Privacy Policy

1. About this policy

This policy explains what personal information Yarra Pacific Pty Ltd (ACN 701 796 705, ABN 76 701 796 705), trading as Yinfinite Travel, collects about you, why we collect it, who we give it to, how long we keep it, and what you can do about it. Where this policy says "Yinfinite", "we", "our" or "us", it means that company.

We have written it to describe what we actually do. Where a statement in this policy is not true of our practice, the statement is the thing that is wrong, and we will fix it.

Our position under the Privacy Act — stated plainly Yinfinite is a small business operator. Under the Privacy Act 1988 (Cth), most businesses with an annual turnover of $3 million or less are not bound by the Act. On our current turnover, the Act is unlikely to apply to us, and we have not opted in to be covered by it. We are telling you this rather than claiming a legal status we do not have. We have chosen to handle personal information in line with the Australian Privacy Principles as a matter of our own policy, and everything set out below is a commitment we make to you directly. Other laws — including the prohibition on misleading conduct in the Australian Consumer Law, and the Spam Act 2003 (Cth) for marketing email — apply to us regardless. If our circumstances change so that the Privacy Act does apply to us, we will update this policy and say so.

2. What we collect

Everyone who contacts us

• your name, email address, phone number and country of residence
• your postal address, where we need it
• what you tell us about the travel you are interested in

People we arrange travel for

• Traveller details — full name as it appears on the passport, date of birth, nationality, and the details of everyone travelling with you
• Passport details — passport number, expiry date, issuing country, and occasionally an image of the passport photograph page, but only where a supplier requires it and only for as long as the booking needs
• Health and accessibility information — mobility, fitness, medical conditions relevant to travel, allergies, and dietary requirements, including where those arise from religious observance. This is sensitive information and we ask for it only when a supplier needs it, with your consent
• Preferences — seat and room preferences, interests, past travel, and dates you are marking
• Contact details for an emergency contact, where you give them to us

Anyone who uses our website

• standard technical information and usage data — pages viewed, referring link, approximate location derived from your IP address — collected through cookies and the visitor analytics built into our website platform, described in section 11 below

We never collect your card number You pay suppliers or Fora directly, so we do not ask for, receive or store card or bank account numbers. If you are ever asked to send card details to Yinfinite by email or messaging app, that request did not come from us.

3. How we collect it

Mostly, you give it to us:

• through the enquiry form on our website
• by email
• in conversation

We also collect information about other travellers from the person making the booking. If you book for other people, we rely on you to tell them that we hold their information and to point them to this policy. We ask you to confirm that you are authorised to give it to us.

We collect website usage information automatically, through cookies and analytics.

We do not buy personal information from data brokers or list vendors, and we do not sell, rent or trade your personal information to anyone.

4. Why we collect it

We do not use your personal information for automated decision-making that produces a legal or similarly significant effect on you.

5. Sensitive information

Health information, and information about your religious observance where it arises from a dietary requirement, is sensitive information.

We ask for it only where a supplier needs it to deliver your travel safely, such as:

• a dietary requirement passed to a hotel
• an accessibility requirement passed to a guide
• an altitude-related condition passed to a ground operator

We ask for your consent before we collect it, at the point we collect it, and we tell you which suppliers it will go to. You can decline. If you do, we will still arrange your travel, but we may not be able to arrange it in a way that accommodates a requirement we do not know about.

We do not use health information for marketing, ever.

We do not collect medical records, test results or details of medical treatment. If you arrange a health appointment through one of our hospital partners, you share your medical details directly with the hospital. If you send us medical information anyway, we will delete it and ask you to send it to the hospital directly.

6. Who we give it to

We disclose personal information to:

• Travel suppliers — hotels, tour operators, guides, drivers, destination management companies, transport providers, cruise lines and airlines, in the countries you are travelling to. This is the core of what we do: a hotel cannot hold a room without a name
• Fora Travel, Inc. (United States), which provides the booking platform, supplier relationships and payment processing we use
• The messaging platform we talk to you on — in practice this is usually WhatsApp, operated by Meta Platforms, Inc. in the United States. If you send us traveller details, or an image of a passport page, by WhatsApp, that information passes through and is held on Meta’s systems. If you would rather not use it, tell us and we will use email instead
• Our website platform and hosting — our site is built and hosted on Lovable, which includes its own visitor analytics and stores those measurements with Tinybird
• Our other service providers — our email hosting provider; and, if and when we start a newsletter, the email marketing platform we use for it, which we expect to be Mailchimp
• Our professional advisers, such as our accountant or a lawyer, where we need advice
• Government authorities, where we are required to by law, or where a destination country requires traveller information for entry

We do not disclose personal information for anyone else's marketing purposes.

7. Information that goes overseas — please read this

Arranging international travel means sending your information to other countries. There is no way to book a hotel in Kyoto without the hotel in Kyoto knowing who is arriving.

Your information is likely to be disclosed to recipients in:

• the United States — Fora Travel, Inc., Meta Platforms, Inc. (WhatsApp), our website platform Lovable and its analytics provider Tinybird, and our email provider
• mainland China, Hong Kong and Macau
• Japan
• Vietnam, Thailand, Cambodia, Laos, Indonesia, Singapore and Malaysia
• any other country you are travelling to or through, and countries where airline and global distribution systems process passenger name records

What we can and cannot promise about this We will only send what a supplier actually needs, and we will tell you where your information is going. But we cannot promise that an overseas recipient will handle your information to Australian standards, and we will not pretend that we can. Once your information is with a hotel in Dali or a ground operator in Hanoi, it is governed by that country's law, not Australia's, and Australian avenues of complaint and redress may not be available to you. By asking us to arrange travel to a destination, you consent to us disclosing your information to suppliers there on that basis. If you would rather we did not, tell us — but in most cases it will mean we cannot make the booking.

