OnePass Privacy Policy

When we refer to ‘personal information’ we mean information, or an opinion, about an individual who is reasonably identifiable, whether the information or opinion is true or not – this is basically how personal information is defined in the Australian Privacy Act.

We may share your personal information for the purposes set out in this Privacy Policy with:

• Participating Brands and Partners as set out in “How Participating Brands and Partners use your personal information” below

• Related Companies for the purposes outlined in “How Related Companies use your personal information” below

• Related Companies and trusted third parties for them to help us operate the OnePass program, provide OnePass or other benefits, and undertake communications and advertising (including as outlined in the “Marketing and personalisation of your experience” section below). These include:

  • Payment systems operators (such as merchants receiving card payments or payment processors such as Stripe)
    
  • Services providers and our Related Companies for application and product development and operations (including through AI), technical support, and processing, storing, hosting, and performing data analysis and matching
  • Social media, advertising and third-party platforms, such as Bing, Google Marketing Platforms, Meta (including Facebook and Instagram), Pinterest, Snapchat, TikTok and Reddit to support customer acquisition, engagement and support, and marketing, personalisation and advertising, and service providers that help manage social media presence
    
  • Our professional advisers, including those that assist with communicating our offers and promotions to you, product development and market research, or provide specialist advice such as lawyers or accountants.
    

Other third parties we share personal information with may include:

• Your representatives

• Government agencies, regulatory bodies, and law enforcement agencies, or as required or permitted by law

• Parties involved in business transfer transactions (and prospective transactions).

As mentioned in this Privacy Policy, we share and combine personal information with our Related Companies to enable us and them to undertake a range of important functions. The personal information that we share and combine with our Related Companies includes:
‍

• Information about your purchases, transaction history, and product and service preferences with OnePass, Participating Brands, Partners, and Related Companies

• Interactions with OnePass, Participating Brands, Partners, and Related Companies, including your activity on their websites and apps (such as your searches and browsing, products you view, add to your shopping cart and purchase), your communications with them (including via AI-enabled services such as chatbots), your interactions with them on social media or with their advertising and your device information like device ID, type and IP address.

We receive this information from the Participating Brands, Partners, and Related Companies through using cookies, tags, and pixels.

We may use this personal information (and disclose it to our Related Companies) for:

• Marketing, advertising, promotions and events (including the marketing and personalisation activities described below)

• Data monitoring, analysis and matching activities, monitoring and analysing trends in customer preferences or transactions and for the improvement, personalisation, operation and maintenance of our websites, apps or other online services

• Developing aggregated insights about customer preferences and research to better personalise our service offerings, advertising, and offers based on shopping and browsing habits

• Displaying advertising or content (including personalised advertising) that may be about OnePass, Participating Brands, Partners, Related Companies or other third parties, on or from third party platforms based on your personal information or preferences (eg on social media sites)

• For the purposes outlined in the “Digital service technologies” and “Marketing and personalisation of your experiences” sections below

• For other purposes where you have provided consent

• For other purposes described in this Privacy Policy.

We may also share your personal information with our Related Companies for them to use for the benefit of their own business in a manner consistent with the purposes outlined above. In some cases our Related Companies act as our agent or service provider.

Some of our service providers, including data storage and technology service providers, may be located or operate outside of Australia.

Where we share personal information overseas, we take steps to ensure that our service providers are obliged to protect this personal information in accordance with Australian legal requirements and that they are only permitted to use personal information for the purpose for which it is shared.

At times, our service providers may hold your personal information in a number of countries, including Canada, EU member states (including Belgium, Denmark, Finland, Germany, Ireland, Italy, Lithuania, Netherlands), Israel, Japan, Malaysia, the Philippines, Singapore, South Africa, the United Kingdom, and the United States of America.

When you join OnePass, based on the relationship between you and us, we will send direct marketing to you (subject to any applicable consents, account settings or marketing preferences that you may set, or if limited by law).

Participating Brands and Partners who you interact with as a OnePass member may also send direct marketing and advertising to you (subject to any applicable consents, account settings or marketing preferences that you may set, or if limited by law).  This includes when you link your OnePass account to them or scan your OnePass card, your linked Flybuys card at a Participating Brand (excluding InstantScripts and Priceline) or your linked Sister Club card at Priceline.

We may also collect, use and disclose information (including personal information) for marketing and advertising purposes.

This may include collecting your information from, and disclosing your information to, third parties such as:

• our Related Companies
• Flybuys and
• platforms (such as social media providers and other digital advertisers).

OnePass and those third parties may use this information for direct marketing and targeted advertising activities (subject to any applicable consents, account settings or marketing preferences that you may set, or if limited by law).

The types of products, services and offers that may be marketed and advertised to you are those we think may be of interest to you, and could include products, services and other offers:

• provided by us directly
• provided by our Related Companies or
• from other trusted third parties.

The marketing and advertisements you see may be tailored through the creation of audiences based on your use of OnePass or your involvement with Participating Brands, Partners, Related Companies or third parties, or your use of social media and other third-party platforms.

