Privacy policy — Excellence Coaches

1. About this policy

Excellence Coaches and Tours Pty Ltd (ABN 34 616 162 442) ("Excellence Coaches", "we", "us") runs airport transfers, shuttles, private transfers, charters and tours in Cairns, Port Douglas and the surrounding region. This policy explains how we handle personal information when you book with us (directly or through a hotel or travel agent), travel with us, use our hotel booking portal, or work with us.

We handle personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. If you have a question about this policy, or want to make a request or complaint, see “Contact us” below.

2. The personal information we collect

We only collect what we need to take, run and account for your booking, or to run our business. Depending on who you are, this may include:

Customers and travellers

your name, mobile number and email address;
trip details: pickup and drop-off places (such as your hotel or home address), dates and times, flight numbers, the number of adults and children, child seats, luggage or extras, and any notes you give us for the driver;
the hotel or travel agent that booked for you, and their booking reference;
payment records: amounts, how and when you paid, invoices, credit notes, refunds and customer credit. For card payments we keep only the card type, the last four digits, the receipt number and the payment status — never the full card number, expiry date or security code;
records of our contact with you, such as the emails we sent, and whether you confirmed your pickup.

Notes about the trip may sometimes reveal something about your health (for example, that a passenger needs extra help or space). Please only tell us what the driver needs to know; we use it only to run your trip.

Hotels, travel agents and their staff

the business name, address, phone, booking and billing email addresses, and contact names;
for each person with a portal login: name, email address, the date they accepted our booking terms, and the bookings they made or changed;
the business's monthly invoices, payments and statement.

Our staff and drivers

name, email, phone and login details;
work records such as shifts, breaks, timesheets, pay rates, vehicle checks (including photos) and the trips assigned to them;
when a driver clocks in or out or starts or ends a break in our app, the device's location at that moment — only if the driver allows location access on their device. We do not track drivers at any other time.

Records about current and former employees that relate directly to their employment may be exempt from the Privacy Act; we still keep them secure and use them only for employment purposes.

3. How we collect it

from you, when you call, email or book with us, or when you talk to our staff or driver;
from your hotel or travel agent, when they book for you in our portal or by phone — they give us your details so we can provide your trip, and we use them only for that booking (as our booking terms with hotels and agents say);
from our payment provider (Square), which tells us whether a card payment went through, the card type and its last four digits;
automatically, in a limited way: the sign-in cookie described below, and a record of who changed what in our system.

You can ask us general questions or for a price without giving your name. To book a trip, we need a name and a way to contact the traveller, so the driver can find you and we can tell you about changes.

4. Why we collect and use it

to take, confirm, change and cancel bookings, plan our runs and vehicles, and get the right driver to the right place at the right time;
to contact you about your booking: confirmations, changes, cancellations, pickup reminders and pickup confirmation links;
to take payments, issue tax invoices, credit notes and refunds, and bill hotels and agents on account;
to keep financial, tax and accounting records and meet our legal obligations;
to look after safety, handle complaints, insurance claims, lost property and incidents, and protect our business against fraud;
to manage our staff and drivers, including pay and timesheets;
to keep our systems secure and working, and to find and fix errors.

We do not sell personal information, and we do not use it for advertising. We do not send marketing emails or texts today. If we ever do, we will only send them where the law allows, every message will have an easy way to unsubscribe, and we will update this policy first.

5. Who we share it with

We share personal information only as needed for the purposes above:

our drivers and office staff, who see only what they need for their work (drivers see the trips assigned to them);
the hotel or travel agent that made your booking, which can see that booking, its status and, for its own account, the price and invoices;
service providers that run parts of our system for us, under contracts or terms that require them to protect it:
Supabase — our database, sign-in and file storage, hosted in Sydney, Australia;
Vercel — hosts our website and app, with its servers in Sydney, Australia;
Resend — sends our emails, so it handles the recipient's address and the content of each email (including attached invoices);
Square — processes card payments. Card details are typed into Square's own secure card form and go straight to Square; we never see or store them. We pass Square the amount and the cardholder's name, email, phone and postcode for verification;
Sentry — if we turn on error monitoring, it receives technical error reports. We set it up to strip out names, email addresses, phone numbers, addresses and card-like numbers before anything is sent;
our accountant, auditors, lawyers and insurers, where needed;
government agencies, police or courts where the law requires or allows it, for example the Australian Taxation Office.

6. Information sent overseas

Our main database and app are hosted in Australia (Sydney). Some of our service providers are based overseas and may store or process information outside Australia, mainly in the United States: Resend (email delivery), Square (card payments; it also operates in Australia) and, if switched on, Sentry (error monitoring). We choose providers that protect information to a standard comparable to the Australian Privacy Principles, and we send them only what they need to do their job.

7. Cookies and website data

Our site uses one kind of cookie: a sign-in cookie that keeps staff, drivers and hotel users signed in. It is needed for the app to work. We do not use analytics, advertising or tracking cookies, and we do not use third-party analytics.

When you pay by card, Square's card form runs on the page and may set its own cookies for fraud prevention, under Square's privacy policy. Our web host keeps standard server logs (such as IP addresses) for security and to keep the service running.

8. How we keep it safe

data is encrypted in transit (HTTPS) and held with established cloud providers;
every user has their own login, and each role (office, driver, hotel) can see only what it needs — for example, a hotel sees only its own bookings, and office-only notes are hidden from drivers and hotels;
money records (payments, invoices, refunds) can't be edited or deleted; mistakes are corrected with a new entry, and changes to bookings are recorded with who made them and when;
invite and password-reset links expire, and we store only scrambled (hashed) copies of them;
we never store full card numbers;
a staff, driver or hotel login can be switched off immediately when it is no longer needed.

No system is completely secure. If a data breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

9. How long we keep it

We keep booking, payment and invoice records for as long as we need them for the purposes above and at least as long as the law requires — tax and financial records are generally kept for at least five years. Because these are financial and audit records, our system is built so they are not deleted or changed; a booking that is cancelled is kept as cancelled.

When we no longer need personal information for any purpose and are not required to keep it, we will take reasonable steps to destroy it or remove the details that identify you.

10. Seeing and correcting your information

You can ask to see the personal information we hold about you, or ask us to correct it if it is wrong, out of date or incomplete. Contact us at imanveerzalam+stg-office-office@gmail.com, 07 3012 7400, or by post to Excellence Coaches and Tours Pty Ltd, 454A Sheridan St, Cairns North QLD 4870. We will need to confirm who you are first. We will respond within 30 days and there is no charge to make a request. If we can't give you access or make a correction, we will tell you why in writing and how to complain. If we don't change a record you think is wrong, you can ask us to attach a note saying so.

Hotels and travel agents can correct their own contact details by contacting us, and can update booking details in the portal within the booking rules.

11. Questions and complaints

If you have a question or concern about how we handle your personal information, please contact us first at imanveerzalam+stg-office-office@gmail.com, 07 3012 7400, or by post to Excellence Coaches and Tours Pty Ltd, 454A Sheridan St, Cairns North QLD 4870. Tell us what happened and how you would like it fixed. We will acknowledge your complaint, look into it, and give you a written response within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, phone 1300 363 992.

12. Changes to this policy

We will update this policy when the way we handle personal information changes. The current version is always on this page, with the date it was last updated.

13. Contact us

Privacy contact: Excellence Coaches and Tours Pty Ltd
Email: imanveerzalam+stg-office-office@gmail.com
Phone: 07 3012 7400
Post: 454A Sheridan St, Cairns North QLD 4870