Privacy Policy – Joylands Amusement Park and Carnival Rides Hire

Last updated: 29/04/26

1. Who We Are

Joylands is a carnival and amusement operator providing rides, games and entertainment at events across Australia. This privacy policy applies to all personal information we collect when you visit our events, use the Joy Pass digital wallet, interact with our staff, or visit our website and social channels.

In this policy, “we”, “us”, and “our” refer to Joylands (trading name of Joyland Amusements Pty Ltd, ABN 46 144 902 492). “You” and “your” refer to anyone whose personal information we hold, whether as an event visitor, Joy Pass holder, vendor, contractor, or staff member.

We are committed to handling your personal information in accordance with the Privacy Act 1988 (Cth) (the “Privacy Act”) and the Australian Privacy Principles (the “APPs”).

2. The Joy Pass and Our Service Provider

The Joy Pass digital wallet, the supporting mobile application, the self-service kiosks and the staffed credit windows at our events are provided to us by Sendrato Pty Ltd (ACN 697 131 427, ABN 61 697 131 427) (“Sendrato”). Sendrato operates these services on our behalf as our service provider.

Where you load Tokens onto a Joy Pass, top up using the Sendrato Visitor App, scan into a ride, or make a purchase at one of our kiosks or POS terminals, your personal information is collected and processed by Sendrato on our behalf. Sendrato handles that information in accordance with our instructions and its own privacy policy, which is available at sendrato.com/privacy.

For the purposes of the Privacy Act, Joylands remains responsible for the personal information collected from event visitors at our events. You can direct any privacy enquiry, access request, or complaint to either Joylands (using the details above) or Sendrato.

3. What Personal Information We Collect

The personal information we collect depends on how you interact with us. It may include:

Information you provide directly

• Identity and contact details: name, email address, mobile telephone number, postal address, and date of birth (where age verification is required).
• Account credentials: username, password and profile information you provide when you register for the Sendrato Visitor App.
• Payment information: card details and billing information you enter when purchasing or topping up Joy Pass Tokens, when buying tickets, or when making any other payment to us. Card numbers are processed by our regulated payment provider on PCI-DSS-compliant infrastructure; neither we nor Sendrato store full card numbers.
• Communications: information you give us when you contact our customer service team, complete a survey, or interact with us on social media.

Information collected automatically

• Wallet and transaction information: your wallet identifier, top-up amounts, transactions, refunds, and the ride or vendor at which transactions occurred.
• Device and technical information: IP address, device identifier, operating system, browser type, and in-app interactions.
• Location information: approximate or precise location, where you have granted the Sendrato Visitor App permission to use it (for example, to show your position on the event map or to provide directions).

Information from third parties

• Event partners and ticketing agents: where you have purchased tickets or registered through a partner event, host venue or ticketing agent, that party may share information with us so that we can deliver our services to you.
• Marketing and social media: where you interact with us through social-media platforms or marketing partners, those parties may share limited information about your interactions, in accordance with their own privacy policies and your settings on those platforms.

Sensitive information

We do not routinely collect sensitive information (as defined in the Privacy Act). Where collection is necessary, for example accessibility requirements at one of our events, we will only collect it with your consent and only for the purpose disclosed at the time of collection.

4. How We Use Your Personal Information

We use your personal information for the following purposes:

• Providing our services: operating our events, providing rides and games, issuing and managing Joy Passes and digital wallets, processing transactions and refunds where permitted under our Terms and Conditions.
• Account management: registering accounts, verifying identity where required, and providing customer support.
• Event operations: managing entry, accreditation, access control, lost-and-found, and on-site safety.
• Communication: sending you transaction confirmations, event information, and where you have opted in, push notifications, newsletters and marketing communications about our events.
• Analytics and improvement: understanding how our events and Joy Pass services are used, in aggregated form, to improve operations, attendee experience and safety.
• Legal compliance: meeting our obligations under applicable laws, including consumer protection, anti-money-laundering and tax requirements.
• Investigations: investigating and responding to complaints, suspected fraud, or unlawful activity.

5. Basis for Collection and Use

Under the Australian Privacy Principles, we collect, hold, use and disclose your personal information on the following bases:

• Necessary for our functions: collection that is reasonably necessary for, or directly related to, providing our events and the Joy Pass service.
• Performance of a contract: where we need information to fulfil our contractual obligations to you, including the Joy Pass Terms and Conditions.
• Required or authorised by law: where we are required to collect or disclose information to comply with a legal obligation or a request from a regulator or law-enforcement agency.
• Consent: where you have given explicit permission, such as for sensitive information, location data, push notifications, or direct-marketing communications. You can withdraw consent at any time.

6. Who We Share Your Personal Information With

We will not sell your personal information. We share it only in the following circumstances:

• Sendrato: as our service provider for the Joy Pass digital wallet, the Sendrato Visitor App, the kiosks and the POS terminals at our events. Sendrato handles your information in accordance with our instructions and its own privacy policy at sendrato.com/privacy.
• Payment service providers: Sendrato’s regulated payment processor authorises, settles and reconciles payment transactions.
• Event partners: where one of our events is co-hosted with a venue, show society, council or other partner, we may share limited operational information with that partner so they can manage their event.
• Other service providers: hosting, infrastructure, communications, customer-service, ticketing and marketing providers who help us operate our business. These providers are bound by confidentiality and data-protection obligations.
• Professional advisers: lawyers, accountants and auditors where necessary.
• Government agencies and regulators: where we are required or authorised by law to disclose information.
• Successors: a purchaser or successor in the event of a sale, merger, restructuring or transfer of the relevant part of our business. We will require any recipient to handle personal information consistently with this policy.

