Privacy Policy
1. Who we are
This Privacy Policy explains how we collect, hold, use and disclose your personal information, and how you can access, correct or complain about it.
In this policy, we, us and our means Take Shape Health & Fitness Pty Ltd (ABN 93 143 572 294), trading as Take Shape Adventures, Impact Adventures and the Positive Outdoor Institute.
We are committed to protecting your privacy and we comply with the Australian Privacy Principles in the Privacy Act 1988 (Cth). We comply with these obligations whether or not the small business exemption would otherwise apply to us.
Personal information: Means information or an opinion about an identified individual, or an individual who is reasonably identifiable.
2. Dealing with us anonymously
You can deal with us anonymously or under a pseudonym where it is lawful and practicable, for example when making a general enquiry or joining our mailing list. You cannot book a trip, retreat or program anonymously, because we need to know who is in the field with us and how to reach your emergency contact.
3. What we collect
Information you give us
| Category | Examples |
|---|---|
| Identity and contact | Name, email, postal address, phone, emergency contact |
| Booking and payment | Trips booked, payment plan details, transaction records |
| Preferences | Fitness level, walking experience, room preferences, clothing sizes |
| Feedback and correspondence | Survey responses, reviews, enquiries, messages to us |
| Employment and contracting | Applications, qualifications, accreditations, insurance certificates |
Sensitive information
Some of what we collect is sensitive information, which attracts higher protection under the Privacy Act. We collect it only with your consent and only where it is reasonably necessary for us to run our activities safely.
| Category | Why we need it |
|---|---|
| Health and medical | Conditions, injuries, medications, allergies. Required to assess suitability for an activity and to respond in an emergency. |
| Dietary requirements | To cater safely on trips and retreats. |
| Images and footage | Photographs and video taken during trips, retreats and programs. |
If you do not provide health information we ask for, we may not be able to accept your booking. We will tell you if that is the case.
Information collected automatically
When you visit our website we collect your IP address, browser and device type, pages viewed, time on site, and the site you came from.
4. How we collect it
We collect personal information directly from you: through our website and booking forms, by email, phone, SMS and WhatsApp, in person on trips and at events, and through surveys and feedback forms.
We may also collect it from third parties, including your employer where they have booked a program on your behalf, a travel agent or partner operator, and social media platforms where you interact with our advertising. Where we collect information about you from someone else, we take reasonable steps to tell you.
If we receive personal information we did not ask for and could not have collected ourselves, we will destroy or de-identify it as soon as practicable, unless it is in a Commonwealth record or we are required by law to keep it.
5. Why we use it
We use your personal information to:
- Provide the trips, retreats, programs and services you have booked
- Assess whether an activity is safe and suitable for you
- Respond to a medical or safety incident in the field
- Process payments and manage payment plans
- Communicate with you about your booking
- Send you marketing about our trips, events and programs, where you have consented
- Improve our services, understand what our clients want, and develop new offerings
- Meet our legal, insurance and permit obligations
- Recruit, train and manage guides, facilitators and staff
We will only use your information for a purpose you would reasonably expect, or a purpose you have consented to, or where the law requires or permits it.
6. Direct marketing
We send marketing by email, SMS and post where you have consented or where you would reasonably expect it as an existing client.
Every marketing email and SMS includes a way to opt out. You can also opt out at any time by contacting us. We will action your request promptly and at no cost.
We do not sell your personal information, and we do not disclose it to other organisations for their own direct marketing.
We use advertising platforms including but not limited to Meta, Facebook, Instagram, and Google to reach people who may be interested in what we do. This can involve providing those platforms with a securely hashed version of your email address so they can show you our advertising or exclude you from it. You can opt out of this by contacting us.
7. Who we share it with
We share personal information with:
- Our employees, contract guides and facilitators, where they need it to deliver your trip or program
- Service providers who operate our systems, listed in section 8
- Partner operators, accommodation providers and transport operators, where necessary to deliver your booking
- Medical and emergency services, where your safety requires it
- Law enforcement, courts or regulators, where we are required or authorised by law
We require our service providers to protect your information and to use it only for the purpose we engaged them for.
