AKIN Travel Loyalty Program – Privacy Policy

Introduction

AKIN Travel Pty Ltd (ABN 43 686 493 201) and its related bodies corporate, (AKIN, we, us or our) recognise the importance of protecting the privacy and the rights of individuals in relation to their personal information. This document is our privacy policy and it tells you how we collect and manage your personal information.

We respect your rights to privacy under the Privacy Act 1988 (Cth) (Privacy Act) and we comply with all of the Privacy Act’s requirements in respect of the collection, management and disclosure of your personal information. Where our Members are located in the European Union or United Kingdom, we also comply with the requirements of the EU General Data Protection Regulation (EU GDPR) and the UK General Data Protection Regulation (UK GDPR) respectively. Where our Members are located in California, we also comply with the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA).

Capitalised terms used in this document that are not otherwise defined have the meaning given to them in our AKIN Travel Loyalty Program – Customer Terms and Conditions.

Our core privacy promise

• We collect only the personal information that we genuinely need to run the AKIN Travel Loyalty Program and improve your experience.
• We do not sell your personal information to third parties — ever.
• We do not share your personal information with our Partners for their own marketing without your separate consent.
• You can access, correct, and request to delete your personal information at any time.
• Exercising your privacy rights will never affect your membership status or rewards.

What is your personal information?

When used in this privacy policy, the term “personal information” has the meaning given to it in the Privacy Act. In general terms, it is any information that can be used to personally identify you. This may include your name, address, telephone number, email address and profession or occupation. If the information we collect personally identifies you, or you are reasonably identifiable from it, the information will be considered personal information.

What personal information do we collect and hold?

We may collect the following types of personal information about you:

• your name, age and nationality;
• your profile photo;
• your contact details such as mailing or street address, email address, telephone number;
• if you are or have been a Member of our AKIN Travel Loyalty Program, your Membership Number, Membership Tier, your AKIN Points, the transactions relating to your AKIN Points, your Member Account and profile details and your stay and travel activities and history associated with your participation in the AKIN Travel Loyalty Program including your selected AKIN Benefits, your Origin Partner attribution, and any AKIN Points earned in the AKIN Travel Loyalty Program;
• if you use our AKIN Platform or mobile apps, all information that you upload or post on the AKIN Platform;
• if you are a job applicant, information that you or others provide in connection with your application;
• if you are our employee, information regarding your employment relationship with us, including your payroll details, tax file number, emergency contact and medical conditions, your performance appraisals and any information that you upload or store on our computers and networks;
• any additional information relating to you on social media that your social media privacy settings permit us to access;
• if you submit reviews, ratings or comments on the AKIN Platform (User Content), we collect and may publish that content in connection with the relevant Partner property. User Content is associated with your Member Account. Please do not include sensitive personal information (such as your home address, phone number or location details) in any User Content, as this information may be publicly visible to other platform users;
• any additional information relating to you that you provide to us, whether by email, on social media, online or in person; and
• information relating to you obtained from cookies, tracking pixels and similar tools as described below.

We may also collect some information that is not personal information because it does not identify you or anyone else. For example, we may collect anonymous answers to surveys or aggregated information about how users use our website.

How do we collect your personal information?

We generally collect your personal information directly from you unless it is unreasonable or impracticable to do so. When collecting personal information from you, we may collect in ways including:

• when you interact with us in person or online, engaging with our support centres, interacting with us on social media, our website, by email or other marketing and promotional activities;
• when you apply for and participate in our AKIN Travel Loyalty Program;
• when you interact with our AKIN Platform;
• during conversations with our representatives; and
• when you apply for employment, and as part of your employment relationship with us.

We may also collect personal information about you from third parties, such as:

• if one of our Members nominates you as the Member’s emergency contact;
• your booking details when you book with one of our Partners; and
• details of the AKIN Benefits that you redeem when staying with one of our Partners.

We may combine different information that we hold about you to create derived information about you.

