1. About this policy and who we are
This policy explains how Fastrack Group Pty Ltd ABN 80105209679, trading as Fastrack Digital Fastrack, we, us, our, collects, uses, stores and discloses personal information. We are a digital strategy and marketing agency based at Level 11, 458 Brunswick Street, Fortitude Valley QLD 4006. Our New Zealand clients contract with our related company, Fastrack Group Limited NZBN 109 077 542. In this policy, Fastrack, we, us and our include both companies. Section 12 sets out how we meet New Zealand privacy law.
We handle personal information in line with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs). Where we deal with individuals in the European Union or United Kingdom, we also apply the General Data Protection Regulation (GDPR) and UK GDPR as relevant.
This policy applies to:
For Client Data, our client is usually responsible for having collected it lawfully and for telling individuals how it will be used. We handle Client Data only to deliver our services to that client, under our agreement with them and this policy.
We may update this policy from time to time. The current version is always on our website, with the date it took effect.
2. What personal information we collect
We collect only what we reasonably need for our business. Depending on how you deal with us, this may include:
|
Category |
Examples |
|---|---|
|
Contact details |
Name, job title, business, email, phone, postal address |
|
Account and project details |
Logins to our platforms, client briefs, approvals, correspondence |
|
Marketing and event data |
Webinar registrations, attendance, email opens and clicks, survey responses |
|
Website and device data |
IP address, browser, device, pages viewed, referring site, cookie identifiers, approximate location |
|
Billing details |
Invoicing contacts and payment records (card details are handled by our payment provider) |
|
Recruitment data |
CVs, references and interview notes |
|
Client Data |
Data a client gives us or lets us access, such as guest names, emails, booking history, CRM records, advertising audiences, analytics and social media account data |
We do not intend to collect sensitive information (such as health, racial or ethnic origin, religious beliefs or criminal records). If a client's data set contains it, we handle it only as needed for the services and with the client's authority.
You can deal with us anonymously or under a pseudonym where that is practical, such as general enquiries. For most services we will need to know who you are.
3. How we collect it
We collect personal information:
If we receive personal information we did not ask for, we will decide within a reasonable time whether we could have collected it lawfully. If not, we will destroy or de-identify it where lawful and reasonable.
4. How we use personal information
We use personal information to:
We use Client Data only for the purposes our client has engaged us for, and not to market our own services to that client's customers.
We will use or disclose personal information for another purpose only if you consent, you would reasonably expect it and it is related to the original purpose, or the law requires or allows it.
5. How we use AI, including Claude
We use artificial intelligence tools to work faster and deliver better results for clients. Our main AI tool is Claude, provided by Anthropic PBC (USA). We access Claude under Anthropic's commercial terms, which prohibit Anthropic from using our content, including Client Data, to train its AI models.
What we use AI for
What personal information may be processed by AI
AI tools may process business contact details, project correspondence and aggregated or de-identified Client Data, such as booking, search and campaign performance figures. We do not input named hotel or other guest records or other identifiable guest information into AI tools. We do not knowingly input sensitive information into AI tools.
Our safeguards
Automated decisions
We do not use AI or other computer programs to make decisions that significantly affect your rights or interests without human involvement. AI may help us segment audiences, score leads or recommend which campaign or content to run, but these outputs are reviewed by our team and do not determine anyone's legal rights, access to services or prices. Advertising platforms such as Meta, Google and LinkedIn use their own automated systems to decide which ads you see; those are governed by their privacy policies.
Accuracy
AI output can be wrong. We take reasonable steps to check the accuracy of personal information we use, and you can ask us to correct it (section 11).
6. Where we store data and overseas disclosure
We store personal information, including Client Data processed through our AI tools and internal systems, in a cloud database operated by Supabase Inc. Our main Supabase environment is hosted in Sydney, Australia. Supabase encrypts data in transit and at rest, and access is limited to authorised Fastrack staff and systems.
