Privacy Policy

1. Who We Are

Space Penguin Proprietary Limited is the APP entity under the Privacy Act and, where applicable, the controller under the GDPR and the UK GDPR for the personal information described in this Policy.

Registered office: Suite 1208/530 Little Collins Street, Melbourne VIC 3000
Sydney office: 89–97 Jones Street, Ultimo, NSW 2007
Contact: hello@spacepenguin.io

2. Changes to This Policy

We may update this Policy from time to time to reflect changes to our practices or for legal or operational reasons. We will post the revised Policy on this page and update the “Last Updated” date above. Material changes affecting how we handle your personal information will, where required by law, be communicated to you directly (e.g. by email) before they take effect. We will maintain a current version of this Policy on our website and will handle personal information in accordance with the version in force at the time of collection or as otherwise permitted by law.

3. What Personal Information We Collect

3.1 Information you give us directly

• Account and signup information: name and email address.
• Payment information: processed directly by our payment processor, Stripe — we do not store full card details ourselves. We receive limited information from Stripe such as payment confirmation, last 4 digits of a card, and billing name.
• Virtual Address subscription information: business name, authorised person name(s) (maximum two per subscription), contact details, and the address to which you’d like mail forwarded (if requested).
• Marketplace information: if you list a Space as a Host, your business/listing details and payout information; if you book a Space, your name and contact details, shared with the Host as needed to fulfil the booking.
• Customer support information: anything you tell us via email, WhatsApp, or other support channels.
• Mail and parcel content: when you use our Virtual Address service, the contents of mail and parcels addressed to you — including any personal information about you or third parties contained within that mail (e.g. a sender’s name, an account number, or other details on a letter) — are incidentally collected and scanned as part of providing the Service. We do not use this content for purposes unrelated to providing the Virtual Address service, except where required or authorised by law (for example, to comply with a legal notice or protect our rights).

3.2 Information we collect automatically (Cookies and similar technology)

When you visit our website, we and our advertising and analytics partners automatically collect Usage Data via cookies, pixels, and similar technologies, including device and browser information, IP address, pages viewed, and how you interact with the Services. See Section 7 (Cookies) for detail, including how this differs for EU/UK visitors.

3.3 Information we receive from third parties

• Stripe (payment processing) — payment confirmation and limited billing data.
• Google Workspace / Gmail — we use Google Workspace for our business email; if you email us, that correspondence is held in our Google Workspace environment.
• Zoho CRM — we use Zoho CRM to manage customer records, including, in most cases, storing or linking to scanned copies of your mail for Virtual Address purposes.
• Advertising platforms (Meta, Google, TikTok, and other platforms we may use from time to time) — see Section 6.2 below.
• Google Calendar and other calendar or availability-management tools — where we integrate a Host’s calendar to show live availability for Spaces, we receive booking and availability information from that tool and may write booking details back to it as needed to facilitate the Marketplace.

We may also collect personal information from publicly available sources and from referees or other contacts you nominate, where reasonably necessary for our functions or activities and permitted by law. We will not collect sensitive information (as defined in the Privacy Act) about you unless you provide it to us and it is reasonably necessary for our functions or activities, or we are otherwise authorised by law to collect it.

3.4 AML/CTF compliance

We collect government-issued identification documents and other information reasonably necessary to verify the identity of our customers and, where applicable, their beneficial owners, authorised representatives and other relevant persons. This may include a copy of a passport, driver licence or other identification document; date of birth; residential address; business registration details; beneficial-ownership information; and information used for sanctions, politically exposed person and other screening.

We collect, use and disclose this information to comply with our obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), the AML/CTF Rules and other applicable laws; to conduct customer due diligence and ongoing monitoring; to assess and manage money-laundering, terrorism-financing and sanctions risks; and to report matters to AUSTRAC or another authority where required or authorised by law.

Providing this information is a condition of receiving a Virtual Address service or other relevant Services where identity verification is required. If you do not provide information reasonably required for these purposes, or we cannot satisfactorily verify it, we may be unable to provide, continue or renew the relevant Service. We retain AML/CTF records for the period required by applicable law.