Where a Partner or Partner staff member creates a Member Account on your behalf, that Partner is required under our Partner Terms and Conditions to obtain your consent before doing so. If you believe a Member Account has been created for you without your knowledge or consent, please contact us at privacy@akintravel.com and we will investigate and, if appropriate, delete the account.

If you provide us with personal information about a third party (for example if you provide your emergency contact), you must inform that person that their details have been provided to AKIN and that they are aware of this Privacy Policy.

Cookies and tracking technologies

In some cases we may also collect your personal information through the use of cookies and pixel tags on our website, mobile apps, email messages and advertisements.

The tracking technologies we place in our emails help measure the effectiveness of our email campaigns by identifying the individuals who interacted with the email and actions taken with the email, and device and browser information about the device used to deliver the email.

We use and disclose the information collected by these tracking technologies for the purposes of improving our platform, measuring the effectiveness of our communications, and delivering AKIN's own marketing communications to you through third-party advertising platforms (such as Meta and Google). Where we use third-party advertising platforms for this purpose, those platforms are contractually required to process your information only to deliver AKIN's communications to you and are not authorised by AKIN to use your information for their own advertising purposes or to build advertising profiles about you for use by others.

We do not sell your personal information to third parties, and we do not share your personal information with third parties for their own advertising or marketing purposes.

We may log IP addresses (that is, the electronic addresses of computers connected to the internet) to analyse trends, administer the website, track users movements, and gather broad demographic information. Full IP addresses are anonymised after 90 days and are not retained in identifiable form beyond that period.

What happens if we can’t collect your personal information?

If you do not provide us with the personal information described above, some or all of the following may happen:

• you may not be able to join our AKIN Travel Loyalty Program or use our AKIN Platform;
• we may not be able to connect your stay with our Partners to your Member Account and credit you with AKIN Points;
• we may not be able to contact you, and provide you with information that you may want;
• we may not be able to provide you with information about our latest offerings that may interest you; or
• we may be unable to tailor the content of our websites and AKIN Platform to your preferences and your experience of our AKIN Platform may not be as enjoyable or useful.

For what purposes do we collect, hold, use and disclose your personal information?

We collect personal information about you so that we can perform our business activities and functions and to operate our AKIN Travel Loyalty Program and AKIN Platform.

We collect, hold, use and disclose your personal information for the following purposes:

AKIN Travel Loyalty Program and other products and services

• to administer, maintain and improve our AKIN Travel Loyalty Program and your participation in the AKIN Travel Loyalty Program;
• to administer Origin Partner attribution including permanently recording the Origin Partner that signed you up to the AKIN Travel Loyalty Program;
• to operate and administer any white-label loyalty program powered by AKIN (such as Viajero Go) in which you choose to enrol;
• to enable authorised staff at AKIN Partner properties to access your Member Account for stay management and program administration, as described under ‘To whom may we disclose your information?’ below;
• to maintain audit logs of account activity, tier changes, and authorised staff access events, for security and regulatory compliance purposes;
• to operate, maintain and improve our AKIN Platform;
• to provide you with access to the AKIN Platform, benefits of our AKIN Travel Loyalty Program and Member support;
• to provide our other products and services to you from time to time;

Emergency contact details

• for emergency contact details that we hold, we will only use them for the purpose of contacting them in an emergency and no other purpose;

Communication and marketing

• to send communications (including direct marketing communications) requested by you or which you consent to receive;
• to answer enquiries and provide information or advice about our existing and new offerings;
• to maintain our customer relationship, and to provide customers with feedback opportunities;
• to provide you with marketing offers that may interest you, including offers relevant to your travel bookings or preferences and history;
• to carry out joint promotions with our Partners;
• to deliver AKIN’s own marketing communications to you through appropriate channels, including through third-party advertising platform acting as our service providers;
• to administer, evaluate and improve our online advertising campaigns, marketing messages and other marketing promotions;

Web, app and account features

• to operate the AKIN Platform, our websites and mobile apps, including online registration processes;
• to assess and improve the AKIN Platform, our website and mobile apps;

Insights, research and development

• to carry out data analysis and compile profiles and statistical reports in a non-identifying manner;
• to carry out data analysis and create derived information and insights about our members;
• to combine, compile and create non-identifying datasets;

Business processing

• to conduct our business processing and administrative functions;
• where you are our employee, to administer your employment relationship with us, including payroll and performance appraisals;
• to update our records and keep your information up to date;
• to process and respond to any complaint made by you; and
• to comply with any law, rule, regulation, lawful and binding determination, decision or direction of a regulator, or in co-operation with any governmental authority of any country.

