Privacy Policy

1. Who we are and what this policy covers

1.1 This policy explains how Perth Wildcats Pty Ltd (ABN 16 162 327 077), trading as the Perth Wildcats, of 201 Underwood Avenue, Floreat WA 6014 (postal: PO Box 455, Wembley WA 6913) (we, us, our) collects, holds, uses and discloses personal information through Wildnation, the corporate hospitality ticketing platform of the Perth Wildcats.

1.2 It covers the Wildnation website at wildnation.com.au, the Wildnation application at my.wildnation.com.au, any Wildnation mobile application, and the emails we send in connection with them.

1.3 It does not cover the Club's other websites, the Club's membership and general ticketing systems, Ticketek, or RAC Arena — each of those handles personal information under its own privacy policy. The Club's own privacy policy, available on wildcats.com.au, continues to apply to the Club's other activities; this policy governs personal information handled through the Platform.

1.4 Whether we handle information about you in our own right, or on behalf of the Club, depends on the arrangement between us and the Club: we handle personal information from the Platform in our own right, and we are accountable for it under the Privacy Act. Either way, the standards in this policy apply.

2. Our obligations under the Privacy Act

2.1 We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in it. Where we are not an APP entity in our own right, we comply with the APPs as if we were. We apply the APPs to all personal information handled through the Platform, whatever our turnover.

2.2 Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not.

2.3 Commercial electronic messages we send are also subject to the Spam Act 2003 (Cth). Clause 6 explains how we handle marketing.

3. What personal information we collect

3.1 Information you give us. Depending on your role:

• if you are a corporate client's contact person or manager: your name, your email address, the company you act for, and the content of messages you send us;
• if you are a manager entering guest details: the names of the guests you assign to seats, and any contact details you enter for them;
• if you complete a sign-up form: your post code, which is required for Australian users. For a manager account we hold your name, your email address, the company you act for and the credentials you use to sign in. For an attendee record we hold the guest's name, the seat assigned to them and, where the company provides one, an email address.

3.2 Information the Club gives us. Most of the information in the Platform reaches us from the Club rather than from you:

• the corporate client list and each client's contact person, from a Club-maintained spreadsheet;
• seat allocations, per-event seat counts and Club-assigned seat categories;
• ticket PDF files exported from Ticketek by Club staff, and the ticket details in them — including the event, the seat address in the form BOX43 · Row E · Seat 4, and the ticket barcode;
• parking pass files provided by Club staff. A parking pass identifies the pass, the event and the parking area, together with any name or vehicle registration the Club has entered on it.

3.3 Information we generate or derive.

• the seat assigned to a named guest, and the record of who assigned it and when;
• the ticket barcode as re-rendered by us — we read the numeric value printed on the source ticket and reproduce it, unaltered, in its original format;
• the tickets and files we generate for you to view or download, including PDF tickets;
• your country, auto-detected from your IP address at sign-up;
• records of emails we send you, such as the "your seat for…" seat-assignment email; and
• technical log information created when you use the Platform, which may include your IP address, browser and device type, the pages you view and the times you view them.

3.4 What we do not collect. The Platform does not take payments, and we do not collect credit card or bank details through it. We do not ask for your phone number. We do not intend to collect sensitive information (such as health, dietary or accessibility information) through the Platform. Dietary and accessibility requirements are not collected through the Platform: the Club handles those separately for its guest lists. We do not collect phone numbers.

3.5 If you choose not to give us information we ask for, we may not be able to allocate or issue a ticket to you or answer your enquiry.

4. Where your information comes from, and what that means

4.1 We collect personal information from you directly, from the Club and its staff, and from the corporate client you are associated with and its managers. We also derive information as described in clause 3.3.

4.2 If you are a guest, we usually did not collect your details from you. Your name and the seat assigned to you typically reach us because a manager at the company hosting you entered them, or because Club staff imported a ticket issued in your name. The first contact you have from us is usually the email telling you which seat you have been assigned.