7. Overseas Disclosures

Some of our service providers and infrastructure are located outside Australia. As a result, your personal information may be disclosed to, accessed by, or stored on infrastructure located in:

• the European Union, where parts of the Sendrato platform’s cloud infrastructure are based;
• Ireland and the Netherlands, where the Sendrato group operates its software and payment infrastructure;
• the United States, where some of our communications, support and analytics tools are hosted; and
• other locations where Sendrato’s payment processor or its sub-processors operate.

Before disclosing personal information overseas, we take reasonable steps, in accordance with APP 8, to ensure that the recipient handles it in a way consistent with the Australian Privacy Principles. This is generally achieved through written contractual commitments, including our service agreement with Sendrato and the European Commission’s Standard Contractual Clauses where the recipient is in the EU.

8. How Long We Keep Your Personal Information

We keep your personal information only for as long as we need it to fulfil the purposes set out in this policy, unless a longer retention period is required or permitted by law. In particular:

• Joy Pass account and wallet information is kept for the duration of an event and for a reasonable period afterwards to handle disputes, refund requests where applicable under our published Terms and Conditions, and reconciliation;
• transaction records are kept for the period required by Australian tax, financial-services and anti-money-laundering laws (typically up to seven years);
• marketing-database information is kept until you unsubscribe or otherwise withdraw consent;
• customer-service and complaint records are kept for as long as needed to manage our relationship with you and to handle complaints.

Once the retention period expires, we delete or de-identify your personal information.

9. How We Protect Your Personal Information

We take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. The Joy Pass platform operated by Sendrato on our behalf includes:

• TLS encryption for data in transit and AES encryption for sensitive data at rest;
• role-based access controls, multi-factor authentication, and least-privilege access for staff and contractors;
• processing of card-payment data only through PCI-DSS-compliant infrastructure operated by a regulated payment processor; full card numbers are not stored;
• RFID wallets that use mutual cryptographic authentication and that do not carry payment-card data on the chip;
• physical security at our offices and at our cloud-hosting providers; and
• ongoing monitoring, logging and incident-response procedures.

Despite these measures, the security of online transactions and electronic communications cannot be absolutely guaranteed. You should take care to protect your account credentials, Joy Pass card or wristband, and your devices.

10. Your Privacy Rights

Under the Australian Privacy Principles, you have the following rights in relation to the personal information we hold about you:

• Access: you can request a copy of the personal information we hold about you. We will respond to your request within a reasonable period as required under applicable privacy laws.
• Correction: you can update most of your information directly through your account in the Sendrato Visitor App. If you cannot update your own information, we will correct any errors within a reasonable period after receiving written notice from you.
• Withdraw consent: where we rely on your consent (such as for marketing or location data), you can withdraw it at any time.
• Opt out of direct marketing: every marketing communication we send includes an unsubscribe option. You can also contact us directly to opt out.
• Complain: if you believe we have mishandled your personal information, you can lodge a complaint with us or with the Office of the Australian Information Commissioner (see Section 15).

To exercise any of these rights, please contact our Privacy Officer using the details in Section 1.

11. Cookies and Trackers

Our website, the Sendrato Visitor App, and our online ticketing pages use cookies and similar technologies (such as local storage and SDKs) to help these services function, to remember your preferences, and to understand how they are being used. These trackers fall into the following categories:

• Strictly necessary: required for core functionality such as session management and security.
• Functional: remember your preferences and improve your experience.
• Analytics: help us understand aggregate usage.
• Marketing: only used where you have consented through our cookie banner.

You can manage tracker preferences through the cookie banner on first visit, the in-app privacy settings, or your browser or device settings. Disabling some categories may affect the functionality of these services.

12. Direct Marketing

We will only send you direct-marketing communications where this is permitted by the Privacy Act and the Spam Act 2003 (Cth). Every direct-marketing communication we send will include a clear unsubscribe option. You can also contact us at any time using the details in Section 1 to opt out.

We may still send you important operational notices, for example transaction confirmations, safety information, or material changes to this policy, that are not promotional in nature. You cannot opt out of these.

13. Data Breaches

We are subject to the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act. If we become aware of a data breach involving personal information that is likely to result in serious harm to one or more individuals, we will assess the breach without delay and, where required, notify the affected individuals and the Office of the Australian Information Commissioner as soon as practicable.

Where a data breach affects information held by Sendrato on our behalf, Sendrato is contractually required to notify us promptly so that we can meet our obligations under this scheme.

14. Children

Our events are family-oriented and children may attend and use a Joy Pass under the supervision of a parent or guardian. We do not knowingly create direct accounts in the Sendrato Visitor App for children under 14 without verifiable parental or guardian consent, and we apply additional safeguards to information collected in respect of children, consistent with the developing Australian Children’s Online Privacy Code.

If you believe a child has provided us with personal information without the consent of a parent or guardian, please contact our Privacy Officer using the details in Section 1 and we will take appropriate steps to remove that information.

15. Complaints

If you believe we have not complied with this policy or with the Australian Privacy Principles, please contact our Privacy Officer using the details in Section 1. We will acknowledge your complaint, investigate it, and provide you with a written response within a reasonable period, ordinarily within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner:

• Web: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

16. Changes to This Policy

We may amend this privacy policy from time to time. We will publish the current version on our website and update the date at the top of this page. Where the changes are material, we will provide additional notice through the Sendrato Visitor App or by email to registered account-holders.

17. Contact Us

For privacy enquiries, access requests, correction requests, or complaints, please contact our Privacy Officer:

You may also contact our service provider in relation to information held on the Joy Pass platform: