Privacy Policy
Your privacy is our priority
Last updated: 14 August 2026
Table of Contents
1. Introduction
Welcome to Orbityx Islamica ("we", "us", "our", or "the Platform"). We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform and services.
By accessing or using Orbityx Islamica, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, please do not use our services.
Last Updated: 14 August 2026
This policy applies to all users including attendees, organizers, volunteers, team members, and organization administrators.
2. Information We Collect
2.1 Personal Information You Provide
Account Registration:
- Full name and email address
- Phone number (encrypted)
- Date of birth (encrypted, for age verification)
- Profile photo and avatar
- Gender (for gender-segregated events)
Event Registration:
- Event attendance history
- Ticket purchases and payment information
- Check-in/check-out timestamps
- QR codes and verification tokens
Volunteer Applications:
- Home address (encrypted)
- Emergency contact information
- Skills and experience
- Working With Children Check number (encrypted)
- Police check status
Organization Information:
- Organization name and type
- Business address and contact details
- ABN/registration numbers
- Stripe Connect account information
2.2 Automatically Collected Information
- Device Information: Browser type, operating system, device identifiers, IP address
- Location Data: Geolocation (with permission), suburb, state, postcode
- Usage Data: Pages visited, time spent, click patterns, search queries
- Cookies: Session cookies, preference cookies, analytics cookies
- Log Data: Server logs, error reports, performance metrics
2.3 Communications and Interactions
- Messages sent through the platform (attendee-organization communications)
- Team chat messages and collaboration data
- Comments, reviews, and ratings on events and venues
- Social interactions (likes, shares, follows, friend requests)
- Support requests and feedback submissions
3. How We Use Your Information
Primary Purposes:
- To provide, maintain, and improve our platform services
- To facilitate event registration, ticketing, and check-in
- To enable communication between attendees and organizations
- To process volunteer applications and manage team coordination
- To send transactional emails (confirmations, reminders, updates)
- To personalize your experience and provide recommendations
- To ensure platform security and prevent fraud
- To comply with legal obligations and enforce our terms
Legitimate Interests:
We process certain information based on our legitimate interests, including platform analytics, service improvement, fraud prevention, and marketing (with your consent where required). You have the right to object to processing based on legitimate interests.
4. Information Sharing and Disclosure
We do NOT sell, rent, or trade your personal information to third parties. We only share information in the following circumstances:
With Organizations
When you register for an event, volunteer for an organization, or message an organization, we share necessary information (name, email, ticket details) with that organization to facilitate the service.
Service Providers
We share data with trusted third-party providers (payment processors, email services, cloud hosting) who process data on our behalf under strict confidentiality agreements.
Legal Requirements
We may disclose information if required by law, subpoena, court order, or government request, or to protect our rights, property, or safety, or that of others.
With Your Consent
We share information with third parties only when you explicitly consent, such as connecting social media accounts or enabling third-party integrations.
Data Processing Agreements:
All third-party processors are bound by data processing agreements that require them to maintain the confidentiality and security of your information and use it only for specified purposes.
5. Data Security
Security Measures:
- Encryption: Sensitive data (phone numbers, addresses, ID numbers) encrypted at rest using AES-256
- Transmission: All data transmitted via HTTPS/TLS 1.3 encryption
- Access Control: Role-based access control (RBAC) and multi-factor authentication
- Audit Logs: Comprehensive logging of all data access and modifications
- Regular Audits: Security assessments and penetration testing
- Data Minimisation: We collect only necessary information
Important Notice
While we implement industry-standard security measures, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security but continually work to improve our protections.
APP 11.3 — Technical & Organisational Measures (2024 Reform)
In accordance with the Privacy and Other Legislation Amendment Act 2024, we maintain both technical and organisational measures to protect your personal information, taking continuing and proactive steps:
- • Technical measures: AES-256 encryption at rest, TLS 1.3 in transit, role-based access control (RBAC), multi-factor authentication, comprehensive audit logging, automated security scanning, and intrusion detection
- • Organisational measures: Appointed Privacy Officer, staff privacy training, documented data-handling policies, incident response procedures, vendor due diligence, and regular compliance reviews
- • Proactive measures: Continuous monitoring, breach detection systems, and 72-hour cyber incident reporting capability under the Cyber Security Act 2024
Automated Decision-Making & AI (APP 1 — Effective 10 Dec 2026)
We use automated processing for event recommendations, content moderation, fraud detection, and volunteer matching. These processes are regularly reviewed and do not produce solely automated legal or similarly significant decisions about you. Where automated decision-making is used, you have the right to request human review of the outcome. To exercise this right, contact privacy@orbityx.com.