Your personal information will not be shared, sold, rented or disclosed other than as described in this Privacy Policy.

Lawful basis for processing (EU and UK Members)

This section applies to Members located in the European Union or United Kingdom. Under the EU GDPR and UK GDPR, we are required to identify a lawful basis for each purpose for which we process your personal information. The table below sets out the lawful basis we rely on for each category of processing.

Where we rely on legitimate interests as our lawful basis, we have assessed that our interests are not overridden by your interests, rights or freedoms. You have the right to object to processing carried out on this basis — see 'Additional rights for EU, UK and California members' below. If you object, we will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests.

Where we rely on consent, you may withdraw it at any time by contacting us at privacy@akintravel.com or by using the unsubscribe facility in any marketing communication. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To whom may we disclose your information?

We may disclose your personal information:

• to our employees, related bodies corporate, contractors or service providers (such as organisations that host or operate our websites and mobile apps, send communications or perform data analytics on our behalf) who provide support and services to us so that we can operate our business;
• to companies with which we enter into business or marketing arrangements, such as to service providers who provide advertising delivery services on our behalf, as described in the Cookies and tracking technologies section above;
• to our professional advisors such as accountants, solicitors, business advisors and consultants who provide us with advice;
• to our Partners and their authorised staff, through the AKIN Partner Portal and/or an API connection to the Partner’s property management system, for the purpose of administering the AKIN Travel Loyalty Program. Partner staff may search for your details by name, email address or Membership Number, view your Membership Tier, contact details, and current and upcoming bookings at their properties, in order to provide you with AKIN Benefits during your stay. Partners are contractually prohibited from using this information for their own marketing without obtaining your separate consent. You should familiarise yourself with the privacy policies of the AKIN Partner properties you book with, as once your information is passed to them for the purpose of fulfilling your booking, it will be governed by their own privacy practices. We are not responsible for the privacy practices of Partner properties, which are independently owned and operated; and
• to any organisation for any authorised purpose with your consent.

We may provide aggregated, de-identified data and insights derived from Member activity to our Partners. This data is anonymised before sharing and is not in a form that can reasonably be used to identify any individual member. Partners are contractually prohibited from attempting to re-identify any Member from this data.

We may disclose information that is not your personal information (including non-identifying information that is compiled or derived from your personal information) to any person at our discretion.

Internal staff access and account impersonation

Authorised AKIN personnel (specifically those with Admin and Super Admin roles) may access Member Account data for customer support, dispute resolution, fraud investigation, technical troubleshooting, and regulatory compliance. In limited circumstances, authorised AKIN personnel may access your account in a supervised mode that allows them to view your account as you would see it. All such sessions are explicitly initiated, automatically terminated after 60 minutes, and fully and permanently audited, including the staff member’s identity, the duration of the session, and all actions taken.

Direct marketing materials

We will only send you direct marketing communications where you have expressly opted in to receive them. You may opt out of receiving marketing communications from us at any time by using the unsubscribe facility in any marketing communication or by contacting us using the details below. Opting out of marketing communications will not affect transactional communications necessary for your Membership (such as booking confirmations and account alerts).

How can you access and correct your personal information?

You may request access to any personal information we hold about you at any time by contacting us (see the details below). Where we hold information that you are entitled to access, we will try to provide you with suitable means of accessing it (for example, by mailing or emailing it to you). The first copy of your personal data will be provided free of charge, however for subsequent requests we may charge you a fee to cover our administrative and other reasonable costs in providing the information to you. We will not charge for simply making the request and will not charge for making any corrections to your personal information.

