Privacy Policy

1. About this policy and who we are

Moonivory Studio is operated by Moonivory Studio Pty Ltd, ACN 672 491 338 and ABN 67 672 491 338. Our contact address for the purposes of this policy is Level 1, 15 Shoreham Drive, Mornington, VIC 3931, Australia. In this policy, “Moonivory Studio”, “we”, “us” and “our” refer to that legal entity.

For people located in Australia, we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles to the extent those laws apply. Where the European Union General Data Protection Regulation or the United Kingdom GDPR applies to a particular interaction, we also provide the additional rights and safeguards described below. Applying these standards does not limit any stronger right available under another applicable law.

2. Scope

This policy applies to information collected through this website, enquiry forms, telephone or in-person communications, class and program registrations, studio visits, events, workshops, corporate wellness arrangements, feedback and other direct interactions with Moonivory Studio. It also applies when an authorised representative, employer, family member or referring professional provides information on your behalf.

This website has been rebuilt to operate with local project resources and does not intentionally load third-party advertising, remote fonts, remote analytics libraries or embedded social media content by default. If the services or technical configuration change, this policy and the Cookie Policy will be updated before materially different tracking is introduced.

3. Personal information we may collect

Depending on your interaction with us, we may collect your name, email address, telephone number, postal address, age range, preferred class or program, booking and attendance details, payment and transaction records, membership information, correspondence, feedback, accessibility requirements, emergency contact details and any other information you choose to provide.

Wellness services can involve information about injuries, mobility, pregnancy, allergies, health conditions, medications, support needs or other sensitive matters. We ask only for information reasonably necessary to provide a safe and suitable service. Where the law requires consent for sensitive or health information, we seek that consent before collection or otherwise rely on another lawful basis expressly permitted by law.

When you access the website, ordinary server or browser records may include an IP address, browser type, device type, language, referring page, requested page, timestamps, error logs and security events. The static website itself does not require a user account and does not intentionally use advertising identifiers.

4. How information is collected

We collect information directly from you when you complete a form, contact us, book or attend a service, speak with a practitioner, participate in a program, request accessibility support, make a payment, subscribe to a communication or provide feedback.

We may also receive information from an organisation arranging a corporate program, a person making a booking for you, an authorised representative, a payment provider, a professional adviser, an insurer, a referring health professional or a service provider that supports our operations. We take reasonable steps to ensure you are aware of the collection where required.

5. Purposes for which we use information

We may use personal information to respond to enquiries; assess whether a class or program is suitable; manage bookings, memberships and attendance; deliver yoga, meditation and wellness services; process payments and refunds; communicate schedule or service changes; maintain safety and incident records; personalise reasonable accommodations; improve services; handle complaints; prevent fraud and misuse; maintain website and information security; comply with legal obligations; and establish, exercise or defend legal claims.

We do not sell personal information. We do not use health or wellness information for unrelated advertising. We do not make decisions that produce legal or similarly significant effects solely through automated processing.

6. Lawful bases under GDPR

Where GDPR applies, we rely on one or more lawful bases appropriate to the activity: performance of a contract or steps requested before entering a contract; compliance with a legal obligation; our legitimate interests in running a safe, secure and effective studio, responding to enquiries and improving services; protection of vital interests in an emergency; and consent where consent is required or is the most appropriate basis.

For special-category data, including health information, we rely on explicit consent where required, protection of vital interests, establishment or defence of legal claims, or another condition specifically available under applicable data protection law. You may withdraw consent at any time, but withdrawal does not affect processing that was lawful before withdrawal and may mean we cannot provide a service that depends on the information.

7. Disclosure and service providers

We may disclose relevant information to instructors and authorised staff; booking, payment, accounting, legal, insurance, IT, hosting, security and communication providers; corporate clients where a program is arranged by an employer, limited to information reasonably necessary for administration; emergency services when required; regulators, courts and government agencies where disclosure is authorised or required; and a purchaser or successor in connection with a genuine business reorganisation, subject to appropriate confidentiality and legal safeguards.