Mainland China specifically. Hotels and accommodation providers in mainland China are required to register the passport details of foreign guests with local public security authorities. That is a legal requirement in China and it is not something we or the hotel can opt out of. Chinese suppliers are also subject to Chinese law, including the Personal Information Protection Law. Hong Kong and Macau have their own separate entry and registration requirements.

The United States. Fora Travel, Inc. holds booking and traveller information on its platform in the United States, where it is subject to United States law, including lawful access by United States authorities.

8. How long we keep it

When a retention period ends we delete the information or de-identify it. Where information sits in a backup, it is deleted when that backup cycles.

9. How we protect it

We are a small business and we are honest about what that means: our protections are the ones a careful small business can actually maintain, not an enterprise security program.

What we do:

• multi-factor authentication on our email and on every business account that offers it
• a password manager, with a unique password for every service
• full-disk encryption and a passcode on every device that holds client information
• passport details requested only when a supplier requires them, kept in one place, and deleted on the schedule above
• card numbers never requested, received or stored
• access limited to Michelle Yin; no contractor, virtual assistant or bookkeeper currently has access to client files. If that changes, they will be bound by a written confidentiality obligation and we will update this policy
• reputable suppliers for hosting, email and analytics

We cannot guarantee that your information will never be compromised, and we will not claim that we can. No business can. What we can say is that these measures are in place and that we keep them in place.

If a data breach occurs that is likely to cause you serious harm, we will tell you and tell you what to do about it, promptly, whether or not we are legally required to.

10. Marketing

We will only send you marketing email if you have asked for it, or if you have given us your details in the course of an enquiry or booking and would reasonably expect to hear from us about similar travel.

Every marketing email will:

• identify us
• include our contact details
• carry a working unsubscribe link

Unsubscribing is free, takes one click, and does not require you to log in or give us any further information. We will action it within 5 working days at the latest, and in practice immediately.

We will never sign you up to a list because you sent us an enquiry, unless you tick the box asking us to. That box is never pre-ticked.

We do not share your details with any other business for that business's marketing.

11. Cookies and analytics

Our website uses a small number of cookies and similar technologies. A cookie is a small text file that a website asks your browser to store. Local storage and session storage do a similar job inside your browser; session storage is cleared when you close the tab.

What we use:

• Site function cookies. These keep the site working, for example page navigation, form submission and security. They are set by us and by Lovable, our website platform, and last for the session or up to 12 months.
• Visitor analytics. Our website platform, Lovable, includes its own visitor analytics, which runs from our own domain rather than a third-party script. It uses a cookie and local and session storage to count visitors rather than visits, records page views, referring links and approximate location derived from your IP address, and stores those measurements with Tinybird. These last up to 12 months.

What we do not use. We do not use Google Analytics, advertising, remarketing or conversion pixels, or cross-site tracking. We do not combine your visit with what you do on other websites, and we do not sell, rent or trade information collected through cookies or analytics. Our fonts and images are served from our own website.

How to control cookies. Every major browser lets you block or delete cookies and clear local and session storage in its privacy settings. Blocking strictly necessary cookies may stop parts of the site from working. Browser tracking protection, and extensions such as uBlock Origin, will also stop our analytics counting your visit. If you would rather we held no analytics record of your visit, email hello@yinfinite.com.au with roughly when you visited and we will ask our platform to remove it.

Why there is no cookie banner. Australia has no law requiring a cookie consent banner. Because we use analytics only, and nothing for advertising, we have chosen clear disclosure here instead. If we add advertising or remarketing technology, or begin marketing to people in the European Union or the United Kingdom, we will add a consent banner and update this section before it goes live. If you are visiting from the EU or the UK and would like us to delete information associated with your visit, email hello@yinfinite.com.au and we will.

Some pages link to tours you can book on Context Travel's website. If you follow one of these links, Context Travel's own terms, cookie and privacy policies apply on their site, and we may receive a commission if you book.

12. Getting access to your information, and correcting it

You can ask us for a copy of the personal information we hold about you, and you can ask us to correct anything that is wrong.

Email hello@yinfinite.com.au. We will respond within 30 days. There is no charge.

We may need to verify who you are first. If we cannot give you something — for example because it would reveal another traveller's personal information — we will tell you why.

You can also ask us to delete information we hold about you. We will do so unless we need to keep it for a booking in progress, or because a law requires us to keep it (tax records, for example). We will tell you which applies.

13. If you have a privacy concern

Please tell us first — hello@yinfinite.com.au. We will acknowledge within 5 business days and respond substantively within 30 days.

If you are not satisfied with our response:

• Because we are not currently covered by the Privacy Act 1988 (Cth), the Office of the Australian Information Commissioner may not be able to investigate a complaint against us. You can still contact the OAIC at oaic.gov.au for information about your options, and if our status changes, the OAIC pathway will be open to you
• If we have not done what this policy says we do, you can raise that with Consumer Affairs Victoria at consumer.vic.gov.au or the ACCC, because a business that does not do what its privacy policy says may be engaging in misleading conduct
• For unwanted marketing email, you can complain to the Australian Communications and Media Authority at acma.gov.au
• Since 10 June 2025, Australian law has also provided a statutory cause of action for serious invasions of privacy, which is available against businesses whether or not they are covered by the Privacy Act

14. Changes to this policy

We may update this policy. The current version is always at www.yinfinite.com.au with a "last updated" date. If a change is material and we hold your contact details, we will tell you.

15. Contact

• Yarra Pacific Pty Ltd trading as Yinfinite Travel
• ACN 701 796 705 · ABN 76 701 796 705
• PO Box 4058, Balwyn East VIC 3103
• hello@yinfinite.com.au