There may be instances where we cannot grant you access to the personal information we hold. For example, we may need to refuse access if granting access would interfere with the privacy of others or if it would result in a breach of confidentiality. If that happens, we will give you written reasons for any refusal.

If you believe that personal information we hold about you is incorrect, incomplete or inaccurate, then you may request us to amend it. We will consider if the information requires amendment. If we do not agree that there are grounds for amendment then we will add a note to the personal information stating that you disagree with it.

Additional rights for EU, UK and California members

For Members located in the EU or UK (GDPR / UK GDPR)

In addition to the rights described above, if you are located in the European Union or United Kingdom, you have the following rights in relation to your personal information: the right to erasure (‘right to be forgotten’); the right to restrict processing; the right to data portability (to receive your data in a structured, machine-readable format); the right to object to processing based on legitimate interests; the right not to be subject to solely automated decisions that have a legal or similarly significant effect on you without the ability to request human review (see ‘Automated decisions’ below); and the right to lodge a complaint with your national data protection supervisory authority (a list of EU authorities is available at edpb.europa.eu; the UK authority is the Information Commissioner’s Office at ico.org.uk).

For Members located in California (CCPA / CPRA)

If you are a California resident, you have the following additional rights: the right to know the categories of personal information we collect, the purposes for which it is used, and the parties to whom it is disclosed; the right to delete your personal information (subject to legal exceptions); the right to correct inaccurate personal information; the right to opt out of the sale or sharing of your personal information for cross-context behavioural advertising (we do not sell or share personal information for this purpose, so you have this right by default); the right to limit our use of sensitive personal information to that which is necessary to provide the service; and the right not to be discriminated against for exercising these rights. Exercising any of the above rights will not affect your AKIN Membership, Membership Tier, AKIN Points or AKIN Benefits.

What is the process for complaining about a breach of privacy?

If you believe that your privacy has been breached, please contact our Privacy Officer using the contact information below and provide details of the incident so that we can investigate it.

We request that complaints about breaches of privacy be made in writing to our Privacy Officer (using the contact details below), so we can be sure about the details of the complaint. We will attempt to confirm as appropriate and necessary with you your understanding of the conduct relevant to the complaint and what you expect as an outcome. We will inform you whether we will conduct an investigation, the name, title, and contact details of the investigating officer and the estimated completion date for the investigation process.

After we have completed our enquiries, we will contact you, usually in writing, to advise the outcome and invite a response to our conclusions about the complaint. If we receive a response from you, we will assess it and advise if we have changed our view.

If you are not satisfied with the way your privacy-related complaint is handled by us, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC). Details of how to lodge a complaint with the OAIC may be found at www.oaic.gov.au or by calling 1300 363 992.

White-label loyalty programs

AKIN powers white-label loyalty programs for select Partner chains. If you enrol in one of these programs, your AKIN Membership Tier, Origin Partner attribution, Membership Tier progression, and AKIN Points will be shared with that white-label Partner to power their branded loyalty interface. The white-label Partner’s platform will display both your white-label program tier and your underlying AKIN Membership Tier. Enrolment in a white-label program is voluntary and separate from your core AKIN Travel Loyalty Program membership. The terms, conditions and privacy policies of those Partners govern their white-label loyalty programs.

Do we disclose your personal information to anyone outside Australia?

We use online services (also known as cloud services) to operate our business. Your information may be disclosed to, or stored and processed in the United States, the European Economic Area and other locations where our service providers are located or maintain servers.

Some of our Partners and providers of AKIN Benefits may be located outside Australia, or may have service providers that are located outside Australia. Where your information is disclosed to these Partners and providers, your information may be disclosed to, or stored and processed in locations outside Australia. It is not practicable for us to specify those countries in this policy.

Where we transfer personal information from the European Economic Area or United Kingdom to countries without an adequacy decision, we rely on Standard Contractual Clauses approved by the European Commission or, for UK transfers, the UK International Data Transfer Agreement.

