Terms and Conditions | TAG Holiday Programs

Privacy Policy

TAG Holiday Programs Pty Ltd – Last updated August 2026

1. About this policy

TAG Holiday Programs Pty Ltd (ABN 33 697 558 268) runs school holiday sports programs for children aged 5 to 13 at venues across Victoria. To run those programs safely we need to collect information about your family, including health information about your child.

This policy explains what we collect, why we collect it, who we share it with, and the choices you have. We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

It applies to everyone who books a place, completes a registration form, subscribes to our emails, enquires about a school incursion, or visits our website.

You are welcome to contact us anonymously or under a pseudonym with a general enquiry. We cannot take a booking or accept a registration that way, because we cannot supervise a child safely without knowing who they are, who is collecting them and what medical needs they have.

Some parts of this policy work alongside our Terms and Conditions and our Child Protection Policy. Where that is the case, we say so and point you to the right clause.

2. What we collect and why

We collect five broad categories of information. Each one has a specific purpose.

2.1 Booking and payment information

What we collect: parent or guardian name, email address, phone number, the venue and days booked, order and invoice details, and any discount or credit applied.

Where it comes from: our website checkout, run on Wix. Payments are processed by Stripe or PayPal, depending on the method you choose. Your card details go directly to them. TAG never sees or stores your card number.

Why: to take and confirm your booking, apply the correct pricing, issue receipts and credits, and meet our tax and record-keeping obligations.

2.2 Child registration and program information

What we collect: your child's name, age or year level, school, and gender. Your child's allergies, medical conditions, dietary requirements, medications and any medical action plan. Behavioural or support needs you tell us about. The name and phone number of your emergency contacts and anyone authorised to collect your child. Which days your child is attending at which venue.

Where it comes from: the registration form you complete after checkout, run on Tally. We also collect information you give us by email or over the phone, and sign-in and sign-out records taken on the day.

Why: to supervise your child safely, respond correctly if they become unwell or have an allergic or asthma reaction, group children appropriately, run attendance rolls, and meet our duty of care.

Health, medical and behavioural information is sensitive information under the Privacy Act. Section 3 sets out how we handle it.

If you choose not to provide it. Allergy, medical and emergency contact details are required. We cannot accept a registration without them, because we cannot meet our duty of care to your child. Behavioural and support information is optional, but telling us helps our team support your child well.

2.3 Marketing information

What we collect: your email address, first name, the venues and programs you have booked or enquired about, and how you have engaged with our emails.

Where it comes from: our email sign-up forms, and from your booking where you have opted in.

Why: to send you information about upcoming programs at venues relevant to you. We use MailerLite, and our list is segmented by program and venue so you receive information about the venues you actually use rather than all of them.

We also send text message notifications about your booking, such as arrival reminders and last-minute program updates. These are opt-in, and you can opt out at any time. This is covered in clause 11 of our Terms and Conditions, and section 6 below explains how to opt out.

2.4 Website and advertising information

What we collect: pages viewed on our website, device and browser type, approximate location, referral source, and how you interact with our ads on Facebook and Instagram.

Where it comes from: Wix analytics and the Meta pixel installed on our website. Section 7 covers this in more detail.

Why: to understand which programs and venues families are looking at, and to show our ads to people who are likely to be interested. This includes retargeting people who have visited our website, and building audiences limited to the areas around our venues.

2.5 Photography and video

We photograph and film program activities for use on social media, our website, newsletters and other marketing materials.

General group and activity photography is covered by the consent you give when you book. Identifiable close-up images intended for paid advertising or printed marketing require separate approval from you first.

The full detail, including how to exclude your child and the notice period that applies, is set out in clause 10 (Photography and Video) of our Terms and Conditions. Please read that clause rather than relying on this summary.

3. How we handle health, medical and behavioural information

Information about your child's health, medical needs and behavioural support needs is sensitive information. It gets stricter treatment than everything else we hold.

We collect it with your consent. You give us this information on the registration form. By completing and submitting that form, you consent to us collecting your child's health, medical and behavioural information and using it for the purposes set out below. We ask only for what we need to keep your child safe, and we never use health information for marketing.

