.
BAR BIKE GROUP PRIVACY POLICY
Effective date: 12 January 2026
1. ABOUT THIS POLICY: Bar Bike Group operates under the ABN 77 687 059 953, trading as Bar Bike Group. In this Policy, Bar Bike Group is called BarBike, we, us or our.
This Policy explains how BarBike handles information in connection with its website, enquiries, quotes, Bookings, customer accounts, payments, communications, Events and business operations.
The Privacy Act 1988 (Cth) does not apply to every Australian small business and whether it applies can depend on a business's circumstances and activities. Where the Privacy Act applies to BarBike, BarBike will handle personal information in accordance with the Australian Privacy Principles and other applicable requirements. BarBike also intends to follow the practices stated in this Policy where those requirements do not apply, subject to any lawful exception stated here.
This Policy is information about BarBike's practices. It is not blanket consent to a collection, use or disclosure that requires separate consent by law.
2. PERSONAL INFORMATION BARBIKE MAY COLLECT: Depending on how a person deals with BarBike, information may include:
1. identity and contact information, such as name, email address, telephone number, company or organisation, industry, primary contact and Event-day contact details;
2. account and security information, such as an internal customer identifier, password hash, password-reset records, login timestamps and authentication or security events;
3. enquiry and quote information, such as the services of interest, Event type, message, source, quote selections, price, pricing version, referral and attribution information;
4. Booking and Event information, such as Event date, time, duration, venue and address, Google place identifier, guest count, package, service, menu, glassware and upgrade selections, access or suitability confirmations, instructions and special requests;
5. transaction information, such as the payment method, amount, currency, payment status, timestamp, Stripe customer or payment identifier, internal Booking or transaction reference, deposit, balance, glassware deposit, credit, refund and dispute records;
6. Booking administration information, such as accepted policy versions, acceptance timestamp and wording, amendments, postponement proposals, cancellations, cancellation acknowledgements, correspondence, operational notes and Event outcomes;
7. communications and content, such as emails, telephone notes, questions, feedback, complaints, reviews, testimonials, photographs, video and information voluntarily supplied in free-text fields;
8. website, device and attribution information described in sections 6 to 10; and
9. records needed for business administration, security or legal rights, such as audit history, error records, suspected misuse, incidents, claims and complaint handling.
A venue-access field may record whether the venue has suitable physical access for BarBike equipment. It is not intended to record that a person has a disability.
BarBike does not ask customers to provide allergy, dietary, medical, disability or other health information and does not ordinarily create structured records of it. A person may nevertheless volunteer such information in an email, free-text field, telephone conversation or other communication. If that occurs, BarBike may incidentally receive and retain it with the relevant communication. A person should disclose only information they choose to provide and that is relevant to a request.
3. HOW BARBIKE COLLECTS INFORMATION: BarBike may collect information:
1. directly from a person through the website, quote, booking, checkout, account and contact forms;
2. through email, telephone and other direct communications;
3. during setup, service and other interactions at an Event;
4. automatically through cookies, pixels, tags, local storage, server logs, device or browser identifiers, analytics tools and server-side application programming interfaces;
5. from Stripe in connection with payment processing and status;
6. through Google Maps and Places when an address or route is searched, selected or calculated;
7. through photographs or video taken under the Booking Terms; and
8. from service providers where needed to operate, secure or administer the service.
BarBike does not ordinarily source customer information from venues, referral partners, other clients, lead platforms, suppliers or purchased lists. It does not buy customer databases or lead lists.
4. WHY BARBIKE HANDLES INFORMATION: BarBike may collect, hold, use and disclose information to:
1. respond to an enquiry or requested quote;
2. calculate pricing, travel, service requirements and availability;
3. create, confirm, administer, change and provide a Booking;
4. communicate about Event details, access, payment, changes, cancellation and service delivery;
5. create and administer a customer account or booking dashboard;
6. process, reconcile and record payments, deposits, balances, credits, refunds and disputes;
7. provide safe service and comply with responsible-service, food-safety, venue and work-safety requirements;
8. provide customer service and handle feedback, complaints, incidents or claims;
9. detect and address fraud, security issues, misuse, technical errors and duplicate records;
10. maintain operational, financial, tax, insurance and business records;
11. establish, exercise or defend legal rights and comply with lawful requirements;
12. operate, maintain, troubleshoot and improve the website and services;
13. measure enquiry sources, lead acquisition, conversion, campaign and business performance;
14. analyse long-term business, Event, lead and customer trends;
15. create audiences, measure advertising, attribute conversions and conduct permitted advertising or remarketing;
16. use authorised photographs, video, testimonials and reviews for portfolio and promotional purposes; and
17. evaluate, negotiate and complete a bona fide transfer of the BarBike business as described in section 15.
