The types of Personal Information that we collect or request from you and how we collect or request this Personal Information will depend on who you are and how we are interacting with you. Typically this includes the following:

GeoSnapShot’s offering on our Platform may include our ‘Selfie-Search’ feature whereby you can upload a Selfie to the Platform, and quickly find other images that match you on the Platform. This feature is provided on the Platform using the AWS AI Service, which is provided by AWS, a third party provider, using Face Analysis.

In particular, when photos are uploaded to the Platform of Event Participants at events, the AWS AI Service automatically captures and stores biometric information related to that photo (i.e. the Face Analysis). This could include facial features that may be used to compare facial features with a Selfie uploaded by you for the purpose of finding photos that may contain a likeness to you quickly and easily. GeoSnapShot has no access to and does not collect, store or analyse any Face Analyses and all Face Analyses are collected, stored and analysed by AWS, our third party provider. GeoSnapShot does not, and has no way of correlating your Face Analysis with any other Personal Information handled or stored by GeoSnapShot.

The AWS AI Service is a universally trusted and secure partner for hosting global websites. As a managed service, the AWS AI Service is protected by AWS’ global network security procedures. Before uploading a Selfie you should feel comfortable with how the Face Analysis operates and you can find more information here https://docs.aws.amazon.com/ . By uploading a Selfie, you consent to AWS, collecting, using, disclosing, processing and otherwise handling your Selfie, Face Analysis (which is Sensitive Information) for the purpose of providing the AWS AI Service.

If you are providing Personal Information and/or Sensitive Information on behalf of someone else (for example if you are a Nominee), you must have the consent of that person to provide their Personal Information and/or Sensitive Information to us to be collected, used and disclosed in accordance with this Privacy Policy. You should also let them know about our Privacy Policy (including the information in this Privacy Policy). We may request evidence of this consent.

If you are providing Personal Information and/or Sensitive Information on behalf of a Minor, you must be that Minor’s parent or legal guardian and you must provide consent for the Minor’s Personal Information and/or Sensitive Information to be collected, used and disclosed in accordance with this Privacy Policy.

Most of the time, we will need your real name as it may not be practicable for us to deal with you anonymously or pseudonymously on an ongoing basis. For example, this includes when providing you with access to our Platform. This means that if we do not collect your Personal Information, we may not be able to provide you with the products and/or services you have asked for.

In some circumstances however, you have the option of not providing your name, or using a fake name, when you deal with us (where it is lawful and practicable). This includes for example, when you make a general enquiry via our Platform.

We collect Personal Information that is necessary to provide you with access to our Platform and its functionalities, and to carry out our business. Such purposes are set out in further detail in the table below:

We may share your Personal Information with third parties:

• for the reasons for which we collect, store and use that Personal Information (see above in section 10) which may include for direct marketing purposes where we have the necessary rights or consents or we are otherwise allowed to do so under applicable law;

• for other purposes explained at the time we collect your Personal Information;

• where we are otherwise allowed or required to do so under applicable law;

• to protect and defend the Platform;

• to prevent or investigate possible wrongdoing in connection with the Platform; or

• to protect the safety and wellbeing of Users or members of the public.

Some of the third parties we may share your Personal Information with include the following:

We generally collect your Personal Information in Australia. However, GeoSnapShot operates internationally and it is likely that we will share your Personal Information with overseas recipients located in the United States of America, the UK, Europe and Canada. These recipients include our Service Providers who may handle, process or store your Personal Information on our behalf.

For example, we may share your Personal Information with Service Providers who assist us with storing our data on secure data storage servers, or with improving our products and services (by analysing information and trends, such as Google Analytics).

We only ever share your Personal Information outside of Australia where we are permitted to do so under the Privacy Act. Generally this means we will take reasonable steps to ensure your Personal Information is treated securely and in accordance with the Privacy Act.

There are other circumstances where we may disclose your Personal Information to an overseas recipient. For example, where you have provided your consent or we are otherwise permitted to do so under other applicable laws.

When you provide your Personal Information to GeoSnapShot, we may use that Personal Information to send you direct marketing communications to keep you informed about our Platform and its functionalities, and as further described at section 10 for the different types of Users.

We may communicate with you (and send these electronic messages and tailored advertising) through various channels, such as via regular mail, email, SMS, telephone, the Platform including via push notifications or social media (including through targeted advertisements on certain websites and social media channels).

We will only send these communications in accordance with applicable privacy and marketing laws (such as the Privacy Act (including Australian Privacy Principle 7) and the Spam Act), and only where you have not opted out from receiving such communications from GeoSnapShot.

If you have indicated a preference for a method of communication, we will endeavour to use that method wherever practical to do so.

You are always in control of the direct marketing communications which you receive and can opt-out at any time. Generally you can opt-out by following the relevant opt-out or unsubscribe instructions in the relevant communication (such as in the email or SMS message).

You can also contact us using the detail set out in section 20 to tell us you would like to stop receiving direct marketing communications from us.

Importantly, regardless of whether you opt out from receiving any or all direct marketing communications, we will still communicate with you if we are required by law to provide you with information, or in relation to the services or products we are providing you with (for example, providing you with a purchase confirmation (if you are an Event Participant)).

When you use our websites or receive communications from us, Linked Sites may be included (and are provided for your convenience). You should make your own enquiries as to the privacy policies of these parties. We are not responsible for information on, or the privacy practices of, any Linked Sites.

You may visit our websites without identifying yourself. If you identify yourself (for example, by creating an online account or making an enquiry), any Personal Information you provide to us will be managed in accordance with this Privacy Policy.

We are committed to protecting your Personal Information, and ensuring that we securely store any Personal Information we collect (and in accordance with applicable privacy laws).

We take all reasonable steps to ensure that any Personal Information we collect, use or disclose is accurate, complete, up-to-date and stored in a secure environment protected from misuse, interference and loss, and from unauthorised access, modification or disclosure.

We store electronic records in secure databases, using trusted third party storage providers. Unless you require your Personal Information to be stored in the territory in which it is collected (for example, for legal and/or compliance reasons), our default position is that we will store Personal Information in the United States of America. If requested, we will provide our available storage options to you. We also maintain physical security measures in relation to storage of our electronic records (such as through locks and security systems at our electronic data stores).

Using technical methods, we also maintain computer and network security. For example, we use firewalls (security measures for the internet) and other security systems such as user identifiers and passwords to control access to our computer systems.

We will only keep your Personal Information we store for as long as is necessary for the purposes set out in this Privacy Policy or as required to comply with any applicable legal obligations, resolve disputes and enforce our legal agreements and policies.

When we no longer require your Personal Information (and in accordance with any applicable laws), we will take steps to delete, destroy or de-identify that information.

We may also retain your Usage Data for internal analysis purposes. However, Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or improve the functionality of our Platform, or if we are legally obligated to retain this data for longer periods of time.

You are entitled to request access to any of your Personal Information that we have. To make such a request, please contact us using the relevant contact details set out below in section 20.

We will take reasonable steps to ensure that the Personal Information we collect, use or disclose is accurate, complete and up-to-date. You can help us to do this by letting us know if you notice errors or discrepancies in the information we hold about you and informing us of any change in your personal details (for example, if your email address changes or if you move and change address).

If you consider any Personal Information we have about you is inaccurate, out-of-date, incomplete, irrelevant or misleading, you are also entitled to request correction of the information (again, please contact us using the relevant contact details set out in section 20). After receiving a request from you, we will take reasonable steps to correct your information.

We may decline your request to access or correct your Personal Information in certain circumstances in accordance with the applicable privacy laws. If we do refuse your request, we will provide you with a reason for our decision. In addition, in the case we refuse your request for correction, we will include a statement about your request with the Personal Information we store.

As outlined in this Privacy Policy, GeoSnapShot is a photo management platform which enables third parties such as Event Organisers and Photographers to upload photos of Event Participants to the Platform. GeoSnapShot is not responsible for any photographs or videos which have been taken or recorded at an event or subsequently uploaded to the Platform.

If you have any concerns in relation to the photos or videos which have been taken or recorded at an event or uploaded to the Platform, you may contact us at any time using the relevant contact details set out below in section 20 and we can provide you with the contact details of the relevant Event Organiser who will be able to assist you with your concerns or complaint.

In accordance with our Website Terms and Conditions which are available here, we reserve the right to remove any photographs or videos from our Platform where GeoSnapShot considers it reasonably necessary in the circumstances.

If you have any questions or concerns about this Privacy Policy or how we have handled your Personal Information, you may contact us at any time using the relevant contact details set out below in section 20.

Please also contact us if you have a complaint about privacy. If you make a complaint about privacy, the following will occur:

If you are not satisfied with our response to a complaint, or you consider that we may have breached the Privacy Act (including the Australian Privacy Principles), you are entitled to make a complaint to the Office of the Australian Information Commissioner (the Australian privacy regulator).

The Office of the Australian Information Commissioner can be contacted by telephone on 1300 363 992, or you can fill out this form to make a complaint about our handling of your Personal Information. Full contact details for the Office of the Australian Information Commissioner can be found online at www.oaic.gov.au .

We may make changes to this Privacy Policy from time to time, with or without notice to you. However, where we make a material change to the Privacy Policy, we will provide notice to you (including by updating our website, and, where appropriate, notifying you directly via email), prior to the change becoming effective. We recommend you visit this Privacy Policy regularly and check the “effective data” at the top of the Privacy Policy to keep up to date with any changes we make.

You can contact us using the details below: