Privacy Policy (APP 1988 & GDPR)

1. Commitment to Traveller Privacy

Roam Australia & Beyond ("we", "us", or "our") is dedicated to protecting the privacy, confidentiality, and security of all personal, medical, and financial data entrusted to us by our guests, travel partners, and website visitors. We comply strictly with the Privacy Act 1988 (Cth), the 13 Australian Privacy Principles (APPs), and where applicable, the General Data Protection Regulation (EU GDPR 2016/679).

2. Categories of Information We Collect

• Identification & Contact Data: Full legal names (matching passport / photo ID), date of birth, residential address, email address, mobile phone number, and emergency contact details.
• Booking & Travel Manifest Telemetry: Flight arrival/departure itineraries, dietary preferences, hotel pickup points, rooming allocations, and companion passenger details.
• Health, Dietary & Medical Fitness Declarations: Pre-existing medical conditions, mobility assistance requirements, severe allergies (anaphylaxis protocols), and emergency medication notices necessary to ensure guest safety on remote expeditions (e.g. Kimberley gorges, Arnhem Land, Flinders Ranges).
• Encrypted Financial Telemetry: Credit card transactions processed through bank-grade PCI-DSS Level 1 tokenized gateways. We never store raw CVV codes or complete credit card numbers on our local servers.

3. Purpose and Legal Basis for Processing

We process your personal information exclusively for the following lawful purposes:

1. Executing travel contracts, confirming boutique lodge reservations, issuing flight and rail tickets, and securing private land charter permits.
2. Safeguarding guest health and wellbeing during escorted departures, including providing medical summaries to emergency aeromedical services (e.g. Royal Flying Doctor Service) if required.
3. Complying with statutory Australian border security, maritime safety, and Aboriginal land council access permit requirements.
4. Administering the Roam Rewards loyalty programme and providing tailored tour recommendations with explicit consent.

4. Data Storage, Security & International Transfers

All digital records are encrypted in transit via TLS 1.3 and at rest utilizing AES-256 bit encryption within ISO-27001 certified cloud infrastructure hosted within Australia. Data shared with regional suppliers (e.g. safari camps, indigenous cultural elders, charter pilots) is limited strictly to operational necessity.

5. Your Privacy Rights

Under Australian and international privacy laws, you possess the right to:

• Request access to the personal data we hold about you.
• Request correction or updating of inaccurate, outdated, or incomplete records.
• Request erasure ("Right to be Forgotten") subject to statutory accounting and regulatory retention limits.
• Withdraw marketing consent at any time via one-click unsubscribe links.

For privacy inquiries or data requests, contact our designated Data Protection Officer at privacy@roamaustralia.com.au.