Privacy Policy

Beyond The Valley Music Festival Pty Ltd (ACN 169 612 159) ATF The Trustee for Beyond The Valley Music Festival Unit Trust and its Related Bodies Corporate ("us", "we" or "our") and/or our subsidiaries or affiliates use, collect, store and disclose information supplied to us in connection with our products or services, whether that be through attending our events, interacting with our website located at

‍https://www.beyondthevalley.com.au or any other website, application or online platform operated or controlled by us or any of our Related Bodies Corporate from time to time (including, without limitation, the websites for our festivals and events) (together, the "Sites"), or by contacting us in person, by phone, or over email (we will refer to the foregoing collectively as the "Services").

This Privacy Policy details how we comply with the Privacy Act 1988 (Cth) ("Privacy Act") and the Australian Privacy Principles ("APPs") set out in Schedule 1 of the Privacy Act.

We may update this Privacy Policy from time to time at our sole discretion. Any variations become effective on posting the updated privacy policy to https://www.beyondthevalley.com.au and we shall have no obligation to provide you with individual notice of such changes. Your continued use of our products and services following the publication of any amended Privacy Policy shall signify your acceptance of that amended Privacy Policy, except where we are otherwise required by law to seek your direct consent.

PLEASE READ THIS PRIVACY POLICY CAREFULLY. IF YOU DO NOT AGREE WITH ANY PART OF THIS PRIVACY POLICY, PLEASE DO NOT BROWSE, ACCESS OR USE OUR SITES; MAKE A PURCHASE; ATTEND OR PURCHASE A TICKET TO OUR FESTIVALS OR EVENTS; OR OTHERWISE ENGAGE WITH OUR PRODUCTS AND SERVICES.

Types of information we collect

"Personal Data" means Usage Information that can be used to identify you in any way, together with your Personal Information. We will only collect Personal Data about you where it is reasonably necessary for, or directly related to, one or more of our functions or activities, and we will do so by lawful and fair means.

"Personal Information" means information that can be used to personally identify you, such as your name, age or date of birth, telephone number, address, email address, photographs or videos where you are personally identifiable, and in some circumstances financial information such as your credit card, direct debit or Paypal account information. If the information we collect personally identifies you or you are reasonably identifiable from it, the information will be considered Personal Information.

"Sensitive Information" is a special type of Personal Information that relates to health information, political beliefs, ethnicity, membership of a professional or trade association, gender, sexual preferences, philosophical beliefs, or criminal record. We will not collect Sensitive Information except with your express consent, and then only if collection of such information is necessary for a particular activity or function, or as otherwise permitted or required by law (including under the Permitted General Situations and Permitted Health Situations set out in the Privacy Act).

"Usage Information" means anonymous aggregate data that is automatically collected through your use of the Sites. This includes information that identifies your device, your operating system, your IP address and dates and times that you access and use the Sites. We recognise that Usage Information, whilst for the most part anonymous, can be cumulatively used to directly or indirectly identify you.

Why we collect your Personal Data

The primary purposes for which we collect information about you are to enable us to:

• perform our business activities and functions;
• provide the Services to you; and
• ensure the health and safety of our workers and attendees (including you).

Other legitimate purposes that you agree we can collect, hold, use and disclose your Personal Data for include but are not limited to the following:

• to provide you with access to the Sites;
• to approve transactions you wish to make;
• to send you invoices and receipts;
• to respond to requests submitted by you;
• to enhance our products and services;
• to verify your identity;
• for our administrative, planning, product/service development, quality control, safety, and research purposes, or those of our contractors or external service providers;
• to provide you with information about any festivals or events for which you have registered as an attendee whether by purchasing a ticket, registering for access, being registered as the holder of a ticket or minor pass, by having a ticket transferred to you or by any other means by which you may be registered as an attendee;
• to contact you with information which we think you may find interesting, only where you have opted in to receiving such communication and until you withdraw such consents;
• to run competitions, promotions, and giveaways;
• to comply with legal and regulatory requirements;
• to update and provide information to any third parties (including but not limited to Emergency Services Staff and insurers) as required by their policies and applicable regulations in connection with our events for health, safety and risk management purposes;
• to prevent, detect and investigate potential illegal activities, security breaches and fraud; and/or
• as otherwise required or permitted under any applicable law.

For the avoidance of doubt, we will only use your Personal Data for purposes that you would reasonably expect us to use your Personal Data for in connection with operating and providing the Services to you, or where we are required by law to collect your Personal Data. We will not sell, rent, or license your email address or any of your Personal Data, except where that activity falls within a purpose disclosed in this Privacy Policy or where we have otherwise obtained your express consent to do so.

We recognise your right under the Spam Act 2003 (Cth) to opt out from direct marketing, and as such these consents can be modified at any time by emailing us at hello@untitledgroup.com.au, or by clicking 'unsubscribe' on any direct marketing communications.

Please note certain non-marketing related correspondence from us, including messages relating to payment and confirmation, will be automatically sent to you by virtue of your use of the Services and you may not have the option to unsubscribe from receiving this correspondence.