8. Overseas disclosure
Several of the platforms we rely on store or process personal information outside Australia. Before disclosing your information to an overseas recipient, we take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles.
| Platform | What it does | Where information is held |
|---|---|---|
| Keap | Customer relationship management, bookings, email | United States |
| Meta (Facebook, Instagram, WhatsApp) | Advertising, messaging, trip group chats | United States and Ireland |
| SMS Global | SMS messaging | Australia |
| Metricool | Social media scheduling and analytics | Spain (European Union) |
| Supermetrics | Marketing reporting | Finland (European Union) |
| Xero | Accounting and invoicing | New Zealand and United States |
| ClickUp | Internal project and task management | United States |
| Anthropic (Claude) | Business analysis and content support | United States |
| OpenAI (ChatGPT) | Business analysis and content support | United States |
| Netlify | Website and booking forms | United States, served through a global content delivery network |
| Stripe | Payment processing | United States |
| Google Analytics 4 | Website analytics and advertising measurement | United States and Google data centres globally |
| WooCommerce | Online bookings, orders and payment records | Australia |
9. Artificial intelligence and automated decisions
We use AI tools, including Claude and ChatGPT, to analyse patterns across our client base as a whole. This includes how people engage with our emails, which trips and programs attract the most interest, and how our marketing channels perform. We use what we learn to decide what to offer, what to develop, and where to promote it.
We also use AI tools to help create and design our marketing material, including written content, images and campaign assets.
This analysis works on grouped and de-identified data. We do not put your name, contact details, health information or program measures into general-purpose AI tools.
Decisions that affect you personally are made by a person. This includes whether an activity is suitable for you, how we price a program, how we respond to a medical declaration, and any decision about a refund, cancellation or complaint.
10. Photographs and video
We take photographs and video on trips, retreats and programs, and we use them in marketing including our website, social media and advertising.
We ask for your consent at the time of booking. You can decline, and you can withdraw your consent at any time by contacting us. If you withdraw consent, we will stop using your image going forward and remove it from our own channels where practicable, though we may not be able to recall material already published or shared by others.
11. Website, cookies and tracking
Our website uses cookies and similar technologies to make the site work, to remember your preferences, to analyse how the site is used, and to deliver and measure advertising.
We use tracking tools including the Meta Pixel and Meta Conversions API, and Google Analytics and Google Ads. These share information about your activity on our site with those platforms.
You can manage cookies through your browser settings or through the consent options on our site. Blocking some cookies may affect how the site works.
12. Security
We protect your information with access controls and multi-factor authentication on our business systems, restricted access on a need-to-know basis, staff and contractor privacy training, secure and reputable service providers, and destruction or de-identification of information we no longer need.
No method of transmission or storage is completely secure. While we take reasonable steps, we cannot guarantee the security of information you send to us over the internet.
We do not store full credit card numbers. Payments are processed by Stripe, which is PCI DSS compliant and you can find their privacy policy on their website.
13. Data breaches
If we have reasonable grounds to believe an eligible data breach has occurred, we will notify affected individuals and the Office of the Australian Information Commissioner as soon as practicable, in line with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth) and our internal Data Breach Response Policy. Our notification will describe the breach, the kinds of information involved, and what we recommend you do in response.
Where we suspect a breach may have occurred but are not yet certain, we will assess the situation within 30 days and notify you if the assessment confirms an eligible breach.
If you believe your personal information held by us has been compromised, please contact us as soon as possible.
14. How long we keep it
We keep personal information only as long as we need it, or as long as the law requires.
| Information | Retention |
|---|---|
| Booking and financial records | 7 years |
| Health and medical declarations | 7 years from the activity |
| Incident and injury records | 7 years |
| Marketing contacts | 5 years |
| Website analytics | 5 years |
When we no longer need information, we destroy it or de-identify it.
15. Accessing and correcting your information
You can ask for a copy of the personal information we hold about you.
We will respond within 30 days. There is no charge for making a request. If giving you access involves significant work we may charge a reasonable cost-based fee, and we will tell you what it is before we proceed. We will never charge you for correcting information.
If information we hold is inaccurate, out of date, incomplete, irrelevant or misleading, tell us and we will correct it. If we decide not to give access or make a correction, we will explain why in writing and tell you how to complain.
16. Complaints
If you think we have mishandled your personal information, please contact us.
We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner: oaic.gov.au, 1300 363 992, or GPO Box 5288, Sydney NSW 2001.
17. Changes to this policy
We review this policy at least annually. We may update it at other times, and the current version is always on our website with its effective date.
If we make a change that materially affects how we handle your personal information, we will tell you by email before it takes effect.
18. Getting this policy in another form
We will provide this policy free of charge in another format if you ask.