Privacy Policy

Nestapik (“we”, “us”, “our”) is committed to protecting the privacy of everyone who contacts us, visits our website or takes part in our events. This Privacy Policy explains how we collect, use, disclose and protect your personal information, and your rights in relation to it.
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), together with other relevant Australian privacy requirements. Where this policy refers to legal obligations, those are Australian obligations.


Who We Are
Nestapik is an independent offline tabletop gaming club based in Newcastle, New South Wales. We are the organisation responsible for the personal information described in this policy.
Nestapik
45 Hunter Street
Newcastle NSW 2300
Australia
Phone: +61 2 4916 3367
Email: info@nestapik.com

Information We Collect
We collect personal information that you provide to us and information generated when you use our website.
Reservation form data. When you submit a reservation request, we collect your:

• full name
• email address
• telephone number
• selected event
• preferred day
• number of participants
• experience level
• privacy consent
• Communications. If you contact us by phone or email, we collect the information you choose to share and keep a record of our correspondence.
• Event administration. We may keep records relating to reservations, confirmations, attendance and participation fees so that events run smoothly.
• Technical website information. When you visit our website, we may automatically collect limited technical information such as your IP address, browser type, device information and usage data, including through cookies and similar technologies (see the Cookie Information section below).

Why We Collect and Use Your Information
We collect and use personal information for purposes that are directly related to our activities as a tabletop gaming club, including to:

• receive and process reservation requests
• confirm availability, capacity, fees and event details
• administer and run our weekly events
• communicate with you about your reservation or enquiry
• provide customer support
• handle participation fees where applicable
• maintain the security and functionality of our website
• comply with our legal and record-keeping obligations

We collect personal information by lawful and fair means, generally directly from you. We only use and disclose your information for the purposes for which it was collected, for directly related purposes you would reasonably expect, or as otherwise permitted or required under the Privacy Act 1988 and the Australian Privacy Principles — for example, where you have consented or where the use or disclosure is required or authorised by law.

Disclosure of Your Information
We do not sell your personal information. We may disclose it to:

• Service providers who help us operate, such as IT and administrative support providers, on the basis that they protect your information and use it only for the services they provide to us.
• Hosting providers that host our website and store data on our behalf.
• Payment providers, where a participation fee is processed electronically, to the extent needed to complete that transaction.
• Authorities or third parties where disclosure is required or authorised by law.

Overseas disclosure. Some of our service or hosting providers may store or process data on servers located outside Australia. Where this occurs, we take reasonable steps to ensure your information is handled consistently with the Australian Privacy Principles.

Data Security
We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include access controls, secure storage and working with providers that maintain appropriate safeguards. No method of transmission or storage is completely secure, but we work to protect your information at all times, and we take reasonable steps to destroy or de-identify personal information once it is no longer needed for any permitted purpose.

Data Retention
We do not keep personal information longer than necessary. We retain different categories of information for different periods, based on the purpose for which it was collected and any applicable Australian legal or record-keeping requirements. The periods below reflect our general approach; where a specific legal requirement applies, we follow that requirement.

Reservation requests (unconfirmed)
What is retained: the details submitted through the reservation form for requests we do not confirm or that do not proceed.
Why: to process and respond to your request and manage capacity.
Retention: generally up to 3 months from the date of the request.
After this period: the data is securely deleted or de-identified unless you have asked us to keep it or another category below applies.
Confirmed reservations
What is retained: reservation and confirmation details for events you are booked into.
Why: to administer the event, communicate with you and manage attendance.
Retention: generally up to 12 months after the relevant event.
After this period: the data is securely deleted or de-identified, unless it also forms part of financial records (see below).
Cancelled reservations
What is retained: records of reservations that are cancelled by you or by us.
Why: to manage cancellations, handle any related queries and resolve disputes.
Retention: generally up to 12 months from the cancellation.
After this period: the data is securely deleted or de-identified unless a dispute remains open.
Attendance and event administration records
What is retained: records of who attended which events and related operational notes.
Why: to run events effectively and improve how we organise the program.
Retention: generally up to 24 months.
After this period: the data is securely deleted or de-identified.
Customer correspondence
What is retained: emails, call notes and other communications between you and us.
Why: to provide support, maintain continuity and resolve any issues.
Retention: generally up to 24 months from the last contact.
After this period: the correspondence is securely deleted unless it relates to an unresolved matter or another category below.
Payment-related records (where applicable)
What is retained: records of participation fees paid, such as transaction references and receipts (we do not store full card numbers).
Why: to manage payments and meet our financial obligations.
Retention: retained for at least 5 years, consistent with Australian taxation record-keeping guidance from the Australian Taxation Office.
After this period: the records are securely deleted or de-identified once no longer required.
Accounting and tax records
What is retained: financial records relating to our operations.
Why: to meet Australian taxation and accounting requirements.
Retention: at least 5 years, in line with Australian Taxation Office guidance on keeping records.
After this period: the records are securely deleted or de-identified once no longer required.
Marketing consent records (where applicable)
What is retained: records of any consent you give or withdraw for marketing communications.
Why: to respect your choices and demonstrate that we have your consent.
Retention: for as long as the consent is active, plus up to 24 months after it is withdrawn so we can show that your preference was honoured.
After this period: the records are securely deleted or de-identified.
Technical and security logs
What is retained: website and system logs, including limited technical data.
Why: to maintain security, diagnose issues and keep the website working.
Retention: generally up to 12 months.
After this period: the logs are deleted or de-identified in the ordinary course.
Privacy requests and related correspondence
What is retained: requests to access or correct your information, privacy complaints and our responses.
Why: to handle your request properly and demonstrate that we have met our obligations.
Retention: for as long as needed to resolve the matter and demonstrate compliance, generally up to 7 years.
After this period: the records are securely deleted or de-identified.
Where information falls into more than one category, we apply the longest relevant retention period. These periods are based on our legitimate operational and legal needs. Where no specific statutory period applies, we use a reasonable, purpose-based period as explained above.

Access and Correction
You have the right to ask for access to the personal information we hold about you and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. To make a request, contact us using the details below. We will respond within a reasonable time and in accordance with the Australian Privacy Principles. In limited circumstances we may decline a request, in which case we will explain why.

Privacy Complaints
If you have a concern about how we have handled your personal information, please contact us first so we can try to resolve it. We take complaints seriously and will respond within a reasonable period. If you are not satisfied with our response, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Cookie Information
Our website uses cookies and similar technologies to help it work properly and to understand how it is used.

• What cookies are. Cookies are small text files placed on your device when you visit a website. They help the site function, remember your preferences and collect information about how the site is used.
• Necessary cookies. These are essential for the website to operate, such as enabling core functionality and security. The site cannot function properly without them, so they do not require consent.
• Preference cookies. These remember choices you make, such as settings and preferences, to give you a more personalised experience.
• Statistics cookies. Where used, these help us understand how visitors interact with our website by collecting information in an aggregated form, so we can improve the site.
• Marketing cookies. Where used, these may be set to help measure the effectiveness of any promotion of our events. We only set them where you have given consent, and you can withdraw that consent at any time.
• Unclassified cookies. Occasionally, cookies are in the process of being categorised. Where this applies, we work to classify them appropriately.
• Managing your preferences. You can manage or change your cookie preferences at any time through our cookie preferences tool, and you can control cookies through your browser settings.

Changing or withdrawing consent for non-essential cookies is possible at any time; doing so will not affect the essential functioning of the site.

Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The “Last updated” date at the top shows when it was last revised. We encourage you to review it periodically.

Contact Us
For any privacy question, access or correction request, or complaint, please contact:
Nestapik
45 Hunter Street
Newcastle NSW 2300
Australia
Phone: +61 2 4916 3367
Email: info@nestapik.com