4. How We Use Your Personal Information

• Providing the Services: to create and manage your account, process payments via Stripe, provide your Virtual Address (including scanning, storing, and — where requested — forwarding mail), facilitate Marketplace bookings between Hosts and Bookers, and provide customer support.
• Operating, maintaining, and improving the Services: to analyse usage, fix bugs, and optimise performance.
• Marketing and advertising (see Section 6.2): to send you marketing communications and to advertise our Services to you and to similar audiences on third-party advertising platforms.
• Security and fraud prevention: to detect, investigate, and act on suspected fraudulent, illegal, or harmful activity, including suspected misuse of a Virtual Address.
• Communicating with you: to respond to enquiries and provide support.
• Legal compliance: to comply with our legal obligations (including tax and corporate record-keeping obligations), enforce our Terms of Service, and protect our rights and the rights of our users.

We will not use personal information for purposes materially different from those described in this Policy unless permitted or required by law or with your consent.

5. Legal Bases for Processing (GDPR)

Where GDPR or UK GDPR applies to our processing of your personal information, we rely on the following legal bases:

6. Marketing and Advertising

6.1 Direct marketing

We may send you marketing communications about our Services by email or other channels. You can opt out at any time using the unsubscribe link in any marketing email, or by contacting us directly. Opting out of marketing does not affect non-promotional communications (such as account or subscription notices). We will comply with the Spam Act 2003 (Cth) when sending electronic marketing messages.

6.2 Advertising on third-party platforms

We use your personal information (such as your email address, in hashed form where supported) to advertise and market our Services on third-party advertising platforms, including Meta (Facebook/Instagram), Google (including Google Ads), TikTok, and any other advertising or marketing platform we may use from time to time. This includes:

• building custom or lookalike audiences from our customer or website-visitor data;
• using pixels or tags (such as the Meta Pixel, Google Ads tag, or TikTok Pixel) on our website to track conversions and re-target visitors with ads; and
• measuring and optimising the performance of our advertising campaigns.

Each advertising platform processes the information we share with it as an independent controller (or, in some cases, jointly with us) under its own privacy policy and terms — we encourage you to review Meta’s, Google’s, and TikTok’s respective privacy policies. You can manage or opt out of personalised advertising directly through each platform’s ad preference settings, and you can opt out of our use of your information for advertising purposes by contacting us or (for EU/UK visitors) withdrawing cookie consent as described in Section 7.

This clause applies to any advertising or marketing platform we use now or add in future, whether or not specifically named above.

7. Cookies

We use cookies, pixels, and similar technologies to operate our website, understand how it’s used, and serve advertising as described in Section 6.2.

If you are visiting from the EU, UK, or another jurisdiction requiring opt-in consent: non-essential cookies (analytics and advertising cookies, including the Meta Pixel, Google Ads tag, and TikTok Pixel) will only be set with your prior, informed consent via a cookie consent banner. You can withdraw or change your consent at any time using the cookie preference tool on our website.

For all other visitors: cookies operate on an opt-out basis — most browsers accept cookies by default, and you can remove or block them through your browser settings, though this may affect site functionality.

We honour the Global Privacy Control (GPC) signal where required by applicable law, treating it as a request to opt out of the sale/sharing of information or targeted advertising for that browser/device.

8. How We Disclose Personal Information

We disclose personal information to:

• Stripe, to process your payments.
• Google Workspace / Gmail, in connection with our business email correspondence with you.
• Zoho CRM, where your customer records (including, for Virtual Address customers, scanned mail in most cases) are stored and managed.
• Our employees and contractors based in Sydney and Melbourne, who are granted access only as needed to provide the Services (currently, access to Virtual Address and mail-related records is limited to our co-founders and Sydney/Melbourne-based employees and contractors).
• Meta, Google, TikTok, and other advertising platforms, as described in Section 6.2.
• Hosts and Bookers on the Marketplace, to the extent necessary to facilitate a booking (e.g. a Booker’s name and contact details may be shared with a Host, and vice versa).
• Professional advisers, regulators, and authorities, where required by law, to enforce our Terms of Service, or to protect our rights or the rights of others.
• A successor entity, in connection with a merger, acquisition, or sale of all or part of our business.

We do not sell your personal information for money. We do not use or disclose sensitive information (as defined in the Privacy Act) to infer characteristics about you, and we only disclose personal information overseas in accordance with Section 9 and APP 8.

9. International Data Transfers

We are an Australian business and primarily store data on servers in Australia. However, your personal information may be transferred to, and processed in, other countries — including the United States and India (e.g. via Stripe, Google, Meta, and TikTok) — in connection with the Services described above.