If a person does not provide information reasonably needed for a quote or Booking, BarBike may be unable to calculate the quote, confirm the Booking, provide a requested accommodation or deliver some Services.
5. PAYMENTS AND BANK TRANSFERS:
5.1 STRIPE CARD PROCESSING: Stripe processes online card payments under its own privacy terms and legal obligations. Stripe may receive a customer's name, email address, internal customer reference, payment and device information, and information needed to authenticate, process, prevent fraud and administer a payment.
BarBike does not receive or store full payment-card numbers, card verification values or complete card credentials. BarBike retains transaction records such as payment method type, amount, currency, status, timestamps, Stripe customer and payment identifiers, Booking reference, credits, refunds and disputes.
5.2 REQUESTED BANK TRANSFER: Bank transfer is not the standard Booking-payment method. A Client who has confirmed a Booking online by paying a deposit may ask to pay the later outstanding balance by bank transfer. If BarBike agrees, the financial institution processes the transfer and BarBike records the cleared-payment outcome against the Booking.
BarBike does not ordinarily retain remittance advice, transfer screenshots or bank statements in the customer record. The receiving financial institution may independently retain payer and transaction information under its own terms and legal obligations.
6. COOKIES, LOCAL STORAGE, ANALYTICS AND ADVERTISING TECHNOLOGY: BarBike and its providers may use cookies, pixels, tags, scripts, local or similar browser storage, browser and device identifiers, server logs and server-side application programming interfaces. These technologies may operate automatically when a person uses an ordinary, non-administration page. BarBike does not currently provide a website cookie-preference panel.
Depending on the technology, settings and interaction, the information handled may include:
1. IP address, user agent, browser, device type, operating system, screen characteristics and approximate location;
2. website address, query parameters, referring page, pages viewed, navigation path, timestamps and time spent;
3. searches, clicks, taps, cursor movement, scrolling, page state, downloads, video interaction, outbound links and form interaction;
4. errors, console information, performance, network and diagnostic information;
5. UTM campaign values, referral source, gclid, fbclid, provider cookies such as Meta's fbp, and a locally generated user identifier;
6. quote, checkout, lead, add-to-cart, purchase, Booking, payment and other conversion events;
7. transaction value, currency, internal order or Booking reference and attribution information;
8. survey, feedback or voluntary testing responses where a feature is used; and
9. pseudonymous or hashed identifiers, including identifiers derived from a name, email address, telephone number or internal customer identifier where supported.
Hashing or pseudonymisation does not necessarily make information anonymous. A provider may be able to match a hashed identifier to information it already holds. BarBike does not intentionally send full payment-card details through analytics or advertising events.
BarBike uses this information for website operation, security, troubleshooting, performance, lead attribution, conversion and trend analysis, service improvement, audience creation, remarketing and advertising measurement.
Browser settings, blocking extensions, Do Not Track signals and provider controls may limit some browser-side collection. They may not stop first-party records, information a person intentionally submits, necessary server processing or server-side conversion measurement. Their effectiveness depends on the browser and provider.
7. GOOGLE SERVICES: BarBike uses Google Analytics, Google Ads and Google Maps or Places.
Google Analytics and Google Ads may receive device and browser information, page and interaction information, attribution identifiers, approximate location, BarBike's internal user identifier, conversion events, transaction values and references. They may be used for enhanced measurement, Google Signals, granular location and device reporting, advertising personalisation, audience creation, remarketing and conversion measurement where those functions are enabled.
At the date this Policy was prepared, BarBike's Google configuration included enhanced measurement, Google Signals, granular location and device collection and advertising personalisation. Event-level analytics retention was configured for two months and user-level retention for 14 months with reset on activity. Email redaction was enabled, URL-query redaction was not enabled, consent signals were inactive, user-provided-data collection was off, and the optional account data-sharing selections inspected by BarBike were off. Provider settings can change and a changed setting will be reflected in a later Policy where it materially changes BarBike's practices.
Google Maps or Places receives address or place queries and may return a selected address, place identifier, route and distance information used for venue and travel calculations.
Google handles information under its own privacy terms and legal obligations and may process it through global infrastructure.
8. META SERVICES: BarBike uses the Meta Pixel and Meta Conversions API. These services may receive page and conversion events such as page view, lead, add-to-cart and purchase, together with IP address, user agent, Meta cookies, attribution information, value, currency, order or Booking reference and hashed or otherwise pseudonymised identifiers.
Meta may match this information with information it already holds for advertising measurement, attribution, audience creation, delivery, security and its other purposes under its own privacy terms. Hashed information is not necessarily anonymous.
BarBike does not disclose its customer database to another organisation for that organisation's independent direct-marketing list. Processing by Meta to provide analytics and advertising functions is not a standalone sale of the customer database.
9. HOTJAR: BarBike uses Hotjar to understand how people use the website and may enable any Hotjar functionality available under BarBike's plan, subject to applicable law, provider rules and any notice or consent required at the time. Functions may include session replay, heatmaps, targeting, surveys, feedback tools, screenshots, error or console capture, user attributes and lookup, tests, interviews and assisted analysis.
Depending on the enabled features and provider protections, Hotjar may process:
1. pages, URLs, referrers, time and visible page state or content, including text, images and video;
2. clicks, taps, cursor movement, scrolling, navigation, permitted form-field interaction or text, and other page interactions;
3. technical information, device and browser data, errors, console or network information, IP address and country-level location;
4. voluntary survey, feedback, testing or interview responses, screenshots, audio or video; and
5. an internal BarBike identifier and supported attributes such as name, email address, customer or Booking status, source, purchase or transaction status and relevant dates.
BarBike may use permissive capture settings where available. BarBike does not promise that every page element, image, field or item will be masked or suppressed. Hotjar's mandatory safeguards and automatic protections continue to apply, including protections for fields the provider designates as sensitive and sequences of nine or more digits that the provider automatically suppresses. BarBike will not deliberately configure Hotjar to capture full payment-card credentials.
Hotjar may process an IP address to derive country-level location. It states that the IP address is not ordinarily stored at rest with a session, although an IP address deliberately sent as a user attribute could be stored as that attribute.
BarBike may select the longest retention made available for a feature. At the date this Policy was prepared, Hotjar indicated that:
1. recordings and heatmap data may be retained for up to 365 days;
2. survey responses and saved highlights may remain until manually deleted;
3. identified user attributes may remain for up to 365 days after the user's last visit and de-identified attribute data for a further period of about three months;
4. user-test or interview recordings may remain for up to two years; and
5. deletion may take up to 30 days to propagate through relevant systems.
Information exported or incorporated into BarBike's own records is governed by section 18 rather than Hotjar's in-product period.
Hotjar's principal hosting is in Ireland. Its affiliated entities, support personnel and subprocessors may process information in the European Union, United Kingdom, United States, Israel, Singapore, Japan, United Arab Emirates, Egypt, Canada, India and other countries in which its current providers operate.
Browser or Hotjar Do Not Track controls may limit some collection but may not prevent information a person voluntarily submits through a survey, test, interview or feedback tool.
More information is available in Hotjar's Privacy Policy (https://www.hotjar.com/legal/policies/privacy/) and Hotjar's Do Not Track information (https://www.hotjar.com/policies/do-not-track/).
10. MONGODB ATLAS, VERCEL AND TECHNICAL RECORDS:
10.1 MONGODB ATLAS: BarBike's primary MongoDB Atlas database is hosted on Amazon Web Services in Sydney, Australia (ap-southeast-2). It stores customer, quote, Booking, payment-reference, communication, customer-relationship-management, authentication and operational records.
