1. Who we are
Gluten Free Getaways ("we", "us", "our") is a travel planning service based in Melbourne, Victoria, Australia. Our ABN is 49 223 734 373. We create custom travel itineraries for travelers who need to eat gluten free.
This policy explains what personal information we collect, why we collect it, how we use and protect it, and the choices you have. It applies to our website at www.gfgetaway.com, our intake forms, our email and phone communications, and the itineraries and planning services we deliver.
We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). Where the Act does not yet apply to a business of our size, we apply these standards voluntarily because of the sensitive nature of the health information our clients trust us with.
2. The information we collect
Information you give us directly
Contact and identity details. Name, email address, phone number, country or city of residence, and any name you prefer to be called.
Travel planning details. Destinations, travel dates, trip length, who is traveling with you, accommodation budget, travel style, must-do experiences, mobility or accessibility needs, and any bookings you have already made.
Health and dietary information. The nature of your gluten free requirement, including whether it is medical or dietary, how sensitive you are to cross-contamination, and any additional allergies, intolerances or dietary restrictions for you or the people traveling with you. Under Australian privacy law this is sensitive information and receives a higher level of protection. We collect it only with your consent, only because it is necessary to plan a trip that is safe for you, and we do not use it for any other purpose.
Payment information. If you purchase a service, payment is processed securely by our third party payment provider. We receive confirmation of payment and basic transaction details. We do not collect or store your full card number.
Correspondence. Emails, messages, planning call notes and feedback you send us.
Information collected automatically
When you visit our website we may collect technical information including IP address, browser and device type, referring page, pages viewed, and time spent on the site. This is collected through cookies and similar technologies, and through website analytics tools. Our website is hosted on Framer, which also processes limited technical data to deliver the site.
Some of this technical information can be linked to you as an individual, so we treat it as personal information.
Information from third parties
We may receive information about you from a travel companion who is booking on your behalf, or from a referral partner. If you give us information about another traveler, please make sure they are comfortable with you sharing it, including any dietary or health details.
3. Why we collect it and how we use it
We use your personal information to:
- Prepare your itinerary, research venues, and verify that restaurants and accommodations are safe for your level of gluten sensitivity
- Communicate with you about your enquiry, planning call, or trip in progress
- Make or advise on bookings and reservations where you have asked us to
- Process payments and issue invoices and receipts
- Improve our research process, our destination knowledge, and our website
- Send you marketing communications, if you have opted in
- Meet our legal, tax and record keeping obligations
We do not sell your personal information. We do not sell or rent our mailing list.
A note on health information. Your dietary and health details are used for one purpose: planning travel that is safe for you. We do not use them for marketing, we do not build health profiles, and we do not share them beyond what is described in the next section.
5. Overseas disclosure
Because we plan international travel, your personal information will usually be disclosed to recipients in the country or countries you are traveling to. The specific countries depend entirely on your trip, and we cannot list them in advance in a general policy.
Our technology providers may also store or process data in the United States, the European Union, and other jurisdictions.
Privacy protections in some of these countries may be weaker than those in Australia, and in some cases you may not be able to seek redress under the Privacy Act 1988 for the way an overseas recipient handles your information. By asking us to make a booking or a dietary request on your behalf, you consent to that disclosure.
If you would rather we did not contact a particular supplier directly, tell us and we will give you the wording to use yourself instead.
7. Marketing
If you subscribe to our mailing list, or become a client, we may send you destination guides, gluten free travel tips and occasional offers. Every marketing email includes an unsubscribe link, and we act on unsubscribes promptly, in line with the Spam Act 2003 (Cth).
Unsubscribing from marketing does not stop essential messages about a trip we are currently planning for you.
8. How we store and protect your information
We store personal information in secured cloud services with access limited to people who need it to do their job. We use measures including password protection, multi-factor authentication where available, encrypted transfer, and reputable providers with their own security controls.
No system is completely secure. If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required under the Notifiable Data Breaches scheme.
9. How long we keep it
We keep your personal information for as long as we need it for the purposes described above, and to meet our legal obligations. In practice:
- Enquiries that do not become bookings: 12 months, then deleted
- Client files and itineraries: 5 years after your trip, so we can support repeat travel and handle any dispute
- Financial records: at least 5 years, as required by Australian tax law
When information is no longer needed and we are not required to keep it, we delete or de-identify it.
10. Your rights and choices
You can ask us to:
- Access the personal information we hold about you
- Correct anything that is inaccurate, out of date or incomplete
- Delete your information, where we are not required to keep it
- Withdraw consent for us to hold your health and dietary information, though this will usually mean we can no longer plan your trip safely
- Stop marketing to you
Email us at hello@gfgetaway.com and we will respond within 30 days. There is no charge for making a request. If we refuse access or correction, we will explain why in writing and tell you how to complain.
You can deal with us anonymously or under a pseudonym for a general enquiry. Once you engage us to plan a trip, we need your real name to make bookings on your behalf.
11. Travelers in the EU, UK and elsewhere
If you are located in the European Union or the United Kingdom, you have additional rights under the GDPR and UK GDPR, including data portability and the right to object to certain processing. Our lawful bases for processing are your consent (for health and dietary information, and for marketing), performance of a contract (to deliver your itinerary), and our legitimate interests (to operate and improve our business). You may lodge a complaint with your local supervisory authority.
If you are located in California, you may have rights under the CCPA, including the right to know what we collect and to request deletion. We do not sell personal information as that term is defined under the CCPA.
To exercise any of these rights, email hello@gfgetaway.com.
12. Children
Our services are aimed at adults. We collect information about children only where a parent or guardian provides it as part of planning family travel, including a child's dietary needs. We do not knowingly collect information directly from children under 16.
13. Third party links
Our website and our itineraries link to restaurants, hotels, booking platforms and other third party sites. We are not responsible for their privacy practices, and this policy does not cover them. Please read their policies before providing information.
14. Changes to this policy
We may update this policy from time to time. The current version is always available at www.gfgetaway.com/privacy, with the effective date at the top. If we make a significant change to how we handle your information, we will tell you by email or with a notice on the site.
15. How to contact us or make a complaint
Questions, requests and privacy complaints can be sent to:
We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.
If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner: