Privacy Policy

1. Introduction

Wahoo Pool Aquatics Pty Ltd (“Wahoo”, “we”, “us”, or “our”) respects your privacy and is committed to protecting your personal information in accordance with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs).

This policy explains how we collect, hold, use, disclose, and safeguard personal information submitted through our website wahoopoolaquatic.com.au, our sales and estimation team, and the course of our commercial aquatic construction services.

By using our website or engaging our services, you acknowledge that you have read and understood this policy.

2. Information We Collect

We collect personal information that is reasonably necessary to deliver our commercial aquatic services. This typically includes:

• Contact details: full name, company name, phone number, email address, postal address.
• Project details: project location, service interest, project stage, procurement model, timeline, and any technical brief information you provide.
• Consent records: confirmation of acceptance of this policy and marketing consent where applicable.
• Technical information: IP address, browser type, operating system, referring URL, pages viewed, and time spent — collected automatically via cookies and analytics tools.
• Commercial records: contract documents, variation registers, invoices, and correspondence relating to engaged projects.

We do not collect sensitive information (e.g. health, racial, political, religious data) unless you voluntarily provide it and its collection is necessary for a specific, legitimate purpose.

3. How We Collect Information

We collect information in the following ways:

• Directly from you — via lead forms, phone enquiries, email correspondence, or in-person meetings.
• Automatically — via our website (cookies, server logs, analytics platforms).
• From third parties — such as main contractors, architects, or building certifiers where you are a listed party on a commercial project.
• Publicly available sources — ASIC, QBCC, or other regulatory registers when conducting contract due diligence.

4. Why We Collect & Use It

We use personal information for the following purposes:

• Responding to your commercial brief or feasibility enquiry.
• Preparing quotes, tender packages, and engineering memos.
• Coordinating with your construction team, consultants, and regulators during delivery.
• Managing contracts, invoicing, warranty obligations, and defects liability periods.
• Issuing capability statements, certifications, and compliance documentation on request.
• Internal record-keeping, quality assurance, and service improvement.
• Complying with legal and regulatory obligations (QBCC, NSW Fair Trading, tax).
• Sending occasional updates, capability statements, or thought-leadership material where you have opted in.

5. Disclosure to Third Parties

We do not sell personal information. We may disclose it to the following categories of recipients, only as strictly necessary to deliver our services or comply with law:

• Service providers: email delivery (Resend), website analytics (Google), advertising platforms (Meta/Google Ads), project management tools, accounting platforms. Each operates under appropriate data processing agreements.
• Project stakeholders: main contractors, architects, consultants, certifiers, councils, and subcontractors engaged on your project — only to the extent required for delivery.
• Regulatory and legal authorities: QBCC, NSW Fair Trading, the Australian Taxation Office, or courts — when required by law or subpoena.
• Professional advisers: insurers, lawyers, and auditors in the ordinary course of operating our business.

6. Analytics, Cookies & Tracking

Our website uses cookies and similar technologies across three categories:

• Essential cookies: required for core website functionality (session, security, form submission).
• Analytics cookies: Google Analytics 4 (GA4) — anonymised visitor flow and page-level performance.
• Advertising cookies: Meta Pixel and Google Ads conversion tags — measuring commercial lead campaign effectiveness.

You can control or disable cookies via your browser settings. Disabling cookies may limit website functionality. To opt out of Google Analytics specifically, install the Google Analytics Opt-out Browser Add-on.

7. Data Security

We implement reasonable physical, technical, and administrative measures to protect personal information, including:

• TLS/HTTPS encryption in transit across all website traffic.
• Encrypted cloud storage for contract documents and project records.
• Role-based access controls limiting who can view or edit client data.
• Staff training on data-handling obligations and confidentiality.
• Regular security audits of third-party service providers.

Despite best efforts, no digital transmission or storage system is 100% secure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the OAIC in accordance with the Notifiable Data Breaches scheme.

8. Data Retention

We retain personal information only for as long as necessary for the purposes described in this policy, and to comply with legal, tax, and contractual obligations:

• Lead enquiries (no engagement): 24 months from last contact.
• Contracted project records: 7 years post-practical-completion (aligned with Queensland statutory limitation periods).
• Analytics data: 14 months (GA4 default retention).
• Marketing opt-ins: until consent is withdrawn.

At the end of these periods, we securely delete or de-identify data unless a longer retention is required by law.

9. Your Rights

Under the Australian Privacy Principles, you have the right to:

• Access: request a copy of the personal information we hold about you.
• Correction: ask us to correct information that is inaccurate or out of date.
• Deletion: request deletion of your data where we are not legally required to retain it.
• Withdraw consent: opt out of marketing communications at any time via the unsubscribe link in any email or by contacting us directly.
• Complain: if you believe we have breached privacy obligations — first to us, then to the OAIC if unresolved.

We will respond to verified requests within 30 days. No fee is charged for access or correction requests.

10. International Data Transfers

Some of our service providers (such as Resend, Google, and Meta) host data in the United States or European Union. When personal information is transferred overseas, we take reasonable steps to ensure it is protected to a standard broadly equivalent to Australian law — through contractual data processing agreements and by engaging providers certified under recognised frameworks (EU-US Data Privacy Framework, Standard Contractual Clauses).

11. Children's Privacy

Our services are commercial in nature and directed at businesses, developers, councils, and operators. We do not knowingly collect personal information from individuals under 18. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it.

12. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, technology, or legal obligations. The effective date appears at the top of the page.

For material changes we will either notify active clients directly or display a prominent notice on the website before the changes take effect. Continued use of our website or services after the effective date constitutes acceptance of the revised policy.

13. Contact & Complaints

Privacy enquiries, access or correction requests, and complaints should be directed to our Privacy Officer:

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001