Privacy Policy

Privacy Policy

Version: 1.0
Effective from: 24 September 2026
Last updated: 24 September 2026

This Privacy Policy explains how Wyndham Carols by Candlelight (“we”, “us” or “our”) collects, holds, uses and discloses personal information.

We aim to handle personal information transparently and consistently with the Privacy Act 1988 (Cth) and Australian Privacy Principles (“APPs”) where they apply to us.

OAIC guidance says an APP privacy policy should explain what information is collected, how and why it is handled, access and correction rights, complaints, and likely overseas disclosures.

1. Information We May Collect

Depending on how you interact with Wyndham Carols by Candlelight, we may collect information including:

  • your name;
  • email address;
  • telephone number;
  • postcode or general location;
  • ticket and order information;
  • names or details associated with tickets in an order;
  • enquiries, correspondence and feedback;
  • accessibility requirements you choose to provide;
  • competition or promotional-entry information;
  • newsletter subscription preferences;
  • marketing consent and unsubscribe preferences;
  • website referral and campaign information;
  • information submitted through website forms;
  • photographs, video or audio captured at the Event; and
  • technical information relating to use of our website.

We aim to collect only information reasonably necessary for our activities. Data minimisation is also reflected in current OAIC guidance concerning collection of personal information.

2. Ticketing and Payment Information

Our authorised ticketing provider may collect personal and payment information directly from ticket purchasers.

We may receive information necessary to administer Event tickets, such as:

  • purchaser name and contact details;
  • order and ticket numbers;
  • ticket type;
  • transaction status;
  • attendance or check-in information;
  • responses to Event-related checkout questions; and
  • referral or campaign information.

Full payment-card details are ordinarily processed by the relevant ticketing or payment provider rather than being stored by Wyndham Carols by Candlelight.

The ticketing provider’s own privacy policy and terms may also apply.

3. Accessibility Information

You may choose to provide information concerning accessibility requirements, including requirements relating to Auslan interpretation or reduced mobility.

Depending on the information provided, this may include sensitive or health-related information.

We will use accessibility information only where reasonably necessary for purposes such as:

  • planning accessible Event arrangements;
  • communicating relevant access information;
  • assisting you with your attendance;
  • managing safety or operational requirements; and
  • improving future Event accessibility.

Please provide only information necessary for us to understand or assist with your access requirements.

4. How We Collect Information

We may collect information when you:

  • obtain or use tickets;
  • visit our website;
  • submit a contact form;
  • subscribe to email updates;
  • enter a competition or promotion;
  • contact us by email or another communication channel;
  • respond to surveys or Event questions;
  • make an accessibility request;
  • attend the Event;
  • interact with an authorised ticketing provider in connection with the Event; or
  • interact with campaign, advertising or referral links associated with the Event.

Information may also be received from service providers acting on our behalf where appropriate.

5. Why We Use Personal Information

We may use personal information to:

  • issue and administer Event tickets;
  • manage admission and attendance;
  • communicate important Event information;
  • respond to enquiries and complaints;
  • administer refunds or other ticketing remedies;
  • provide accessibility support;
  • operate and improve our website;
  • measure marketing and campaign effectiveness;
  • administer promotions or competitions;
  • maintain Event safety and security;
  • manage lost property;
  • maintain appropriate organisational records;
  • undertake Event planning and evaluation; and
  • send marketing communications where permitted and appropriate.

We will not use sensitive information for unrelated marketing purposes without appropriate consent.

6. Operational Communications and Marketing

Purchasing a ticket may result in operational communications necessary to administer your booking and Event attendance, including:

  • ticket information;
  • weather and safety updates;
  • entry information;
  • Event changes;
  • cancellation information; and
  • refund or remedy information.

These communications are separate from optional marketing communications.

Where you separately subscribe or otherwise consent to receive marketing communications, we may send information about Wyndham Carols, future events, announcements, promotions and related activities.