Where we use your personal information to send you direct marketing communications, we will provide you with an opportunity to opt out of receiving such communications (eg using the unsubscribe link or opt out details provided in the direct marketing communication, changing your preferences within your OnePass account or contacting OnePass customer support on the details below). If you prefer not to receive personalised in app messaging and content cards, the only way to opt out is to stop using the OnePass app. When you opt-out of direct marketing communications, we may still need to send you important factual messages about the services we provide.

If you want to stop receiving direct marketing from Related Companies or Partners you will need to contact them directly with your request, for example by clicking an unsubscribe link in a marketing email from them.

You may be able to limit personalisation of our website and app, and the advertisements you see (although you will still receive non-personalised ads) by:

• blocking the use of cookies (see the ‘Digital service technologies’ section below)

• using opt-out functionality provided by industry bodies such as optout.networkadvertising.org, optout.aboutads.info and youradchoices.com/appchoices

• opting out of Google Ads Personalisation: www.google.com/settings/ads

• opting out of Unified ID 2.0 (UID2) Personalisation: www.transparentadvertising.com

• changing your account settings on the third-party site or social media account
  

• using features provided by your device or browser, such as notification or push settings or incognito browsing.
  

In addition, our Related Companies and service providers may assist us in sales, analytics and management of our marketing and advertising activities.

We may collect information, including device information like device ID, type and IP address, and technical data, metadata, browsing information and location data (where available), when you use and access our digital services (i.e., websites, apps, or any of our search or chat functionalities such as Search with OnePass), including the digital services of our Participating Brands, Partners, Related Companies, and trusted third parties (such as social media platforms and other and other third-party platforms). This information may include personal information.

Like many website and app operators, we use digital service technologies like cookies (which are small data files transferred onto devices when a website or app is accessed), tags, pixels (which ‘tag’ devices), or other digital identifiers including those associated with tracking and advertising identifiers across these digital services that help us with a range of functions including to:

• authenticate you

• maintain your browsing session and remember you and your preferences when you return

• monitor how you use our websites and apps, including the parts you visit and actions you take

• combine information with the Participating Brands, Partners, Related Companies, trusted third parties, Suppliers and Service Providers

• provide you with advertising, offers, and experiences that may interest you from OnePass, Participating Brands, Partners, Related Companies, trusted third parties, Suppliers and Service Providers, both on the OnePass website and apps, and when you visit other websites and apps (such as social media and other third-party platforms) (see “Marketing and personalisation of your experiences” section for more information)

• protect the security of our website, apps, and members and manage our network usage

• allow you to interact with social media platforms, for example by ‘liking’ and sharing our content.

We use cookies to help us collect data, which may include personal information. We will handle that personal information in the ways set out in this Privacy Policy. The cookies we use include ‘session’ cookies (which are retained only during a current browsing session) and ‘persistent’ cookies (which are retained by your device or browser between sessions).

Some of the digital service technologies used on our website and apps are created or set for third parties who provide content or services to us. These third parties include, for example:

• social media and online platforms such as Bing, Google Marketing Platforms, Meta (including Facebook and Instagram), Pinterest, Snapchat, TikTok and Reddit, and
• digital marketing services, advertising networks, analytics providers and content providers.

We may use other third-party services in similar ways.

See below for further description of how we work with Google.

You can change your cookies settings on your web browser to block some cookies but, if you do, our website or app may not work as well for you. See www.allaboutcookies.org for more information on how to change your cookie settings for many common browsers, and to learn more about cookies generally.

If you are signed into your Google account when you use OnePass, then Google may also combine data from your Google account with data about your use of OnePass, to help identify you to be shown relevant OnePass advertising online, across your devices, and across the internet. For example, you may see advertising for OnePass, Participating Brands, and Partners on other websites and third-party platforms you visit based on the fact that you have visited this website. We use a range of Google services that help us monitor and more effectively display our advertising so that we can provide a better customer experience.

Google Analytics helps website owners measure how users interact with website content.
For more information:

• About Google advertising cookies and Google Analytics cookies: www.google.com/policies/technologies/types/

• About Google’s Privacy Policy: policies.google.com/privacy

• About how Google uses data when you use sites and apps that use Google technologies: policies.google.com/technologies/partner-sites

• On how to opt out of Google Analytics: tools.google.com/dlpage/gaoptout/

We work hard to keep your personal information safe and secure. This includes building our systems with your privacy and security in mind and implementing a range of security measures including:

• Maintaining an ongoing cyber security program and team

• Controlling access to personal information through access and identity management systems

• Implementing information security, privacy, and confidentiality related policies and processes

• Regularly reviewing our security program and controls to protect your personal information appropriately.

You can contact us here if you:

• Want to request access to the personal information we hold about you

• Think any personal information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading and you want it corrected.

Please select “My Data & Privacy” and follow the prompts. You will need to include your name, contact details, and details of the personal information you want access to or would like corrected. We will then consider your request, and we may need to verify your identity.

You can also contact us using the email address set out in the “Contact us” section below.

If you wish to make a complaint about how we have handled your personal information, you can contact us here. Please select “My Data & Privacy” and follow the prompts. You will need to include your name, contact details and details of your complaint.

We will respond to your complaint in a reasonable period of time. If you disagree with our response, we will provide you with information about what action you can take, including making a complaint to the Office of the Australian Information Commissioner (whose details are set out below).