PRIVACY POLICY

Last updated: 14 September 2026

Operated by Woolgarlo Leisure Resort Pty. Ltd. ATF Woolgarlo Management Trust ABN 31 375 170 375

1. ABOUT THIS POLICY

Lake Burrinjuck Resort is operated by Woolgarlo Leisure Resort Pty. Ltd. ATF Woolgarlo Management Trust ABN 31 375 170 375, of 590 Woolgarlo Road, Woolgarlo NSW 2582 ("Lake Burrinjuck Resort", "we", "us" or "our"). We respect the privacy of guests, visitors and people who interact with our business.

This Privacy Policy explains the kinds of personal information we collect and hold, how we collect, use, disclose and protect it, and how a person may request access or correction or make a privacy complaint.

We aim to handle personal information responsibly and, where applicable, in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles and other applicable laws.

2. PERSONAL INFORMATION WE MAY COLLECT

Depending on how you interact with us, we may collect:

• your name, postal address, telephone number and email address;

• booking details, arrival and departure dates, site or cabin information and booking history;

• the names, ages or other relevant details of people included in a booking where required for occupancy, pricing or safety purposes;

• vehicle, boat or trailer details, including registration details where required for access, identification or security;

• payment status, transaction references, invoices, refunds and other financial transaction information;

• communications with us, including enquiries, feedback, complaints and survey responses;

• information you choose to provide about accessibility, dietary or other requirements where reasonably necessary to provide the requested service;

• CCTV footage and security-related information where cameras operate;

• gate, key, code or access-control records where access-control systems are used;

• device, connection or network information generated when you use resort Wi-Fi, to the extent collected by our network systems;

• website, booking-page and cookie information, including analytics or advertising information where those tools are enabled and consent is required or obtained; and

• marketing preferences and records of consent or opt-out requests.

We do not require guests to provide more information than is reasonably necessary for the relevant purpose.

3. HOW WE COLLECT INFORMATION

We may collect personal information directly from you when you:

• make, change or cancel a booking;

• check in or register as a guest or visitor;

• contact us by phone, email, website form, SMS, social media or in person;

• make a payment or request a refund;

• use resort facilities, Wi-Fi, gate or access systems;

• enter a competition, promotion or survey; or

• subscribe to or interact with marketing communications.

We may also receive information from an authorised person making a booking on your behalf, a third-party booking service, Camper BMS, a payment provider, or another service provider involved in providing your booking or stay.

4. CAMPER BMS AND BOOKING INFORMATION

We use Camper BMS, operated by Pillarbit Software Pty Ltd, as a booking and property-management platform.

Information entered into our Camper BMS booking process may be processed and stored by Camper BMS on our behalf in accordance with its service and data-processing arrangements.

We are responsible for deciding what guest information we collect through Camper BMS and for using that information appropriately.

We do not ask guests to enter full payment card numbers, bank account numbers, passport numbers, driver licence numbers or biometric information into general Camper BMS custom fields.

5. PAYMENTS

Payments may be processed by third-party payment providers connected to our booking or payment systems.

Lake Burrinjuck Resort does not need to store full card numbers in its general booking records. We may receive or retain payment status, transaction identifiers or tokenised payment references that allow authorised transactions, refunds, booking changes, incidentals or chargebacks to be managed securely.

Payment providers handle payment information under their own privacy and security terms.

6. WHY WE COLLECT, USE AND DISCLOSE PERSONAL INFORMATION

We may use personal information to:

• provide quotes, make and manage bookings and allocate accommodation or sites;

• confirm identity and guest details where reasonably necessary;

• process payments, deposits, refunds, invoices and chargebacks;

• communicate booking confirmations, arrival information, access information, safety notices and service updates;

• operate the resort and provide requested facilities or services;

• maintain guest, occupancy and transaction records;

• manage safety, security, emergencies, incidents, complaints and disputes;

• protect guests, staff, property and neighbouring land;

• administer access-control and security systems;

• provide and manage guest Wi-Fi;

• improve our services, website, booking process and guest experience;

• comply with legal, accounting, tax, insurance and regulatory obligations;

• prevent or investigate fraud, misuse, unlawful activity or breaches of resort rules; and

• send marketing communications where you have consented or where otherwise permitted by law.

If information reasonably required to provide a booking or service is not supplied, we may be unable to provide that booking or service.

7. WHO WE MAY DISCLOSE INFORMATION TO

Where reasonably necessary for the purposes described above, we may disclose personal information to:

• Camper BMS and other booking or property-management providers;

• payment processors and financial institutions;

• email, SMS, telecommunications, cloud-hosting, IT and cybersecurity providers;

• website, analytics or advertising providers where those services are enabled;

• accountants, auditors, insurers, professional advisers and contractors;

• service providers assisting with maintenance, security, access systems or guest services;

• emergency services, police, regulators, courts, tribunals or government authorities where required or authorised by law or reasonably necessary to address a serious safety issue; and

• another party with your consent or at your direction.

We do not sell guest personal information.

8. OVERSEAS PROCESSING AND DISCLOSURE

Some technology, payment, communications, analytics, cloud or other service providers may store or process information using infrastructure located outside Australia.

The countries involved may vary depending on the provider and its infrastructure. Where the Privacy Act requires us to do so, we will take reasonable steps in relation to overseas disclosures and, where practicable, identify relevant countries in this policy or in a collection notice.

9. CCTV, SECURITY AND ACCESS RECORDS

CCTV may operate in parts of Lake Burrinjuck Resort for safety, security, incident investigation and property protection.

CCTV is not intended to monitor areas where a person would reasonably expect privacy.

Where gate, keypad, key, code or other access-control systems are used, those systems may record access events, dates, times, credentials or vehicle information necessary to manage access and security.

Security information may be reviewed following an incident and may be provided to police, emergency services, insurers or other authorised persons where permitted or required by law.

10. WEBSITE, COOKIES, ANALYTICS AND WI-FI

Our website and booking pages may use cookies or similar technologies needed to operate booking and website functions.

Optional analytics or advertising technologies may also be used where enabled. Where consent is required, non-essential tracking should only be activated after the required consent has been obtained.

If you use resort Wi-Fi, technical information such as device identifiers, IP addresses, connection times, traffic volumes or security events may be generated by network equipment or service providers. We use this information only as reasonably necessary to operate, secure and troubleshoot the network and enforce applicable usage conditions.

11. DIRECT MARKETING

We may send marketing information about Lake Burrinjuck Resort where you have consented or where otherwise permitted by law.

You may opt out at any time using an unsubscribe facility in the communication or by contacting us. Service messages relating to an existing booking, safety issue or transaction are not marketing messages and may still be sent where necessary.

12. SENSITIVE INFORMATION

We do not seek to collect sensitive information unless it is reasonably necessary for a legitimate purpose and we have the consent or other legal authority required to collect it.

For example, a guest may voluntarily provide limited health or accessibility information so we can consider an accessibility request or assist with a particular need. Such information will be handled with additional care and only used for the relevant purpose or as otherwise permitted by law.

13. STORAGE, SECURITY AND RETENTION

We use reasonable administrative, technical and physical safeguards appropriate to the nature of the information we hold. These may include restricted staff access, account security controls, secure service providers and other measures designed to reduce the risk of misuse, interference, loss or unauthorised access, modification or disclosure.

No electronic system can be guaranteed to be completely secure.

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, accounting, tax, insurance, dispute-resolution and record-keeping requirements.

Some records held by third-party providers, including booking and financial records, may be retained under those providers' applicable retention arrangements. We also maintain independent records where required for our business or legal obligations.

When personal information is no longer reasonably required, we will take reasonable steps to delete, destroy or de-identify it where appropriate and legally permitted.

14. ACCESS AND CORRECTION

You may request access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

We may need to verify your identity before providing access or making a correction. In some circumstances the law may permit or require us to refuse access, in which case we will explain the reason where required.

15. PRIVACY QUESTIONS AND COMPLAINTS

If you have a question, want to request access or correction, or wish to make a privacy complaint, contact:

Privacy Contact Lake Burrinjuck Resort Woolgarlo Leisure Resort Pty. Ltd. ATF Woolgarlo Management Trust ABN 31 375 170 375 590 Woolgarlo Road Woolgarlo NSW 2582 Website: lakeburrinjuck.com.au

Please provide enough information for us to understand and investigate the issue. We will aim to acknowledge and respond to privacy complaints within a reasonable time.

If the Privacy Act applies to us and you are not satisfied with our response, you may have the right to complain to the Office of the Australian Information Commissioner.

16. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes to our systems, service providers, legal obligations or business practices.

The current version should be made available through our website and/or booking process, with the date of the most recent update shown at the top.