You may unsubscribe from marketing communications at any time using the unsubscribe facility provided or by contacting us.

OAIC guidance requires a straightforward opt-out mechanism where personal information is used for direct marketing, and electronic marketing may also be subject to the Spam Act 2003

7. Website Analytics, Campaign Attribution and Cookies

Our website may use first-party cookies and similar technologies to:

  • remember website preferences;
  • maintain referral information;
  • understand where visitors came from;
  • record campaign attribution;
  • distinguish first-touch and more recent campaign interactions;
  • understand which website content or ticket links are used; and
  • improve website and marketing performance.

Campaign information may include parameters such as:

  • utm_source;
  • utm_medium;
  • utm_campaign;
  • utm_content;
  • utm_term; and
  • a Wyndham Carols referral identifier.

This information may be associated with a form submission or ticketing interaction where relevant.

We may also use website analytics or advertising services. Where third-party tracking or advertising technologies collect personal information, we will seek to use them transparently and provide controls where reasonably required.

OAIC guidance specifically identifies privacy considerations around tracking pixels and targeted advertising.

8. Photography and Video at the Event

Photography, video, audio recording and livestreaming may occur at Wyndham Carols.

Attendees may appear incidentally in crowd or Event recordings.

Images or recordings may be used for:

  • reporting;
  • archival purposes;
  • promotion of Wyndham Carols;
  • future Event communications;
  • website and social-media content; and
  • other communications relating to Wyndham Carols and its activities.

Where we specifically approach a person for an interview, testimonial, posed photograph or other prominently featured content, additional consent may be sought where appropriate.

9. Disclosure of Personal Information

We may disclose personal information where reasonably necessary to:

  • authorised ticketing or payment providers;
  • website, hosting and technology providers;
  • email and communications providers;
  • Event contractors and service providers;
  • security, first aid or emergency-management providers where appropriate;
  • professional advisers;
  • insurers;
  • Parks Victoria or other venue/land-management representatives where reasonably required;
  • government, regulatory, emergency or law-enforcement authorities where required or authorised by law; or
  • another organisation where you have consented or would reasonably expect the disclosure.

We do not sell personal information to advertisers.

We will not ordinarily provide ticket purchasers’ contact details to sponsors or partners for their independent marketing merely because they support the Event.

10. Third Party Embedding

Embedded content from other websites, such as YouTube videos, behave in the exact same way as if the visitor has visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

11. Overseas Processing

Some technology, communications, website, ticketing or cloud service providers may store or process information outside Australia.

The countries involved may vary depending upon the provider and its infrastructure.

Where the Privacy Act and APPs apply, we will take reasonable steps in relation to overseas disclosures as required by law.

If we can practicably identify likely overseas locations used by relevant providers, we may update this Policy to identify them.

12. Security and Retention

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

Personal information may be stored using systems operated by us or by contracted service providers.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, legitimate organisational requirements and applicable legal or recordkeeping obligations.

Where information is no longer required, we will take reasonable steps to destroy it or de-identify it where appropriate.

13. Access and Correction

You may request access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

We may need to verify your identity before processing a request.

In some circumstances access may lawfully be refused or limited. Where appropriate, we will explain the reason.

14. Privacy Enquiries and Complaints

If you have a privacy question, would like to request access or correction, or believe your personal information has been handled improperly, contact:

Privacy Officer / Wyndham Carols by Candlelight
Email: wyndhamcarols@wyndhamcarols.org.au
Website: www.wyndhamcarols.org.au

Please provide sufficient information for us to understand and investigate the matter.

We will seek to respond within a reasonable period.

If the Privacy Act applies and you remain dissatisfied after contacting us, you may also be entitled to make a complaint to the Office of the Australian Information Commissioner.

15. Changes to This Privacy Policy

We may update this Privacy Policy as our activities, technology, service providers or legal obligations change.

The current version and date of last update will be published on our website.