OnePass Privacy Policy

When we refer to ‘personal information’ we mean information, or an opinion, about an individual who is reasonably identifiable, whether the information or opinion is true or not – this is basically how personal information is defined in the Australian Privacy Act.

We may share your personal information for the purposes set out in this Privacy Policy with:

• Participating Brands and Partners so you can receive the benefits of OnePass (these may include gift cards, vouchers, rewards, offers, points multipliers or discounts) and to improve their marketing and for the purposes outlined in the section above.

• Related Companies, Suppliers, other providers for them to help us operate the OnePass program and provide OnePass benefits. These include:

  • Payment systems operators (such as merchants receiving card payments or payment processors such as Stripe).
    
  • Services providers and our Related Companies for application and product development, technical support, and processing, storing, hosting, and analysing data.
  • Social media and online platforms, such as Google Marketing Platforms, Meta (including Facebook and Instagram), Pinterest and Reddit to enable member engagement and support, and marketing and advertising, and service providers that help us manage our social media presence.
    
  • Our professional advisers, including those that assist with communicating our offers and promotions to you, product development and market research, or provide specialist advice such as lawyers or accountants.
    

Other third parties we share personal information with may include:

• Your representatives.

• Government agencies, regulatory bodies and law enforcement agencies, or as required or permitted by law.

• Parties involved in business transfer transactions (and prospective transactions).

As mentioned in this Privacy Policy, we share and combine personal information with our Related Companies to enable us and them to undertake a range of important functions. The personal information that we share and combine with our Related Companies includes:

• Information about your purchases and transaction history with OnePass and Related Companies and product and service preferences.

• Interactions with OnePass, Participating Brands, Partners, and Related Companies, including your activity on websites and apps (such as the products you have viewed, added to your shopping cart and purchased), your communications with them, your interactions with them on social media or with their advertising and your device ID. We receive this information from the Participating Brands, Partners, and Related Companies through using cookies, tags, and pixels.

We may use this personal information (and disclose it to our Related Companies) to:

• Perform data analysis and matching to help us and them to better understand what you like and want and for insights and strategic and operational decision making.

• Enable us to provide you with offers, experiences, and direct marketing that interest you (where you have consented to receive direct marketing), display online advertising and personalise our website and apps.

• Develop aggregated insights about customer preferences, and research, survey, and improve our service offerings, advertising, and offers based on shopping and browsing habits.

• For other purposes where you have provided consent to us.

• For other purposes described in this Privacy Policy.

Our Related Companies may use it for the similar purposes relating to their operations.

Some of our Participating Brands, Partners, Suppliers and Related Companies may transmit or store information (including your personal information) that we provide to them overseas. This may include disclosures to entities located in Canada, EU Member States (including Belgium, Denmark, Finland, Germany, Ireland, Netherlands), Japan, the Philippines, Singapore, the United Kingdom, and the United States of America.

When you join OnePass, based on the relationship between you and us, we will send direct marketing to you (unless you opt out of receiving it from us, or we are limited by law). Participating Brands and Partners who you’ve activated your OnePass Account with or otherwise engaged with them as a OnePass Member (including when you scan your OnePass card, your linked Flybuys card at a Participating Brand (excluding InstantScripts and Priceline) or your linked Sister Club card at Priceline) may also send direct marketing to you (unless you opt out of receiving it from them, or they are limited by law). The direct marketing may be sent by email, push notification, telephone, SMS, and other permitted means.
‍
You can stop receiving direct marketing from us through any of the following:

• Using the unsubscribe link or process in a direct marketing communication from us.

• Changing your preference within your OnePass account.

• Contacting customer support on the details below.

If you want to stop receiving direct marketing from Participating Brands or Partners you will need to contact them directly with your request, for example by clicking an unsubscribe link in a marketing email from them.

We also use, subject to compliance with applicable law:

• The personal information we collect from, or about you, to personalise the appearance of our website and apps to you.

