Privacy Policy

Your privacy at a glance

We are d’Albora Marinas. To run our marinas, we collect information including your contact details, vessel and insurance details, account and payment information, CCTV footage at our marinas and recordings of some calls. We use this information to provide and improve our services, manage your account, keep people and property safe, meet our legal obligations, and tell you about our services (you can opt out of marketing at any time). We share it with our related companies and the service providers who help us operate, and some of our providers store information overseas. You can ask to see or correct your information, deal with us anonymously for general enquiries, and if needed, make complaints by contacting us via phone or email (1800 DALBORA or privacy@dalbora.com.au, attention Privacy Officer) and then to the Office of the Australian Information Commissioner (OAIC). 

1. Who we are and what this policy covers
   
   

This policy applies to the collection and handling of personal information by MA MARINA FUND OPCO NO. 1 PTY LTD ACN 667 243 601 and its related bodies corporate (we, us and our) in connection with:

• our marina, boatyard, storage, hospitality, boat sales and related “d’Albora Marinas” businesses;
• our loyalty program, including member benefits and points; and
• our website, member portal and the d’Albora App.

We are committed to protecting your privacy and we handle personal information in accordance with the Privacy Act 1988 (Cth) (Privacy Act).

We are an Australian business. Our services, website and App are directed to customers in Australia, and this policy does not confer rights under overseas privacy regimes.

If you apply for a job with us, this policy applies to you as an applicant. Once you are employed, our handling of your employee records is generally exempt from the APPs under the Privacy Act’s employee records exemption and, to that extent, will be governed by our internal policies.

2. What is personal information and sensitive information?

The Privacy Act defines “personal information” as information or an opinion about an identified individual, or an individual who is reasonably identifiable:

• whether the information or opinion is true or not; and
• whether the information or opinion is recorded in a material form or not.

“Sensitive information” is a type of personal information that includes information about matters such as racial or ethnic origin, political opinions or associations, religious or philosophical beliefs, professional, trade or union membership, sexual preferences or practices, criminal record and health information, and includes biometric information and templates.

Whenever we use these terms in this policy, we mean these legal definitions.

3. What personal information do we collect?

General

What we collect depends on your dealings with us. It can include:

• identity and contact details — name, address, phone, email, date of birth, emergency contacts, proof of identity documents;
• financial information — payment history, bank account details and credit card details;
• vessel details — vessel name, registration, hull identification number, dimensions, insurance details and certificates of currency;
• contract, account and transaction details — bookings, berth and storage history, invoices, payments, direct debit and card authorities, utility consumption and meter data, account correspondence and complaints;
• loyalty program details —name, contact details and date of birth of any nominated beneficiary;
• images and recordings — CCTV footage of our marinas and premises, facial recognition enrolment images and biometric templates (if you enrol in facial recognition site access), licence plate recognition images of vehicles entering our sites, and recordings of calls with our team;
• website, portal and App data — log-in details, device and usage information, IP address, and data from cookies, tags and pixels (more information set out at section 10 below);
• site access and safety information — contractor licences, insurances and inductions, site access records (fob, facial recognition and vehicle entry logs), incident reports;
• job application information — your CV, resume or application, employment history, references and education; and
• visitor Wi-Fi data — where you connect to visitor Wi-Fi at our marinas, your device’s IP address, MAC address and connection logs, which we may use to identify and manage inappropriate use of the network.

Sensitive information

We will not ask you to disclose sensitive information unless it is reasonably necessary for our functions or activities and you have consented to the collection, or the collection is otherwise permitted by law. For example, we may collect:

• health information you choose to give us for emergency management;
• vessel-related criminal history warranties in your contract;
• health and disability information when managing a personal injury or security incident at our marinas or to assist with mobility and access arrangements (for example, providing disability aids); or
• your biometric template if you choose to enrol in our facial recognition site access system (see section 5).

Sensitive information is handled in accordance with this policy and the Privacy Act.