Atlas may maintain replicas, temporary and redundant copies across availability zones. BarBike may enable any backup, resilience and data-management functionality available for its service level, including scheduled or continuous backup, point-in-time restore, snapshots, on-demand backups, operation logs, exports, online archives, compliance policies and copies in other regions or supported cloud providers.
BarBike may choose the longest available retention or no automatic expiry for backups, snapshots, archives and exports. A backup-compliance policy may prevent early deletion or reduction of a configured period. Deleting an active record or terminating a cluster does not necessarily remove it immediately from replicas, logs, snapshots, archives, exports or backups.
Different technical records have different provider periods. At the date this Policy was prepared, database and audit logs could be retained for about 30 days, Performance Advisor information for about seven days and Trigger logs for about 10 days, while daily aggregated metrics and exported information may remain longer or indefinitely.
MongoDB and its subprocessors may access or process information for hosting, support, monitoring, backup, recovery and security in Australia, the United States, Ireland, Canada, Israel, France, India, Italy, Spain, Portugal, Brazil, Singapore, Poland, Germany, the United Kingdom and other countries in which current subprocessors operate.
Optional functionality described here is not necessarily enabled at all times. This section gives notice of the maximum configuration BarBike may use; a materially different purpose or collection will be addressed as required at the time.
10.2 VERCEL: BarBike uses Vercel to host and deliver the website and application. Vercel may process HTTP requests, IP address, user agent, submitted form and application data, function logs, security and diagnostic information and Vercel Speed Insights information.
At the date this Policy was prepared, BarBike's application functions ran in Vercel's iad1 region in the United States. Vercel may also use globally distributed edge infrastructure and subprocessors.
10.3 TECHNICAL STORAGE: BarBike may retain logs, deduplication records, delivery records, security events, resume tokens, audit histories and backups for operation, fraud prevention, troubleshooting, continuity and evidence. Some records are subject to configured or provider-controlled expiry while related underlying customer, quote, Booking or transaction records may remain.
11. EMAIL AND COMMUNICATION PROVIDERS: BarBike uses Mailtrap for outbound email and Zoho Mail for inbound email. These services may process names, email addresses, message content, attachments, delivery status, timestamps and technical routing information.
The BarBike application may parse inbound email and store message metadata such as sender, recipient, subject, date, mailbox identifier, thread key and reply state so that replies stop automated follow-ups and can be associated with the correct customer or enquiry.
At the date this Policy was prepared, the Zoho mailbox used an Australian service endpoint. Mailtrap may process outbound email through infrastructure in the United States. Both providers may use support personnel and subprocessors in other countries under their current terms.
12. ENQUIRY FOLLOW-UPS AND DIRECT MARKETING: BarBike does not currently conduct general bulk email-marketing campaigns and does not disclose customer information to another organisation for that organisation's own marketing.
The quote process includes an “Email me a copy of this quote” control that is selected by default. If a person leaves it selected and requests the quote, BarBike sends the requested quote and may schedule up to three personalised follow-up emails about that specific enquiry. These follow-ups may discuss the requested Event or BarBike services.
A Booking or any reply from that email address stops the automated follow-up sequence. BarBike may separately continue the individual conversation where the person asks a question or requests a response.
A person may ask not to receive further sales or marketing communication by replying to any BarBike email or contacting kieren@barbike.com.au. Every reply stops the automated follow-up sequence. BarBike may respond directly if the reply asks a question or requests a response. Necessary communications about an active enquiry, quote, Booking, payment, Event, complaint or legal matter may continue.
An internal field called marketing.subscribed, or a similar technical field, may be used to control communications. Its name does not mean that the person consented to unrelated or general marketing.
If BarBike begins a materially different general marketing campaign, it will update its process and notices and obtain or rely on consent only as permitted by applicable law.
13. EVENT PHOTOGRAPHY AND PROMOTIONAL CONTENT: Under the Booking Terms, Event photography and video are enabled unless the Client opts out; there is no separate photography checkbox. The Client may opt out before or during the Event by email, telephone or another communication channel. If BarBike receives an opt-out before the Event, it will not take photography or video at that Event. If it receives an opt-out during the Event, it will stop taking photography or video and will not use material already taken at that Event for promotional purposes.
BarBike may otherwise photograph or record its equipment, products, service setup and Event and use authorised content for its portfolio, website, social media and promotion. It will not intentionally use an identifiable person as the primary subject of promotional content without appropriate permission. Appropriate permission is required before intentionally featuring a child as the primary subject.
Event photographs and video may contain personal information about attendees. A person shown in content may contact the Privacy Contact to raise a concern or request consideration of removal. A request will be assessed in light of the person's rights, the context, BarBike's records and applicable law.
14. DISCLOSURE TO PROVIDERS AND OTHER RECIPIENTS: BarBike may disclose or make information available to:
1. personnel and contractors who need it to administer or provide Services;
2. Stripe and a financial institution for payments and banking;
3. MongoDB Atlas and Vercel, including their disclosed subprocessors, for hosting, database, backup, security and technical functions;
4. Mailtrap and Zoho, including their disclosed subprocessors, for communications functions;
5. Google, Meta, Hotjar and Vercel Speed Insights for the functions described in this Policy;
6. Google Maps or Places for address and route functions;
7. insurers, accountants and professional advisers where reasonably necessary;
8. a venue, emergency service, authority, regulator, court or other person where reasonably necessary for safety, legal compliance or legal rights;
9. a prospective purchaser, that purchaser's financier or adviser where reasonably necessary, or a completed purchaser under the controls in section 15; and
10. the public where BarBike publishes authorised photography, video, a testimonial, review or other promotional content.
Providers handle information for the functions they provide to BarBike and, where applicable, for purposes described in their own privacy terms and legal obligations. BarBike does not promise that every provider acts only as BarBike's processor where the provider's terms give it an independent role.
BarBike does not sell or disclose its customer information as a standalone list for another organisation's own marketing.
15. SALE OR TRANSFER OF THE BUSINESS: BarBike does not sell its customer database as a standalone marketing list. A bona fide sale, merger, restructuring or transfer of the BarBike business may nevertheless involve customer information.
During due diligence, BarBike will use aggregated or de-identified information where reasonably practicable. Identifiable information may be disclosed only where reasonably necessary for the proposed transaction, permitted by law, and de-identified information is insufficient. BarBike may use confidentiality obligations, restricted data-room access, copying or export limits, staged disclosure and return or destruction conditions if the transaction does not complete.
On completion, information reasonably necessary to continue the business and honour Bookings may transfer to the purchaser or successor. It may include customer and contact details, quote and Booking records, Event information, communications, payment and credit records, service preferences, complaints and other operational records.
The purchaser must handle transferred information consistently with applicable law and the purposes for which it was collected, unless a lawful change is notified or agreed. BarBike may retain copies where reasonably necessary for accrued liabilities, tax, evidence, disputes or another purpose in section 18.
BarBike or the purchaser will notify affected people of a completed transfer where required by law or otherwise reasonably appropriate in the circumstances.
16. OVERSEAS PROCESSING: BarBike operates in Australia and does not target or provide Event services internationally. Some providers and their personnel or subprocessors operate overseas, so information may nevertheless be processed outside Australia.
The current primary MongoDB Atlas database is in Sydney, Australia. Other processing may occur in the United States through Vercel, Mailtrap, Google, Meta and other providers; in Ireland through Hotjar and provider infrastructure; and in other countries used by Stripe, Zoho, MongoDB and the providers' current affiliated entities or subprocessors. Stripe may process payment information in Australia, Ireland, the United States and other locations used by its subprocessors.
Likely locations may include the United States, Ireland, United Kingdom, Canada, India, Israel, Singapore, Japan, United Arab Emirates, Egypt, Brazil, France, Germany, Italy, Spain, Portugal, Poland and other countries in which an identified provider or its current subprocessor operates. Provider arrangements and subprocessor locations may change.
Where the Privacy Act applies and BarBike discloses personal information to an overseas recipient, BarBike will take the steps required by applicable law. Use of a provider's global service may also involve that provider handling information under its own privacy terms.
17. SECURITY AND DATA INCIDENTS: BarBike uses measures it considers reasonable for the nature of the information and business, which may include authentication, role or account access controls, provider security controls, encrypted connections, backup and recovery functions, software maintenance, logging and limiting access to people who need it.
No website, transmission or storage system is completely secure. BarBike does not guarantee that information will never be lost, misused, accessed without authority or affected by a service-provider incident.