Some of our service providers store or process personal information outside Australia. The countries most likely to be involved are:
|
Provider |
Purpose |
Likely locations |
|---|---|---|
|
Anthropic (Claude) |
AI processing |
United States |
|
Supabase |
Database hosting |
Australia |
|
Google (Workspace, Analytics, Ads) |
Email, documents, analytics, advertising |
United States and other countries |
|
Meta (Facebook, Instagram) |
Advertising and social media |
United States, Ireland |
|
|
Advertising and social media |
United States, Ireland |
|
Email marketing and CRM platforms |
Newsletters and contact management |
United States |
Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs. We do this by using reputable providers with contractual data protection terms, security commitments and, where offered, data processing agreements. Under the Privacy Act we remain accountable for how these providers handle personal information we disclose to them, except where an exception applies.
Where a client requires its data to stay in Australia, we will agree that with the client in writing.
7. Disclosure to third parties
We do not sell personal information. We may disclose it to:
We disclose Client Data only to deliver services to that client or as the client directs.
8. Cookies, analytics and advertising
Our websites use cookies, pixels and similar technologies to make the site work, understand how it is used and measure our marketing. These may include:
These providers may combine information from our site with information they already hold about you, under their own privacy policies.
You can block or delete cookies through your browser settings, although some parts of the site may not work properly. You can also manage advertising preferences through Google Ads Settings, Meta and LinkedIn account settings, or opt out of Google Analytics with the Google Analytics opt-out add-on.
9. Direct marketing
We may send you newsletters, webinar invitations and information about our services where you have consented, or where you would reasonably expect it, such as when you are a client or have attended our events. We comply with the Spam Act 2003 (Cth).
Every marketing email includes an unsubscribe link. You can also opt out at any time by contacting us (section 11). We may use email tracking to see whether messages are opened and which links are clicked, so we can improve our communications.
10. Security, retention and data breaches
We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss and unauthorised access, change or disclosure. These include encryption, multi-factor authentication, role-based access, approved-tool rules for AI, and staff confidentiality obligations.
We keep personal information only as long as we need it for the purposes in this policy or as the law requires (for example, tax records for at least five years). When a client engagement ends, we return or delete that client's Client Data, including copies in our database and AI workspaces, within 90 days unless the client agrees otherwise or the law requires us to keep it. Unsuccessful job applications are deleted within six months.
If we have a data breach likely to cause serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme. If the breach involves Client Data, we will also tell the affected client promptly so it can meet its own obligations.
11. Access, correction, complaints and contact
You can ask to access or correct the personal information we hold about you. We will respond within 30 days and will not charge you for making a request. If we refuse, we will explain why in writing and tell you how to complain. If your request relates to Client Data, we may refer you to the relevant client and will help them respond.
If you are in the EU or UK, you also have rights to erasure, restriction, portability and to object to processing, as provided by the GDPR.
Complaints. If you believe we have breached your privacy, please contact our Privacy Officer in writing. We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner on 1300 363 992.
Contact our Privacy Officer
12. New Zealand
This section applies if you are in New Zealand, or if we handle your personal information for a New Zealand client. In those cases we also comply with the Privacy Act 2020 (NZ) and its Information Privacy Principles (IPPs). Where New Zealand law gives you stronger protection than this policy, New Zealand law applies.
Who is responsible. [Fastrack Digital NZ Limited] is responsible for personal information collected for its New Zealand clients. All services are performed for it by our team in Australia, which holds and processes that information on the New Zealand company's behalf and only for its purposes. The New Zealand company remains accountable for it under the Privacy Act 2020.
Information sent overseas. New Zealand personal information is handled in Australia and by the service providers listed in section 6, including in the United States. We use providers that handle the information only to provide their service to us, or that give safeguards comparable to New Zealand law, such as contractual data protection terms. We do not let them use it for their own purposes, including training AI models.
Information we collect from others. From 1 May 2026, IPP 3A requires us to tell you when we collect your personal information from someone other than you. Usually a client gives us your information, and the client tells you how it will be used, including by service providers like us. Where that has not happened, this policy is our notice to you, unless an exception in the Privacy Act applies.
Access and correction. You can ask to access or correct your personal information. We will respond within 20 working days and will not charge you for access.
Privacy breaches. If a privacy breach causes or is likely to cause you serious harm, we will notify you and the New Zealand Privacy Commissioner as soon as practicable.
Marketing. Our marketing messages to New Zealand recipients comply with the Unsolicited Electronic Messages Act 2007 (NZ) and always include an unsubscribe option.
Complaints. Contact our Privacy Officer using the details in section 11. If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner on 0800 803 909.