• Online advertising as a way of promoting OnePass. This can include you seeing advertisements when you visit other websites or apps, including social media platforms. The advertisements may be based on personal information we have collected about you, your use of OnePass or your involvement with Participating Brands and Partners. You may be able to limit the personalisation of these advertisements (although you will still receive non-personalised ads when you visit other websites or apps) by:

• • blocking the use of cookies (see the ‘Digital Service Technologies’ section below).

  • using opt-out functionality provided by industry bodies such as optout.networkadvertising.org, optout.aboutads.info and youradchoices.com/appchoices.

  • opting out of Google Ads Personalisation: www.google.com/settings/ads.

  • using features provided by your device.
    

We may collect personal information about you when you use and access our website or apps and the websites and apps of our Participating Brands, Partners, and Suppliers (such as social media platforms). Like many website and app operators, we use digital service technologies like cookies (which are small data files transferred onto devices when a website or app is accessed), tags, and pixels (which ‘tag’ devices), or other similar technologies on our website and app that help us:

• Authenticate you.

• Maintain your browsing session and remember you and your preferences when you return.

• Monitor how you use our websites and apps, including the parts you visit and actions you take.

• Combine information with the Participating Brands and Partners.

• Provide you with offers and experiences that interest you from OnePass, Participating Brands, and Partners, both on the OnePass website and apps, and when you visit other websites and apps.

• Protect the security of our website, apps, and members and manage our network usage.

• Allow you to interact with social media platforms, for example by ‘liking’ and sharing our content.

We use cookies to help us collect data, which may include personal information. We will handle that personal information in the ways set out in this Privacy Policy. The cookies we use include ‘session’ cookies (which are retained only during a current browsing session) and ‘persistent’ cookies (which are retained by your device or browser between sessions).

Some of the digital service technologies used on our website and apps are created or set for third parties who provide content or services to us. These third parties include social media and online platforms such as Google Marketing Platforms, Meta (including Facebook and Instagram), Pinterest and Reddit, and digital marketing services, advertising networks, analytics providers and content providers. See below for further description of how we work with Google. We may use other third-party services in similar ways.

You can change your cookies settings on your web browser to block some cookies but, if you do, our website or app may not work as well for you. See www.allaboutcookies.org for more information on how to change your cookie settings for many common browsers, and to learn more about cookies generally.

If you are signed into your Google account when you use OnePass, then Google may also combine data from your Google account with data about your use of OnePass, to help identify you to be shown relevant OnePass advertising online, across your devices, and across the internet. For example, you may see advertising for OnePass, Participating Brands, and Partners on other websites you visit, based on the fact that you have visited this website. We use a range of Google services that help us monitor and more effectively display our advertising so that we can provide a better customer experience.

Google Analytics helps website owners measure how users interact with website content. For more information:

• About Google advertising cookies and Google Analytics cookies: google.com/policies/technologies/types/

• About Google’s Privacy Policy: www.google.com/policies/privacy/

• About how Google uses data when you use sites and apps that use Google technologies: www.google.com/policies/privacy/partners/

• On how to opt out of Google Analytics: tools.google.com/dlpage/gaoptout/

We work hard to keep your personal information safe and secure. This includes building our systems with your privacy and security in mind and implementing a range of security measures including:

• Maintaining an ongoing cyber security program and team.

• Controlling access to personal information through access and identity management systems.

• Implementing information security, privacy and confidentiality related policies and processes.

• Regularly reviewing our security program and controls to protect your personal information appropriately.

You can contact us here if you:

• Want to request access to the personal information we hold about you.

• Think any personal information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading and you want it corrected.

Please select “My Data & Privacy” and follow the prompts. You will need to include your name, contact details, and details of the personal information you want access to or would like corrected. We will then consider your request, and we may need to verify your identity. You can also contact us using the email address set out in the “Contact us” section below.

If you wish to make a complaint about how we have handled your personal information, you can contact us here. Please select “My Data & Privacy” and follow the prompts. You will need to include your name, contact details and details of your complaint.

We will respond to your complaint in a reasonable period of time. If you disagree with our response, we will provide you with information about what action you can take, including making a complaint to the Office of the Australian Information Commissioner (whose details are set out below).