Statutory Tort for Serious Invasions of Privacy (2024 Reform)
The Privacy and Other Legislation Amendment Act 2024 introduced a statutory tort allowing individuals to sue for serious invasions of privacy. We are committed to ensuring our data practices do not give rise to such claims and maintain robust safeguards against misuse of your personal information.
6. Data Retention
We retain your personal information only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law.
| Data Type | Retention Period | Reason |
|---|---|---|
| Account Information | Until account deletion + 7 years | Legal/tax requirements |
| Event Records | 7 years after event | Financial records |
| Volunteer Applications | 7 years after last activity | Employment law |
| Messages | Until deleted by user | User control |
| Analytics Data | 26 months | Analytics purposes |
| Security Logs | 12 months | Security monitoring |
Your Rights: You can request deletion of your account and personal data at any time. We will retain certain information as required by law or for legitimate business purposes (e.g., fraud prevention).
7. Your Privacy Rights
Under Australian Privacy Principles (APPs) and other applicable laws, you have the following rights:
Access
Request a copy of your personal information
Correction
Request correction of inaccurate data
Deletion
Request deletion of your data (right to be forgotten)
Portability
Receive your data in a structured, machine-readable format
Restriction
Request restriction of processing
Objection
Object to processing based on legitimate interests
Withdraw Consent
Withdraw consent at any time
Complaint
Lodge a complaint with supervisory authority
How to Exercise Your Rights:
To exercise any of these rights, please contact us at:
Email: privacy@orbityx.com
Phone: +61 XXX XXX XXX
Address: [Your Business Address], Australia
We will respond to your request within 30 days.
8. International Data Transfers
Orbityx Islamica is based in Australia, but we use cloud infrastructure that may process data in other countries.
Data Transfer Safeguards:
- All international transfers comply with Australian Privacy Principles
- We use Standard Contractual Clauses (SCCs) where applicable
- Cloud providers maintain adequate security certifications (SOC 2, ISO 27001)
- Data is encrypted during transfer and storage
9. Children's Privacy
Age Restrictions:
Our services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are under 13, please do not use our services or provide any personal information.
Parental Consent (Ages 13-17):
Users aged 13-17 require parental or guardian consent to:
- Register for certain events
- Volunteer for organizations
- Participate in certain community features
Children's Online Privacy Code (2024 Reform):
The Office of the Australian Information Commissioner (OAIC) is developing a Children's Online Privacy Code under the 2024 privacy reforms. This code will set additional standards for online services likely to be accessed by children. We are actively monitoring the development of this code and will update our practices to ensure full compliance upon its finalisation. Parents and guardians can manage their child's data through our Family Link Hub and parental consent features.
10. Cookies and Tracking
We use cookies and similar tracking technologies to enhance your experience, analyze usage, and personalize content.
Essential Cookies
Required for platform functionality (authentication, security, session management). Cannot be disabled.
Preference Cookies
Remember your settings, language preferences, and accessibility options.
Analytics Cookies
Help us understand how users interact with our platform (Google Analytics, Mixpanel).
Your Cookie Choices:
You can control cookie preferences through your browser settings or our Cookie Consent Manager. Note that disabling certain cookies may affect platform functionality.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
Notification Process:
- We will notify you of material changes via email and/or platform notification
- Updated policy will be posted on this page with revised "Last Updated" date
- Continued use after changes constitutes acceptance of updated policy
12. Contact Us
If you have any questions, concerns, or complaints about this Privacy Policy or our data practices, please contact us:
Privacy Officer
Email: privacy@orbityx.com
Phone: +61 XXX XXX XXX
Address: [Your Business Address]
Data Protection Authority
You also have the right to lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
www.oaic.gov.au
1300 363 992
This Privacy Policy is designed to comply with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) as amended by the Privacy and Other Legislation Amendment Act 2024, the Cyber Security Act 2024, the Notifiable Data Breaches scheme, GDPR (where applicable), and other relevant privacy legislation.