4.3 Because of this, APP 5 requires the party that collects your details — the corporate client or the Club — to tell you at the time that your information is being given to us, and to make this policy available to you. Our terms of use require corporate clients to do that, and to confirm they are authorised to give us your details. If you received a seat assignment and were not told, please contact us using the details in clause 18 and we will tell you what we hold and who provided it.

4.4 We collect information from third parties only where it is reasonably necessary for one of the purposes in clause 5, or where you have consented.

5. Why we use your information

5.1 We use personal information to:

• set up and administer accounts for Club staff, corporate clients, managers and guests;
• record seat allocations to corporate clients, and record the guests those clients assign to seats;
• match tickets to the venue seat map and to Club-assigned seat categories, and identify duplicate, superseded or off-map tickets;
• make a ticket, including its barcode, available to the guest it is assigned to, in the Platform and as a downloadable file;
• distribute parking passes and other hospitality inclusions;
• send service emails — in particular the seat-assignment email, and emails about changes to your allocation, your account or an event;
• respond to enquiries and provide support, including helping the Club resolve a ticketing problem;
• keep the Platform secure, investigate suspected fraud or misuse of a ticket or barcode, and enforce our terms;
• maintain, troubleshoot and improve the Platform; and
• comply with our legal obligations.

5.2 We use your information for the purpose it was collected for, and for a related purpose you would reasonably expect. We will otherwise ask for your consent.

5.3 A post code and an IP-derived country are recorded at sign-up. The recorded reason for collecting a post code is marketing analysis. We use them for aggregate reporting on where our corporate contacts and guests are located, and to help the Club plan its hospitality and marketing activity. We do not use them to send you marketing unless you have opted in under clause 6.

6. Marketing and commercial messages

6.1 The seat-assignment email and other emails about your account, your allocation or an event are service messages. We send them because you have a ticket or an account, and you cannot opt out of them while you do.

6.2 We will only send you marketing about the Club, matches or hospitality offers if you have asked us to or agreed to receive it. Marketing is opt-in: we will not add you to a marketing list because you were assigned a seat. Where you give marketing consent, we record it against your account with the date and how you gave it.

6.3 Every marketing email we send will identify us, will include our contact details, and will contain a working unsubscribe link that we action promptly and in any event within five business days, as the Spam Act 2003 (Cth) requires.

6.4 You can opt out at any time by using the unsubscribe link or by contacting us under clause 18. Opting out of marketing does not stop service messages about a ticket you hold.

6.5 We do not sell personal information, and we do not disclose it to third parties for their own marketing.

7. Who we disclose your information to

7.1 The Club. Club staff with back-office access can see corporate clients, contact people, allocations, tickets, barcodes and guest assignments, so they can run corporate ticketing.

7.2 Your corporate client and its managers. If you are a guest, the company hosting you and its nominated managers can see your name, the seat assigned to you and your ticket, because they made the assignment and manage the allocation.

7.3 Service providers. We disclose personal information to providers who help us run the Platform, on the basis that they use it only for that purpose. These include:

• Google — Google Drive, Google Sheets and Google Groups are used in the ticketing workflow, so ticket PDFs, parking pass files and corporate client and allocation data are held in Google services;
• the Club's hosting and infrastructure providers, which operate the servers, database and file storage for the Platform;
• our transactional email provider, which delivers the seat-assignment and account emails on our behalf; and
• Google Analytics on the marketing website (clause 9), and the error-monitoring and support tools we use to keep the Platform working.

7.4 The venue. When a ticket is scanned at RAC Arena, the barcode is read by the venue's scanning system. Beyond that, we do not currently give the venue or its operator information about who holds a ticket. If the Club later gives the venue or its operator access to game-day information about ticket holders, we will update this policy before that access begins.

7.5 Ticketek. Ticketek issues the tickets the Platform distributes, and Club staff export them from Ticketek's systems into the Platform. That flow is one way: we do not send personal information from the Platform to Ticketek or TEG.

