1. General

   1. This Policy applies to personal information collected by Cara Luxe Stays Pty Ltd, ACN 701 248 008, when you visit our websites, make a booking, complete our guest check-in and verification process, communicate with us, or stay at accommodation we operate.

   2. In this Policy, we, us and our refer to Cara Luxe Stays Pty Ltd, and you refers to any person whose personal information we collect, including a guest who makes a booking and each person who stays at or visits a property with a guest.

   3. Website refers to caraluxestays.com.au, book.caraluxestays.com.au and any booking pages hosted for us by our booking system provider.

   4. Platform refers to a third-party accommodation booking platform through which you may book our accommodation, including Airbnb, Booking.com, Vrbo, Stayz and Google Vacation Rentals. Each Platform has its own privacy policy that applies to the information you give it.

   5. We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth), and we treat the identification and verification information described in clause 4 with the additional care that the Privacy Act requires for sensitive information.

   6. This Policy should be read with our Website and Direct Booking Terms and Conditions and the House Rules for the property you book.

2. Information We Collect

   1. We collect the following kinds of personal information, depending on how you deal with us:

      1. identity and contact details, including your name, email address, mobile number, residential address and, where required for verification, your date of birth;

      2. booking details, including the property, dates, number of guests, the names of the people in your party, the purpose of your stay, your estimated arrival time and any special requests;

      3. identification and verification information, described in clause 4;

      4. payment information, including the payment method you use and the transaction record. Your full card number and security code are collected and held by our payment processor, not by us;

      5. communications with us, including emails, messages sent through the Website or a Platform, text messages and call records;

      6. information about your stay, including check-in and check-out times, access code use, maintenance requests, and records and photographs relating to damage, an incident, a complaint or a dispute;

      7. reviews and feedback you give about your stay;

      8. marketing preferences and mailing list subscriptions; and

      9. technical information when you use the Website, including your IP address, device and browser type, the pages you view and cookie identifiers, described in clause 10.

   2. We collect personal information:

      1. directly from you, when you make a booking, complete the check-in and verification form, send us a contact form or message, subscribe to our mailing list, or stay with us;

      2. from a Platform, when you book through it, which sends us your name, contact details, booking details and any messages you send through the Platform;

      3. from our payment processor, which sends us confirmation of payment and a payment method reference;

      4. from our cleaning and maintenance contractors, where they report on the condition of a property after a stay; and

      5. automatically through the Website, using cookies and similar technologies.

   3. If you give us personal information about another person, such as the other members of your party, you must be authorised to do so and must tell that person about this Policy.

3. How We Use Your Information

   1. We use personal information to:

      1. process, confirm and administer your booking and payment;

      2. verify your identity and the identity of the person responsible for the booking;

      3. send you check-in instructions, access codes and information about the property and your stay;

      4. communicate with you before, during and after your stay, including about maintenance, emergencies and complaints;

      5. keep guests, neighbours and our properties safe, and prevent parties, unauthorised occupancy and fraud;

      6. assess and recover the cost of damage, excess cleaning or other charges, and resolve disputes and payment reversals;

      7. comply with our legal obligations, including under the NSW Code of Conduct for the Short-term Rental Accommodation Industry, tax and record-keeping laws, and the terms of our insurance;

      8. send you marketing communications;

      9. improve our accommodation, the Website and our guest communications; and

      10. respond to lawful requests from police, NSW Fair Trading or other authorities.

   2. We do not sell personal information, and we do not use identification documents for any purpose other than those described in clause 4.

4. Identification and Verification

   1. Before we release access information for a direct booking, and for some Platform bookings, we ask the guest responsible for the booking to complete a check-in and verification process through our booking system. The process may ask for:

      1. a copy or image of a current government-issued photo identification document, such as a driver licence or passport;

      2. where the property listing says it is required, a live photograph of you taken through the verification form, which is compared with your identification document to confirm that you are the person shown; and

      3. the names of the people who will stay at the property.

   2. We collect this information to confirm that the person who booked is the person who will stay, to deter fraudulent bookings and unauthorised parties, to protect our properties and neighbours, and to support any claim for damage or any report to police or an insurer.