How we collect your Personal Data

We collect your Personal Data directly from you, unless it is unreasonable or impractical to do so.

We do this in a number of ways, including:

• when you contact us by email, telephone or in writing;
• when you fill out a form on our Sites when completing an application or order;
• when you enter a competition or giveaway;
• when you subscribe to our mailing lists or other direct marketing communications;
• when you purchase a ticket, register for event access, transfer ticket registration, are registered as the recipient of a transferred ticket or are registered as the holder of a minor pass or registered as the child of a parent or legal guardian attending an event in respect of our festivals or events via one of our third-party ticket merchants or ticket resale merchants;
• recording or photographing you at our festivals or events; or
• interacting with our, or an event partner's, social media pages (for example, by following, commenting on, messaging, or otherwise engaging with our official social media accounts, or those of an artist, agent or business partner in connection with our festivals or events).

It is your choice to provide information to us. Wherever it is lawful and practicable, you have the option not to identify yourself when interacting with us. Please be aware that it is necessary for us to collect your Personal Data to enable us to provide the Services to you. As such, if you do not wish to provide your Personal Data, we may not be able to provide the Services to you.

Circumstances where we collect Personal Data about you from sources other than you directly include where:

• you have consented for a third party to share information with us;
• where we are authorised by law to collect the information from a third party;
• where it is unreasonable or impracticable to collect the information from you personally (for example, if you are an emergency contact for an attendee).

If we collect your Personal Data from third parties in circumstances where you may not be aware that we have collected such Personal Data, we will take reasonable steps to notify you of the collection and circumstances surrounding the collection.

We may also collect Personal Data from third parties including our contractors and business partners, third-party ticketing and ticket resale platforms, social media platforms, medical and emergency services providers ("Emergency Services Staff"), advertisers, mailing lists, recruitment agencies and government entities.

Where we receive unsolicited Personal Data about you that we did not request, we will assess whether we could have collected that information had we solicited it in accordance with this Privacy Policy. If we could not have done so, and the information is not contained in a Commonwealth record, we will destroy or de-identify that information as soon as practicable, provided it is lawful and reasonable for us to do so.

You expressly consent that we may collect your Sensitive Information from you, Emergency Services Staff or any necessary party in the event of:

• a permitted health situation (as defined by section 16B of the Privacy Act) ("Permitted Health Situation");
• an emergency, including but not limited to health emergency, injury, death or safety incident (e.g. if you injure yourself or lose consciousness) ("Emergency Incident"); or
• voluntary notification to us via email, telephone, in writing, or in person (e.g. if you notify us of accessibility requirements).

We do not use, adopt or disclose a government related identifier (such as your driver licence, Medicare or passport number) as our own identifier for you, except where permitted or required under the Privacy Act or other applicable law.

Cookies

We may collect Usage Information through cookies, pixel tags and other tracking technologies (collectively Cookies). Cookies are small packets of data that are downloaded onto your device when you access a website. Cookies hold specific information that help a website 'remember' your actions and preferences over time. These are the types of Cookies that we may use to operate the Sites:

• Strictly Necessary Cookies — these Cookies are essential to ensure that the Sites work correctly, and record information that allows you to move around the Sites and navigate their features;
• Performance Cookies — these Cookies collect information about how you use the Sites, such as how often you access the Sites and if you encounter any errors;
• Functionality Cookies — these Cookies allow the Sites to remember the choices you make to provide a more personalised experience;
• Targeting/Advertising Cookies — these Cookies deliver targeted advertising to you based on your interests and use of the Sites.

Cookies can stay on your device temporarily ("Session Cookies") or until you manually delete them ("Persistent Cookies"). Data collected by Cookies does not identify you, but it does identify your device. Where such data can be cumulatively used to personally identify you, we will handle that information in accordance with this Privacy Policy. You can disable Cookies at any time in your browser. If you disable Cookies, we cannot guarantee that the Sites will be available to you in a fully functional form.

Who we disclose your Personal Data to

You agree and consent that we may disclose your Personal Data to:

• our directors, officers, employees, contractors, consultants and agents;
• external service providers for the operation of our business, and our professional advisers such as accountants and solicitors, insurers and their representatives, marketing agencies, financial service providers, payment gateways, e-commerce platforms and technical support;
• our Related Bodies Corporate (as that term is defined in the Corporations Act 2001 (Cth));
• our existing or potential agents, business partners, or joint venture entities or partners, including our third-party ticket merchants and ticket resale merchants engaged in connection with our festivals and events;
• our sponsors or promoters (as may be advertised on our Sites from time to time);
• Emergency Services Staff;
• specific third parties authorised by you to receive information held by us;
• the police, any relevant authority or enforcement body, or your Internet Service Provider or network administrator, if we have reason to suspect you have committed a breach of our terms and conditions or have been engaged in unlawful activity, and we reasonably believe disclosure is necessary;
• as required or permitted by any law (including the Privacy Act).