4. How do we collect it?

Directly from you

Most of the time we collect personal information directly from you. For example, when you:

• make a booking or enter into a contract;
• use our products, services, facilities, App, website or portal;
• contact guest services or otherwise communicate with us;
• visit our marinas or premises;
• complete a form, survey, enquiry, complaint or feedback;
• supply products or services to us;
• subscribe to marketing or take part in a promotion, competition or event;
• join or use our loyalty program, or are nominated by a member to use member benefits on their behalf;
• complete an induction, safety, security or compliance process;
• apply for employment; or
• otherwise give us your information.

Automatically

We also collect information automatically. For example:

• through CCTV at our marinas, which may capture images (and, in limited areas, audio) of customers, visitors, tenants and their staff;
• through recordings of calls with our team;
• through licence plate recognition cameras at vehicle entry points and, if you have enrolled, facial recognition at site entry points;
• when you connect to our visitor Wi-Fi;
• through your use of our website, App and social media platforms; and
• through cookies, tags and pixels.

From third parties

We may collect information about you from third parties. For example:

• your insurer or broker (to verify cover);
• your authorised representatives;
• our loyalty program members, about the person they nominate to use member benefits on their behalf;
• marine brokers;
• our related entities;
• publicly available registers;
• debt recovery service providers (where relevant to amounts owing);
• law enforcement agencies (for example, in connection with an incident at a marina); and
• anyone you nominate in a job application.

Information about other people

If you give us personal information about another person (for example, a nominated beneficiary under our loyalty program, an emergency contact, or an authorised representative), you must have their consent to do so and make them aware of this policy. Where practicable, we will also give that person our own notice of this policy (for example, when they first use the d’Albora App).

If we receive personal information we did not ask for and decide we do not need it, we will destroy or de-identify it where lawful and reasonable to do so.

You do not have to provide personal information. However, if you choose not to when requested, we may not be able to provide all of our products and services to you, enter into or perform a contract with you, or deal with you (for example, progress your application for employment).

5. CCTV, call recording and monitoring

General

Our marinas and premises are monitored by CCTV, operating continuously. This is for the safety and security of people, vessels and property, for incident investigation and emergency management, and also for the protection and enforcement of our legal rights. Signage is displayed at our marinas where CCTV operates.

Calls to and from our team members may be recorded for training, quality and record-keeping purposes. You will be told at the beginning of a recorded call and you may ask to communicate by other means.

CCTV footage and call recordings are held securely, accessed only by authorised personnel on a need-to-know basis, disclosed outside d’Albora only as described in this policy (including to police and regulators where required or authorised by law) and retained for at least four (4) weeks in the case of CCTV footage (the exact period varies by site) and thirty-six (36) months in the case of call recordings, and for longer where required for an incident, complaint, claim, or legal or regulatory process.

Facial recognition

At some of our sites we use facial recognition technology to manage access to gates and secure areas for enrolled berth holders, team members, contractors and authorised visitors. The technology converts an image of a face captured at the point of entry into a biometric template and compares it with a database of individuals who have consented to enrol. A match allows the gate or entry point to open. We do not use this technology to screen, identify or flag individuals against any exclusion, banning or “watchlist” database. Its only function is to confirm that an enrolled, authorised person is seeking entry.

Enrolment is voluntary and is offered for your convenience (for example, so you do not need to present a fob when entering a site). Biometric templates are sensitive information, and we collect them only with your consent. Before we enrol you, we will ask for your consent and explain how your image and biometric template will be used, held and protected. If you do not wish to enrol, or wish to withdraw your consent at any time, you can use fob access instead — speak with our marina team or contact our Privacy Officer using the details in section 16. Signage is displayed at each site where the technology operates.

Where an image captured at an entry point does not match an enrolled individual, it is not identified. The biometric template generated for the comparison is deleted immediately and automatically. The image is retained only as part of our standard CCTV footage, for the period described above. Biometric templates and enrolment images are encrypted and accessible only to a restricted number of authorised personnel. They are retained only while you remain enrolled and are deleted within ninety (90) days after your enrolment ends, unless we need to keep them longer for an open incident, complaint, claim, or legal or regulatory process. You may ask us to delete your enrolment at any time. We do not use this information for marketing or any other purpose, and do not sell or disclose it except with your consent or as required or authorised by law.

You may ask whether facial recognition operates at a particular site, request access to the information we hold about you in connection with it, withdraw your consent, or complain about it, using the details in section 16.