   3. Where the process compares a live photograph with your identification document, the comparison uses biometric technology provided by our booking system provider. We collect that information only with your consent, which you give by completing that step. If you do not wish to provide it, contact us before check-in and we will offer an alternative way to verify your identity, which may include showing your identification document by video call or at check-in.

   4. Identification documents and live photographs are stored in our booking system provider's platform and are not saved to shared devices, shared mailboxes or messaging apps. Access is limited to the directors of Cara Luxe Stays.

   5. We delete identification documents and live photographs within 30 days after your check-out date, unless we need to keep them for a damage claim, a dispute, a payment reversal, an insurance claim or a legal requirement, in which case we delete them when that matter is resolved.

5. Who We Disclose Information To

   1. We disclose personal information to:

      1. our booking system provider, which hosts our booking pages, guest messaging, check-in and verification forms and guest records;

      2. our payment processor, which processes payments and refunds;

      3. the Platform through which you booked, including messages and reviews exchanged through it;

      4. our website hosting and email providers;

      5. our cleaning, maintenance and key management contractors, who receive only the information they need for your stay, such as arrival and departure dates and the number of guests, and not your identification documents;

      6. the owner or managing agent of a property we lease, who receives reports about the condition of the property and any damage but not your identity documents or contact details unless a claim requires it;

      7. our insurer, in connection with a claim;

      8. our accountants, lawyers and other professional advisers; and

      9. police, NSW Fair Trading, a local council or another authority, where the law requires or permits it, or where it is necessary to protect the safety of a person or property.

   2. If we sell or restructure our business, we may transfer guest records to the buyer or the new entity, which must handle them in accordance with this Policy.

6. Overseas Disclosure

   1. Some of the providers listed in clause 5 store or process information outside Australia.

7. Security

   1. We protect personal information by:

      1. storing guest records, identification documents and payment references in the systems of our booking system and payment providers, which use encryption and access controls, rather than on local devices;

      2. limiting access to guest records to the people who need it, and using individual logins and multi-factor authentication for our booking, payment and email accounts;

      3. keeping the computers and devices we use for the business updated and protected, and reviewing our security practices regularly; and

      4. deleting or de-identifying personal information when it is no longer needed.

   2. If we become aware of a data breach that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and we will tell you what happened and what you can do.

   3. No method of storage or transmission is completely secure. You should take care when sending personal information by email or message, and you should not send identification documents by email or text message unless we have asked you to use a secure link.

8. Retention

   1. We keep booking, payment and communication records for 7 years after your stay to meet our tax and record-keeping obligations and to deal with any claim or dispute.

   2. We keep identification documents and live photographs for the period described in clause 4.

   3. We keep records of a damage claim, incident or complaint for 7 years after the matter is resolved.

   4. We keep your details on our mailing list until you unsubscribe or ask us to remove them.

9. Cookies and Analytics

   1. The Website uses cookies and similar technologies that are necessary to operate the booking process, such as keeping your search and booking details as you move between pages.

   2. The Website may also use analytics and advertising cookies from third parties, including our website hosting provider's analytics, to understand how the Website is used and to show you advertisements for our accommodation on other websites and social media. These cookies collect your IP address, device information and the pages you visit.

   3. You can manage cookies through your browser settings. Disabling necessary cookies may prevent you from completing a booking.

10. Access, Correction and Deletion

    1. You may ask us for access to the personal information we hold about you, or ask us to correct it, by contacting us using the details in clause 14. We will respond within 30 days. We may ask you to verify your identity before we give access.

    2. You may ask us to delete personal information. We will delete it unless we need to keep it for a reason described in clause 8, in which case we will tell you why.

11. Complaints

    1. If you have a concern about how we have handled your personal information, contact us using the details in clause 14.

    2. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992.

12. Contact and Changes

    1. You can contact us about this Policy or your personal information at hello@caraluxestays.com.au.

    2. We may update this Policy from time to time. The current version is published on the Website with the date it took effect, and we will notify guests with a current booking of any change that affects how we handle their information.

​