BarBike will investigate a suspected data incident and take containment, remediation, assessment and notification steps required by applicable law.
18. RETENTION: BarBike does not apply a fixed automatic deletion period to most ordinary enquiry, quote, Booking, Event, account, correspondence or operational records. Subject to applicable law, those records may be retained for an indefinite period while reasonably required to:
1. administer services and maintain an accurate Booking and business history;
2. analyse lead acquisition, conversion and long-term business trends;
3. prevent fraud, misuse, duplication or unwanted communication;
4. manage complaints, incidents, disputes, credits or refunds;
5. establish, exercise or defend legal rights;
6. meet financial, tax, insurance, contractual or other legal needs; or
7. support due diligence or a bona fide business sale.
Financial and transaction records may be retained for at least five years after the later of their preparation or completion of the relevant transaction, and longer where reasonably required for another stated purpose or by law.
Event photographs and video have no fixed automatic expiry and may be retained while reasonably required for an authorised promotional, portfolio, evidentiary or business-history purpose.
Consent, communication-preference and suppression records may be retained indefinitely where reasonably necessary to document a choice or prevent unwanted communication.
Analytics information is retained according to BarBike's provider settings and each provider's rules, including the periods described in sections 7 and 9. Aggregated or properly de-identified information may be retained indefinitely.
Technical records, tokens, delivery and deduplication records, logs, replicas, archives and backups may remain for configured, provider-controlled or technical cycles after active information changes or is deleted. An exported or incorporated copy may be retained under another purpose in this section.
If applicable law requires information that is no longer needed to be destroyed or de-identified, BarBike will take the steps required by that law.
19. ACCESS, CORRECTION, DELETION AND WITHDRAWAL REQUESTS: A person may make a written request to access or correct personal information BarBike holds about them, ask BarBike to assess deletion, withdraw a consent for future handling, or raise a communication or photography preference. Requests should be sent to the Privacy Contact in section 22.
BarBike may ask for information reasonably necessary to verify identity or authority and protect another person's privacy. BarBike will handle access and correction within a reasonable period and to the extent required by applicable law. It may refuse or limit a request where permitted or required by law and will provide any explanation the law requires.
A verified deletion request triggers an assessment; it does not guarantee deletion. BarBike may retain information where a continuing lawful and reasonable purpose applies, including an active Booking, business-history or trend analysis, financial, tax, insurance or legal requirements, complaint or incident management, security and fraud prevention, establishment or defence of legal rights, suppression records, provider or backup cycles, or another purpose in section 18.
If deletion is required by applicable law, BarBike will take the required steps. Removal from an active system may not immediately remove technical copies, logs, archives or backups, and BarBike may retain a minimal record of the request where reasonably necessary to document compliance or prevent further unwanted communication.
Withdrawal of consent operates prospectively and does not invalidate handling that was lawful before withdrawal. It may not affect handling supported by another lawful basis or reasonably necessary to provide a requested Booking or service.
20. PRIVACY COMPLAINTS: A privacy complaint should describe the concern and be sent to the Privacy Contact in section 22.
BarBike will acknowledge and investigate the complaint and aims to respond within 30 days.
BarBike may ask for further information needed to investigate and may propose practical resolution steps.
If the Privacy Act applies to the relevant handling and the person is dissatisfied with BarBike's response, the person may be entitled to complain to the Office of the Australian Information Commissioner. Other regulators or remedies may be available depending on the issue.
21. CHANGES TO THIS POLICY: BarBike may publish a new Privacy Policy for future handling. Each published version will state its effective date and version number.
A new Policy does not retrospectively authorise an earlier collection, use or disclosure and does not replace the version acknowledged for an existing Booking merely because the website is updated. Where a material change affects existing customers, BarBike will give any additional notice or obtain any consent required by applicable law.
BarBike may retain accepted historical versions and records of the version presented during a Booking. If an exact historic document is unavailable, BarBike will record that limitation rather than fabricate the content.
22. CONTACT: Privacy requests and complaints should be directed to:
- Kieren Stewart — Privacy Contact
- Bar Bike Group
- ABN 77 687 059 953
- Email: bookings@barbike.com.au