Licence plate recognition

At some sites we use licence plate recognition cameras at vehicle entry points. These capture an image of your vehicle’s number plate, which we use to manage vehicle access to car parks and secure areas (by matching plates registered to berth holders, team members, contractors and authorised visitors), for safety and security, and to investigate incidents. Plate images and entry logs are held securely, accessed only by authorised personnel, used only for those purposes, and retained for the same period as our CCTV footage, unless needed for longer for an incident, complaint, claim, or legal or regulatory process.

6. How do we hold and protect your information?

Where and how it is held

We hold personal information electronically in our booking, marina management, billing, customer relationship, document management and email systems. Our core systems are hosted on our own servers in Sydney. Backups and some third-party systems (for example, our marina management platform) are hosted in secure data centres operated by cloud providers such as Amazon Web Services and Microsoft Azure, in Australia and overseas (more information is set out at section 9).

We hold limited hard-copy records (such as signed contracts and site induction forms) at our marinas and offices under physical access controls. CCTV and call-recording systems are described in section 5.

How we protect it

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Our measures include access controls and role-based permissions, encryption of information in transit, staff confidentiality obligations and training, and due diligence on the service providers who hold information for us. No transmission over the internet can be guaranteed as totally secure, but we review our security measures regularly.

How long we keep it

We keep personal information only as long as it is needed. In general:

• contract and account records are retained for at least seven (7) years after the end of your relationship with us to meet legal, accounting and dispute-related requirements;
• CCTV footage, call recordings, licence plate recognition images, and facial recognition templates and enrolment images are retained for the periods described in section 5; and
• marketing data is retained until you opt out. When information is no longer required and we are legally permitted, we take reasonable steps to destroy or de-identify it.

7. Why do we collect, hold, use and disclose personal information?

We collect, hold, use and disclose personal information for the following purposes.

Providing our services and managing your account

• To communicate with you.
• To provide our services and operate our marinas (including berth and storage licensing, bookings, launches, boatyard services and site access).
• To operate our loyalty program — including enrolling members, calculating tier status and points, providing member benefits (including benefits provided by our partners) and preventing misuse of the program.
• To verify vessel ownership, registration and insurance, and verify your identity.
• To personalise your experience.
• To manage accounts, invoicing and payments — including processing direct debits and card payments, recovering amounts owing and registering and enforcing security interests (including on the Personal Property Securities Register (PPSR)).

Safety, security and legal

• To ensure the safety and security of people and property and manage incidents and emergencies.
• To manage access to our sites, car parks and secure areas, including through fob, facial recognition and licence plate recognition systems.
• To operate and secure our visitor Wi-Fi networks and identify and manage inappropriate use of them.
• To help prevent and detect fraud, including by assisting us, our service providers, related entities and other third parties in investigating and preventing potential, suspected or actual breaches of law, fraudulent activities and other misconduct.
• To handle complaints and resolve disputes.
• To comply with our legal obligations.
• To exercise and defend our legal rights.

Improving, marketing and corporate purposes

• To operate and improve our website, portal and App, and improve our services, products and processes.
• To conduct surveys, reviews, market research, trend analysis, data analysis and matching, and analytics.
• To market and advertise our services.
• To evaluate, facilitate and manage mergers and sales of businesses.
• For such other purposes disclosed to you at the time the personal information is collected.

8. Who do we disclose it to?

We may disclose personal information, for the purposes in section 7, to:

• our related bodies corporate within the MA Financial Group;
• service providers who assist us to run our business — IT and hosting providers, booking and marina management systems, payment processors, mailing houses, security services providers, market research and feedback collection companies, marketing, advertising, promotions and event service providers, and their own service providers;
• professional advisers such as lawyers, auditors and accountants, and our insurers;
• your insurer, broker or authorised representatives;
• contractors and emergency services where necessary for safety or incident management;
• debt collection agencies and our lawyers in connection with amounts owing or disputes;
• the operator of the PPSR in connection with registrations;
• third parties whose equipment or services we supply or arrange as agent (for example, equipment hire), to the extent needed to provide them to you;
• our loyalty program partners who provide member benefits, limited to the information needed to provide a benefit you choose to use;
• third-party platforms on which we advertise, including to display advertising or content based on your preferences;
• third parties assisting in investigating and preventing potential, suspected or actual breaches of law, fraud or other misconduct;
• a purchaser or prospective purchaser (and its advisers) in connection with the sale or restructure of any part of our business;
• government agencies, courts, regulators and law enforcement where required or authorised by law, and otherwise to persons disclosed to you at the time of collection; and
• such other third party that we have disclosed to you at the time the personal information is collected.