In the event of the Permitted Health Situation and/or Emergency Incident, you agree and consent that we may disclose your Sensitive Information:

• to Emergency Services Personnel;
• to external service providers for the operation of our business, and our professional advisers such as accountants and solicitors and insurers and their representatives; and
• any necessary parties in connection with the Permitted Health Situation and/or Emergency Incident.

We will take reasonable steps to make these third parties aware of this Privacy Policy. Where we disclose your Personal Data to a recipient located overseas, we will take the additional steps set out under Overseas Disclosure below.

You can withdraw your consent for us to share your Personal Data with third parties at any time by emailing hello@untitledgroup.com.au, but please note that withdrawal of such consents may affect your ability to access and use the Services.

What are your rights to your Personal Data

You have a general right to access any Personal Data about you that is held by us, unless a valid exception applies. You can request access to your own Personal Data by emailing us at hello@untitledgroup.com.au. We will respond to your request within a reasonable period. We will not charge you for making the request, although we may charge a reasonable amount for giving you access where permitted by law. If we refuse to give you access to your Personal Data, we will provide you with written reasons for that refusal (unless it would be unreasonable to do so) and information about how you may complain about our refusal.

We take reasonable steps to ensure that the Personal Data we collect, use and disclose is accurate, up to date, complete and relevant, having regard to the purpose for which it is held. As much of the Personal Data we hold is provided by you directly, it remains important that you provide accurate information and notify us promptly of any changes; we will not be liable for any loss arising from your failure to do so. If you believe that the Personal Data we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, you may request that we correct it by emailing us at hello@untitledgroup.com.au. We will take reasonable steps to correct your Personal Data where we are satisfied it is inaccurate, out of date, incomplete, irrelevant or misleading, having regard to the purpose for which it is held. If we refuse to correct your Personal Data as requested, we will give you written reasons for that refusal and, if you ask us to, we will take reasonable steps to associate a statement with your Personal Data noting that you believe it to be inaccurate, out of date, incomplete, irrelevant or misleading.

Data Retention

We will retain your Personal Data and Sensitive Information for the period necessary to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law. How long we retain your Personal Data and Sensitive Information depends on the type of data and the legitimate purpose for which we process and/or retain the data. Once your Personal Data and Sensitive Information is no longer needed for any purpose for which it may be used or disclosed under this Privacy Policy, and we are not otherwise required by law to retain it, we will take reasonable steps to destroy that information or ensure that it is de-identified.

External Links

Our Sites may contain links or plugins to other third-party websites or applications, including to our third-party ticket merchants or ticket resale merchants. Please note that this Privacy Policy does not cover the privacy practices of any third-party site. We do not have access to, or control over, the technologies that third-party sites may use to collect information about you. We disclaim all liability in connection with the services of any third-party sites integrated or otherwise linked to our Services. If you have any concerns about the privacy practices of a third-party site, we encourage you to reach out to them directly.

Security

We protect your Personal Data through technical security measures i.e. firewalls, encryption that limit the risk of loss, disclosure, unauthorised access and modification. No security measures are, however, 100% secure so we cannot guarantee the security of your information or data at any time. To the extent permitted by law, we accept no liability for any breach of security, or direct hacking of our security measures, or any unintentional disclosure, loss or misuse of any information or data or for the actions of any third parties that may obtain any information or data.

Where we have reasonable grounds to believe that an eligible data breach has occurred, we will notify the Australian Information Commissioner and affected individuals as required by law. We will also take reasonable steps to contain and remediate any suspected data breach.

We also train our personnel who may have access to your Personal Data about this Privacy Policy and our obligations under the Privacy Act and APPs. For more information on our internal policies, email us at hello@untitledgroup.com.au.

Overseas Disclosure

We may, in the course of providing any products or services to you, disclose Personal Data to recipients located overseas. Before disclosing Personal Data to an overseas recipient, we will take reasonable steps in the circumstances to ensure that the overseas recipient does not breach the Australian Privacy Principles in relation to that information, in accordance with Australian Privacy Principle 8. Where we transfer data to a third party in another country, we will take reasonable steps to ensure that the person or entity handling your data in those countries is bound under contract to meet the requirements of the Privacy Act and APPs. Given the range of overseas service providers we may engage from time to time, it is not practicable for us to specify the countries in which such recipients are likely to be located; if this changes, we will update this Privacy Policy accordingly.

Contact

Thank you for taking the time to read our Privacy Policy. If you have any questions regarding our Privacy Policy, you can reach our privacy officer at the details below.

Beyond The Valley Music Festival Pty Ltd (ACN 169 612 159) ATF The Trustee for Beyond The Valley Music Festival Unit TrustAtt: Privacy Officer1/1 Eastbourne StreetWindsor VIC 3181hello@untitledgroup.com.au

If you believe your privacy has been breached by us, or have any questions or concerns about our Privacy Policy, please contact us using the details above. We will treat your requests or complaints confidentially. We will contact you within a reasonable time after receipt of your complaint to discuss your concerns and outline options regarding how they may be resolved.

If you are not satisfied with our handling of your Personal Data, or have any other concern over our privacy policy, then you may lodge a formal complaint with the Office of the Australian Information Commissioner (for more information, please see www.oaic.gov.au).

‍