For personal information originating in the EU/UK: where we or our service providers transfer your personal information outside the EEA or UK to a country that has not been recognised as providing an adequate level of data protection (including Australia and the United States), we rely on appropriate safeguards recognised under GDPR/UK GDPR — including the European Commission’s Standard Contractual Clauses (SCCs) and, where applicable, the UK International Data Transfer Addendum — with the relevant recipient.

10. Your Rights and Choices

Depending on where you live, you may have some or all of the following rights. These are not absolute and may be subject to exceptions permitted by law.

• Access — request access to the personal information we hold about you.
• Correction / Rectification — request that we correct inaccurate or incomplete information.
• Deletion / Erasure — request that we delete your personal information, subject to legal retention obligations (e.g. tax/corporate records).
• Portability — request a copy of your information in a portable format, or that we transfer it to a third party, in certain circumstances.
• Restriction of Processing — ask us to pause our processing of your information while a request or dispute is resolved.
• Object — object to our processing of your information where we rely on legitimate interests, including for direct marketing, at any time and without needing to give a reason.
• Withdraw Consent — where we rely on your consent (e.g. cookie consent, marketing consent), withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
• Automated Decision-Making — we do not currently make any decisions about you based solely on automated processing (including profiling) that produce legal or similarly significant effects on you.
• Lodge a Complaint — see Section 12 below.

You can exercise these rights by contacting us at hello@spacepenguin.io. We may need to verify your identity before actioning a request, and we will respond within the timeframes required by applicable law (including the one-month default response period under GDPR and the reasonable period required under the Privacy Act and APPs).

11. Australian Privacy Act and Notifiable Data Breaches

We handle personal information in accordance with the 13 APPs under the Privacy Act, including in relation to the cross-border disclosure of personal information (APP 8) as described in Section 9.

If we experience a data breach that is likely to result in serious harm to affected individuals (an “eligible data breach” under the Notifiable Data Breaches scheme), we will notify the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable, in accordance with the Privacy Act. Where GDPR also applies, we will notify the relevant supervisory authority within 72 hours of becoming aware of a qualifying breach, and affected individuals where required.

12. Complaints

If you have a complaint about how we handle your personal information, please contact us first at hello@spacepenguin.io — all privacy complaints are handled centrally from our Melbourne, Victoria office, regardless of where you or the relevant service are based.

If you’re not satisfied with our response:

• Australian residents may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
• EU/UK residents may lodge a complaint with their local data protection supervisory authority (for example, the Information Commissioner’s Office (ICO) in the UK, or the relevant authority in your EU member state).

We will follow any applicable guidance or determinations issued by the OAIC in relation to our handling of personal information.

13. EU and UK Representatives

In accordance with Article 27 of the Regulation (EU) 2016/679 (GDPR) and Article 27 of the UK GDPR, we may appoint a representative in the European Union and a representative in the United Kingdom for data protection matters, given we have visitors and customers based in those regions. Their contact details will be included here once appointed.

14. Security and Retention

We take reasonable technical and organisational measures to protect your personal information, but no method of transmission or storage is completely secure, and we cannot guarantee absolute security. We require our service providers who handle personal information on our behalf to implement appropriate security measures.

We retain personal information for as long as needed to provide the Services, plus any additional period required to comply with our legal obligations (for example, Australian tax and corporate record-keeping laws typically require financial records to be kept for at least 7 years), resolve disputes, and enforce our agreements. Mail and parcel handling and retention follow the timeframes set out in our Terms of Service (Virtual Address — Mail and Parcel Handling). Marketing data is retained until you withdraw consent or opt out. When personal information is no longer required for these purposes, we will take reasonable steps to destroy or de-identify it, in accordance with APP 11.

15. Children’s Data

The Services are not intended for use by children, and we do not knowingly collect personal information from children. If you are a parent or guardian and believe your child has provided us with personal information, contact us to request its deletion.

16. User-Generated Content

If you post a review or other content in a public area of the Services, that content is publicly accessible, and we are not responsible for how others use information you choose to make public.

17. Third-Party Websites and Links

Our Services may link to third-party websites not controlled by us. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before providing them with information.

18. Contact Us

For any questions about this Privacy Policy, or to exercise any of your rights, contact us at:

SPACE PENGUIN PROPRIETARY LIMITED
hello@spacepenguin.io
Suite 1208/530 Little Collins Street, Melbourne VIC 3000