We take reasonable steps to ensure that the overseas recipients of your personal information do not breach the privacy obligations relating to your personal information.

Origin Partners

When you complete a stay from a booking made through the AKIN Platform, your Origin Partner receives some details regarding the booking and may receive a commission for that booking. Your Origin Partner does not receive your name, booking destination, dates, or profile information, only an anonymised commission report. Commission records are retained for 7 years for financial and tax compliance purposes.

Automated decisions

We employ the following automated decision making systems that may significantly affect the rights or interests of an individual. Where we use artificial intelligence tools provided by third-party service providers, we require those providers to process your personal information only in accordance with our instructions and applicable data protection laws. Third-party AI providers are contractually prohibited from using your personal information to train their own models or for any purpose beyond delivering the contracted service to AKIN.

Data retention

We retain your personal information for no longer than is necessary for the purposes described in this privacy policy, subject to our legal obligations. As a guide: active Membership Account data is retained for the duration of Membership plus 3 years after closure; booking and transaction records are retained for at least 7 years from the transaction date (for tax and financial regulatory compliance); audit logs of account activity and staff access events are retained for at least 7 years; marketing consent records are retained until consent is withdrawn plus 3 years; full IP addresses are anonymised after 90 days. Where you request deletion of your Membership Account, we will delete your personal information within 30 days except where we are required to retain it by law, in which case we will tell you what we have retained and why.

Security

We take reasonable steps to ensure your personal information is protected from misuse and loss and from unauthorised access, modification or disclosure. We may hold your information in either electronic or hard copy form. We take reasonable steps to securely destroy or de-identify personal information when no longer needed.

Our security measures include encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent); password hashing using industry-standard one-way algorithms (plain-text passwords are never stored); role-based access controls ensuring staff access only the data necessary for their role; full audit logging of all administrative actions and data access events; PCI-DSS compliant payment processing (full card data never passes through AKIN systems); and regular security assessments and penetration testing. In the event of a data breach that is likely to result in serious harm to you, we will notify the Office of the Australian Information Commissioner and will contact affected members directly, in accordance with our obligations under the Privacy Act 1988 (Cth). For EU and UK members, we will notify the relevant supervisory authority within 72 hours of becoming aware of a breach that is likely to result in a risk to your rights and freedoms.

Support call recording

With your consent, calls with our support team may be recorded and/or monitored for quality assurance, coaching and training purposes. As part of any recording, we may collect information such as the identity of the caller, the date and time of the call, and the subject matter of the enquiry. Any financial information discussed during a support call is not retained by AKIN.

Links

Our website and mobile apps may contain links to other websites operated by third parties. We make no representations or warranties in relation to the privacy practices of any third party website and we are not responsible for the privacy policies or the content of any third party website. Third party websites are responsible for informing you about their own privacy practices.

Contacting us

If you have any questions about this privacy policy, any concerns or a complaint regarding the treatment of your privacy or a possible breach of your privacy, please use the contact link on our website or contact our Privacy Officer using the details set out below.

We will treat your requests or complaints confidentially. Our representative will contact you within a reasonable time after receipt of your complaint to discuss your concerns and outline options regarding how they may be resolved. We will aim to ensure that your complaint is resolved in a timely and appropriate manner.

Please contact our Privacy Officer at:

Privacy Officer, AKIN Travel Pty Ltd. Post: West Carr and Harvey, East 13, Federal Mills Park, 33 Mackey Street, North Geelong, VIC 3215, Australia. Email: privacy@akintravel.com

Changes to our privacy policy

We may change this privacy policy from time to time. For material changes, that is, changes that affect your rights, how we use your personal information, or the parties to whom it is disclosed, we will notify you by email at least 30 days before the change takes effect and will display a prominent notice in your Member Account. Any updated versions of this privacy policy will be posted on the AKIN Platform. Previous versions are available on request.

This privacy policy was last updated on 31 May 2026.