Service providers are expected to use information only for authorised purposes, protect it appropriately and comply with contractual and legal obligations. We seek to minimise information shared and to avoid disclosing sensitive details unless necessary.

8. Overseas disclosures and international transfers

Some operational providers may store or process information outside Australia. Where an overseas disclosure occurs, we take reasonable steps required by Australian privacy law and assess the destination, provider safeguards and nature of the information. Where GDPR applies to a transfer outside the European Economic Area or another recognised adequate jurisdiction, we use an approved transfer mechanism where required, such as standard contractual clauses, together with supplementary safeguards appropriate to the risk.

You may contact us for general information about relevant transfer safeguards. Security and confidentiality considerations may limit the level of technical detail we can provide.

9. Retention

We keep personal information only for as long as reasonably necessary for the purpose of collection, the provision of services, safety and incident management, accounting and tax requirements, dispute resolution, limitation periods, insurance obligations and other legal or regulatory requirements.

Retention periods vary by record type. Enquiries that do not result in a service are generally retained for a shorter period than active client, transaction or incident records. When information is no longer required, we take reasonable steps to delete, destroy or de-identify it, subject to lawful backup cycles and records that must be retained.

10. Security

We use administrative, physical and technical measures designed to protect information against loss, misuse, interference, unauthorised access, alteration and disclosure. Measures may include access controls, staff confidentiality, secure configuration, software maintenance, local asset hosting, data minimisation, backups, incident procedures and appropriate provider due diligence.

No method of transmission or storage is completely secure. If we become aware of an eligible data breach, we will assess it promptly and notify affected individuals and relevant regulators where required by law.

11. Your privacy rights

Subject to applicable law and exceptions, you may ask for access to personal information we hold about you, correction of inaccurate or incomplete information, deletion or erasure, restriction of processing, objection to certain processing, and a portable copy of information you provided where the portability right applies. You may also withdraw consent and lodge a complaint with a competent supervisory authority.

Under Australian privacy law, you may request access to and correction of personal information. We may need to verify your identity and may refuse or limit a request where the law permits or requires this. If we refuse a request, we will generally provide reasons and information about available complaint mechanisms unless prohibited from doing so.

We will not discriminate against you for exercising a privacy right. Some rights are not absolute, and retaining limited information may be necessary to meet legal obligations, protect safety, resolve disputes or establish legal claims.

12. Marketing communications

We may send service messages necessary for a booking or program. Promotional communications are sent only where permitted. You may opt out of promotional electronic communications at any time using the method stated in the message or by contacting us. Opting out of marketing does not stop essential administrative or safety communications relating to a service you requested.

13. Children and young people

Our general website is not directed to children who are unable to provide valid consent. Where a class or service is designed for a child or young person, we may require consent and information from a parent or legal guardian and take age-appropriate steps to explain how information will be used. We do not knowingly use children’s information for behavioural advertising.

14. Cookies and local storage

The website may use strictly necessary browser storage or similar technology to support basic functions and security. It does not intentionally deploy third-party advertising cookies or remote analytics scripts by default. Detailed information, including how to control browser storage, appears in our Cookie Policy.

15. Complaints

Please contact us first if you believe we have mishandled personal information. Include enough detail for us to understand the issue, the information involved and the outcome you seek. We will acknowledge and investigate a complaint within a reasonable period and may request additional information to verify identity or clarify the concern.

If an Australian privacy complaint remains unresolved, you may be able to contact the Office of the Australian Information Commissioner. If GDPR applies, you may also complain to the data protection supervisory authority in the country where you live, work or believe an infringement occurred.

16. Changes to this policy

We may update this policy to reflect changes in law, services, technology or business practices. The updated version will be published on this page with a revised effective date. Where a change materially affects how existing information is used, we will take additional steps required by law.

17. Administrator and contact

Privacy requests should be marked “Privacy Request” and should explain the request clearly. Do not include unnecessary health or identity information in an initial email.