7.6 Where the law requires or allows it. We may disclose personal information where required or authorised by law, to a court, regulator or law enforcement agency, or where necessary to prevent a serious threat to a person's life, health or safety, or to investigate suspected unlawful activity.

7.7 Business changes. If the Platform or the Club's corporate ticketing operation is transferred to another entity, we may disclose personal information to that entity, subject to it handling the information in accordance with the Privacy Act.

8. Overseas disclosure and where your information is held

8.1 Personal information collected through the Platform is held on servers operated by the Club's hosting and infrastructure providers, with the primary hosting location in Australia. Ticket files, parking passes and corporate client data are also held in Google Workspace and Google Drive, as clause 7.3 describes.

8.2 Some of our service providers operate globally, so personal information may be stored or accessed outside Australia. These include Google (Workspace and Drive), and our hosting, content-delivery and email providers, which may store or access personal information in the United States.

8.3 Before disclosing personal information to an overseas recipient we take the reasonable steps APP 8.1 requires to ensure the recipient does not handle it in a way that would breach the APPs, or we rely on a permitted exception. If our providers or the countries they operate in change, we will update this clause.

8.4 You can ask us where your personal information is held, and which providers hold it, using the contact details in clause 18.

9. Cookies, analytics and tracking

9.1 We use cookies and similar technologies. In the application at my.wildnation.com.au we use only strictly necessary cookies: they keep you signed in, protect your session against cross-site request forgery, and remember settings as you move between pages. If you block them you will not be able to sign in.

9.2 On the marketing website at wildnation.com.au we use Google Analytics 4 to measure traffic in aggregate. It records the pages you view, how long you spend on them, your device and browser type, and the approximate location derived from your IP address. We use it to understand which pages are useful, not to identify you, and Google handles that information as a service provider to us.

9.3 We do not use advertising, remarketing or social media tracking cookies on the Platform, and we do not sell or share information collected by cookies for advertising.

9.4 You can control cookies through your browser settings, which let you block or delete them for particular sites or altogether. You can also opt out of Google Analytics on every website you visit by installing Google's Analytics opt-out browser add-on. Blocking strictly necessary cookies will stop the application working.

9.5 Separately from cookies, the Platform detects your country from your IP address at sign-up (clause 3.3), and our servers keep technical logs of Platform use. We keep those logs for the period set out in clause 11.

10. How we keep information secure

10.1 We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure, as APP 11 requires. In practice this means access control so that users see only their own company's allocations and guests, encryption of personal information in transit, back-office and administrative access restricted to the Club staff who need it, logging of administrative actions, and periodic review of who has access.

10.2 Ticket barcodes are treated as credentials: they admit a person to the venue, so we limit who can see them and ask you not to share or publish them.

10.3 No system is completely secure, and we cannot guarantee the security of information you send us over the internet or of any account whose credentials have been shared. Please tell us immediately if you think your account has been compromised.

10.4 Source ticket PDF files are also kept in Google Drive as a backup against system failure, so a copy of ticket information exists outside the application. Clause 11 explains what that means for deletion.

11. How long we keep information

11.1 We keep personal information only while we need it for a purpose in clause 5, or while we are required to keep it by law, after which we take reasonable steps to destroy it or de-identify it.

11.2 Our retention periods are:

• manager and other account records — while the company you act for holds an allocation, and then for 24 months;
• ticket, allocation and attendee records, including seat assignments — 7 years from the end of the season they relate to, for tax, record-keeping and dispute purposes;
• ticket PDF files and barcodes — 12 months after the event they relate to;
• parking pass files — 12 months after the event they relate to;
• system, security and email delivery logs — 12 months.

11.3 Copies of ticket files and corporate client data are also held in the Club's Google Drive as a backup against system failure, so a copy exists outside the application. Those copies are kept for the same periods as the records in clause 11.2 and are removed on the same basis.

11.4 Where you ask us to delete personal information and we are not required to keep it, we will action your request within 30 days and confirm what we have removed. We may keep information for longer where the law requires it, or where we need it for an actual or anticipated legal claim.

11.5 One operational limitation we want to be straight about. Removing a corporate client and its associated records is not a self-service function in the Platform: it is performed manually by the Club's developers, because removing a client that has allocations and assignments can break event records. Requests are handled case by case, and we will tell you what we can and cannot remove and when.

12. Accessing and correcting your information

12.1 You may ask us for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. These are your rights under APP 12 and APP 13.

12.2 Ask by contacting us using the details in clause 18. We may need to verify your identity first. We will respond within a reasonable period and in any event within 30 days.

12.3 We provide access free of charge, though we may charge a reasonable amount for the cost of giving access in a particular form. We will tell you any charge before we incur it.

12.4 If we refuse access or a correction, we will tell you why in writing and how to complain. Grounds for refusal are limited to those in the Privacy Act — for example where giving access would unreasonably affect another person's privacy, such as another guest's details in the same allocation.

12.5 Some information about you may be held by your corporate client or by the Club rather than only by us. If your request concerns information they control, we will tell you and, where we can, direct you to the right contact.

13. Complaints

13.1 If you are concerned about how we have collected or handled your personal information, contact us using the details in clause 18. Tell us what happened and what outcome you are looking for.

13.2 We will acknowledge your complaint promptly, investigate it, and respond to you in writing within 30 days. If we need longer we will tell you why and when to expect an answer.

13.3 If we cannot resolve your complaint, or you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner:

• online at oaic.gov.au
• by phone on 1300 363 992
• by post to GPO Box 5218, Sydney NSW 2001

14. Data breaches

14.1 We have a process for responding to actual or suspected data breaches, including containing the breach, assessing the risk of serious harm and notifying those affected.

14.2 If a breach is an eligible data breach under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth) — that is, one likely to result in serious harm and which we cannot remediate — we will notify affected individuals and the Australian Information Commissioner as soon as practicable, as the scheme requires.

14.3 Because a ticket barcode is an admission credential, unauthorised disclosure of barcodes will be assessed for serious harm alongside any disclosure of names and seat details, and may lead to tickets being reissued. Our data breach response plan is owned by the Club's platform team. It covers containing the breach, assessing the risk of serious harm, telling the Privacy Officer, and notifying affected individuals, the affected corporate client and the Commissioner where the scheme requires it.

15. Children and under-18 guests

15.1 The Platform is designed for use by adults. Manager accounts are for people aged 18 or over.

15.2 A corporate hospitality guest may be under 18 — for example a client's family guest at a match. Where a seat is assigned to a person under 18, we rely on the corporate client to have the consent of that person's parent or guardian before giving us their details, and we handle the information as we would any guest's. A person under 18 cannot hold a manager account. Where a seat is assigned to a guest under 18, the company hosting them should nominate a parent, guardian or one of its own managers to receive the seat-assignment email, and we do not knowingly collect personal information directly from a child.

16. Other websites and services

16.1 The Platform links to other services, including the Club's websites, Ticketek and the venue. We are not responsible for the collection, use, disclosure or security of personal information you give to a third party service, which is governed by that party's own privacy policy. Please read theirs before giving them your information.

17. Changes to this policy

17.1 We may update this policy from time to time — for example when the Platform changes, when we add a service provider, or when the law changes.

17.2 The current version is always published at wildnation.com.au/privacy with its effective date. Where a change materially affects how we handle your personal information, we will notify account holders by email.

17.3 This policy takes effect on the date it is published on wildnation.com.au.

18. How to contact us

18.1 For any question, access or correction request, or complaint about privacy:

• Privacy Officer: the Privacy Officer, privacy@wildcats.com.au
• Post: PO Box 455, Wembley WA 6913, or 201 Underwood Avenue, Floreat WA 6014
• Phone: (08) 6272 0777

18.2 If your question is about a ticket, a hospitality package or entry to the venue rather than privacy, contact the Club or the venue — those are handled under their terms, not ours.