9. Overseas disclosure

Some of our service providers (including cloud hosting, booking, payment and customer-relationship platforms) store or access personal information outside Australia, so we are likely to disclose personal information to overseas recipients, principally in Slovenia (where our marina management platform provider is based) and Germany, the United Kingdom, USA and New Zealand. Where personal information is disclosed overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs.

10. Website, App, cookies and online advertising

Our website and App use cookies, tags, pixels and similar technologies. A cookie is a small text file placed on your device by our web server, which our servers can later retrieve. Tags and pixels work in a similar way. We use these technologies to customise our website for you, for statistical and analytics purposes, and for security. You can control cookies through your browser settings, although disabling them may limit some website functions. We may also collect your IP address in connection with your use of our website.

Our website contains links to third-party websites. If those third parties collect information about you, we may also collect or have access to it under our arrangements with them, and cookie or preference information may be shared between us. Third-party websites are governed by their own privacy policies, which we encourage you to read.

When you view our advertisements on a third-party website, the advertising company may use cookies and web beacons to collect information such as your browser type, the date and time of your visit and the performance of their marketing, and, when you later access our website, how you use it. We and our advertising partners may use this information to show you advertising on third-party platforms based on your preferences; you can manage advertising preferences through those platforms and your browser settings.

11. Direct marketing and your choices

We may use your personal information to tell you about our services, loyalty program, membership benefits, events and offers by email, SMS, phone, post or through the App, where permitted by law. We will not use or disclose sensitive information for direct marketing unless you have consented. If you do not wish to receive direct marketing from us or from other organisations, or want to know the source of the information used, use the unsubscribe link in the communication or contact us using the details in section 16. We will give effect to your request as soon as practicable and without charge.

12. Automated decision-making

We do not currently use computer programs to make decisions, without human involvement, that could reasonably be expected to significantly affect your rights or interests. Our booking, billing and account systems automate routine processing (for example, generating invoices and calculating loyalty program points and tier status, and opening access gates for enrolled fobs, faces and registered vehicle plates), but decisions such as refusing or terminating a contract or taking enforcement action are made by our personnel. If this changes, we will update this policy to describe the kinds of personal information used by those programs and the kinds of decisions involved.

13. Dealing with us anonymously

Where it is lawful and practicable (for example, general enquiries) you may deal with us anonymously or using a pseudonym. Please note however, it is not practicable for us to deal with you anonymously in connection with berthing, storage and other contracted services or the loyalty program.

14. Data breaches

If a data breach involving personal information occurs, we will act promptly to contain and assess it in accordance with our data breach response plan. Where the breach is likely to result in serious harm to affected individuals, we will notify those individuals and the OAIC as required by the Notifiable Data Breaches scheme, and will advise the steps you can take in response.

15. Access and correction

You may ask to access the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading, by contacting our Privacy Officer (please refer to section 16).

There is no charge for making a request or for corrections, and any charge for giving access will be limited to our reasonable costs. If we refuse access or correction, we will tell you why in writing and how you may complain. You can also view and update key account details at any time through the d’Albora App or member portal.

16. Questions and complaints

If you have a question, concern or complaint about how we have handled your personal information or our compliance with the Privacy Act, contact our Privacy Officer:

• Post: GPO Box 3570, Sydney NSW 2001
• Phone: 1800 DALBORA (32 52 672)
• Email: privacy@dalbora.com.au (attention: Privacy Officer)
• Website: dalbora.com.au.

We will acknowledge your complaint, investigate it, and give you a decision. If, despite our best efforts, you believe your complaint has not been satisfactorily resolved, you may contact the OAIC.

17. Changes to this policy

We review this policy regularly to keep it up to date with our practices and the law, and may change it from time to time. The current version will always be available at www.dalbora.com.au/privacy-policy. The effective date of this policy is 1 October 2026.