You can withdraw your consent at any time by contacting us. We may not be able to keep your child's place if we no longer hold the information we need to care for them safely.

We use it only for care and safety. That means administering or supervising medication, responding to an allergic reaction, asthma episode or injury, adjusting activities where needed, briefing the team before the day, and completing a Risk Minimisation Plan where one applies.

Access is limited to staff who need it. Program staff supervising your child on the day can see the medical and support information relevant to that child. This includes action plans and medication instructions carried with the group. Office staff who process registrations can see it in order to prepare rosters and briefings. Nobody outside those roles has access, except in the limited circumstances described in section 4. We never share it with other families or with other children's parents.

Medical action plans and identifiers. Some action plans include a Medicare number or similar government identifier. We hold those documents as provided, and we do not use or disclose government related identifiers except where the Privacy Act permits it.

We ask you to provide the physical items too. Where your child requires an adrenaline autoinjector such as an EpiPen, or an asthma puffer, that medication must arrive with them. This is set out in clause 7 (Additional and Medical Needs) of our Terms and Conditions.

4. Who we share information with

We do not sell personal information, and we do not share it for anyone else's marketing.

4.1 Venue partners

We run programs at host school venues including Carey Baptist Grammar School, Xavier College, Alphington Grammar School and Firbank Grammar School. We share limited information with venue staff for attendance and safety purposes only, such as the number and names of children on site, and any information a venue needs in an emergency or evacuation. Venue partners do not receive your information for their own marketing or enrolment purposes.

4.2 Service providers

We use third-party platforms to run the business. With the exception of Meta, these providers process information on our behalf and are bound to use it only for the services they provide to us.

Meta is different. When you interact with our website or our ads, Meta also uses that information for its own purposes under its own privacy terms, which you can read at facebook.com/privacy/policy. Section 7 explains what we send them and how to limit it.

Provider – What it handles – Where it stores data

Wix: Website, bookings and checkout – United States, Ireland, South Korea, Taiwan, Israel

Stripe: Card payments – United States and other countries

PayPal: Payments made through PayPal – United States and other countries

Tally: Child registration forms – Belgium

Supabase: Our booking and attendance database – Japan

Vercel: Hosting for our booking system – United States

Google Workspace and Google Sheets: Email, documents and day-to-day operational records – United States and other countries where Google operates

MailerLite: Email marketing – Germany and the Netherlands

Resend: Transactional emails such as booking confirmations – United States

Make.com: Automation between the systems above – European Union

Mobile Message: Text message notifications – Australia

Meta (Facebook and Instagram): Advertising, including retargeting and location-based audiences – United States and other countries

Overseas storage. As the table shows, most of these providers hold information outside Australia. Text messages are the only part that stays here.

We choose established providers and take reasonable steps to ensure they handle information consistently with the Australian Privacy Principles. Under section 16C of the Privacy Act we remain accountable to you for what these providers do with information we give them.

Providers occasionally change where they store data. If a change means your information moves to a country not listed above, we will update this policy.

4.3 Police and child protection authorities

In the rare situation where a child is not collected and we cannot reach you or any of your emergency contacts, we may need to contact Victoria Police or the After-Hours Child Protection Emergency Service at the Department of Families, Fairness and Housing. If that happens, we will share the information those agencies need to keep your child safe.

The timeframes and the steps we follow first are set out in clause 5d (Child not collected) of our Terms and Conditions.

4.4 Where the law requires it

We may also disclose information where we are required or authorised to do so by law, or where we reasonably believe it is necessary to prevent a serious threat to someone's life, health or safety.

5. How we store your information and how long we keep it

Storage. Information is held in the systems listed in section 4.2, protected by password access and multi-factor authentication where the platform supports it. Access is limited to the people who need it for their role. Paper records taken during a program, such as sign-in sheets and action plans, are kept with the program team during the day and transferred to secure digital records afterwards.

How long we keep it. We keep different records for different lengths of time.

Record – How long we keep it

Booking, payment and invoice records: 7 years from the end of the financial year, as required by Australian tax law

Registration details, including health and medical information: 3 years after your child last attends a program, so we can carry your details forward if you book again

Records relating to an injury, incident or child safety matter: Until the child turns 25, which reflects the time a person has to bring a claim about something that happened in childhood

Marketing contact details: Until you unsubscribe. We then keep a minimal record of your email address so we do not accidentally add you back

Website and advertising analytics: Held by Wix and Meta under their own retention settings, generally 24 months or less

When we no longer need information, we delete it or de-identify it.

Data breaches. If we suspect a data breach, we assess it within 30 days. Where we form a reasonable belief that the breach is likely to result in serious harm, we notify affected families and the Office of the Australian Information Commissioner as soon as practicable, as required under the Notifiable Data Breaches scheme.

6. Marketing and how to opt out

You will only receive marketing from us if you have opted in.

Email. Every email we send includes an unsubscribe link at the bottom. Clicking it removes you immediately. You can also email us and we will do it for you.

Text messages. Every SMS includes opt-out instructions. Replying with the stop word listed in the message removes you.

Where we got your details. If you receive marketing from us and are not sure how we got your details, ask and we will tell you where the information came from.

Advertising. You can limit how Meta uses your information for ad targeting through your Facebook and Instagram ad preferences, and you can hide or report individual ads. Section 7 covers how to limit tracking on our website.

Unsubscribing from marketing emails does not stop essential emails about a booking you have made, such as a confirmation, a venue change or a program cancellation. If you opt out of text messages, we will still send those updates by email.

7. Cookies and website tracking

Our website uses cookies and similar technologies.

Wix analytics cookies tell us how people find and move through the site, which pages and venues get the most interest, and whether bookings are being completed. This data is reported to us in aggregate.

Wix functional cookies keep your cart and session working during checkout. The site will not work properly without these.

The Meta pixel records actions taken on our website, such as viewing a program page or completing a booking. Meta uses this to measure how our ads perform and to build the retargeting and location-based audiences described in section 2.4.

Your choices. You can manage or block cookies through your browser settings, though blocking functional cookies will affect checkout. You can also adjust ad tracking through your Facebook and Instagram ad settings and through your device's tracking permissions.

8. Access, correction and complaints

Access. You can ask for a copy of the personal information we hold about you or your child. There is no charge for making a request, and we aim to respond within 30 days. We may need to confirm your identity first, and if there is a reason we cannot provide something we will tell you what it is in writing.

Correction. If information we hold is wrong, out of date or incomplete, tell us and we will fix it. This matters most for medical and emergency contact details, so please let us know as soon as those change rather than waiting for the next booking. If we decide not to make a correction, we will explain why in writing, tell you how to complain, and if you ask, attach a note to the record saying you believe it is inaccurate.

Deletion. You can ask us to delete information we no longer need. We will do this unless we are required to keep it, for example for tax or insurance reasons.

Complaints. If you are concerned about how we have handled your information, email us at info@tagholidayprograms.com.au with the subject line "Privacy complaint". We will acknowledge it within 5 business days and respond in full within 30 days.

If you are not satisfied with our response, you can take the matter to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992. Because we hold health information in Victoria, the Health Records Act 2001 (Vic) may also apply, and complaints about health information can be made to the Victorian Health Complaints Commissioner at hcc.vic.gov.au or on 1300 582 113.

All privacy requests and complaints go to Poppy Owen at info@tagholidayprograms.com.au.

9. Children's privacy

Most of the information we hold about children comes from you, their parent or guardian, and consent is given by you when you book and register.

Children attending our programs give information directly to staff in limited ways during the day, such as telling a staff member how they are feeling or who is picking them up. We use that only for their care on the day.

Our approach to child safety, including staff Working with Children Checks, supervision, and how we respond to a concern about a child's wellbeing, is set out separately in our Child Protection Policy. That policy takes precedence on child safety matters.

If you would like to see what we hold about your child, section 8 explains how to ask.

10. Changes to this policy

We may update this policy from time to time. The current version is always available on our website with the last updated date at the top. If we make a change that significantly affects how we handle your information, we will let you know by email.

11. Contact us

TAG Holiday Programs Pty Ltd

ABN 33 697 558 268

Email: info@tagholidayprograms.com.au Phone: +61 402 711 444

Privacy requests and complaints: Poppy Diviny, info@tagholidayprograms.com.au

Last updated: 6 August 2026