Privacy Policy.

01Who this policy covers

Stratosphere Group (we, us, our) is an Australian marketing practice based on the Gold Coast, Queensland. This policy explains how we handle personal information collected through this website, stratospheregroup.com.au, and through the enquiries and correspondence that follow it.

Stratosphere Group is a trading name of The Trustee for David Collins Family Trust (ABN 79 300 135 894).

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles.

02What we collect

When you complete the enquiry form on this website, we collect:

• your name
• your business email address
• your phone number
• your business or project name
• your project or business location
• whatever you choose to write in the message field

We also record a small amount of technical information that arrives with the enquiry, so that we can answer it properly and keep the form working:

• the page you submitted the enquiry from
• campaign parameters carried in the web address, such as utm_source, utm_medium, utm_campaign, utm_term, utm_content and gclid, which tell us which advertisement or link brought you to the site
• your IP address, used at the moment of submission to slow automated abuse. It is held only in the memory of the server handling that request and is not stored with your enquiry

If you email us, call us or meet with us, we collect what you tell us in that conversation, including anything you send us about your business or project.

We do not ask for sensitive information as the Privacy Act defines it, such as health, financial account or government identifier details. Please do not send it to us through the form.

03How we collect it

• directly from you, through the enquiry form, by email, by phone or in a meeting
• automatically, through website analytics, as section 07 describes
• from your organisation's publicly available business information, where we research an enquiry or a prospective engagement

Every field marked as required on the form is required because we cannot answer the enquiry sensibly without it. If you would rather not complete the form, the email address and phone number in section 14 reach us just as well.

04Why we collect it

• to answer your enquiry and have the conversation you asked for
• to prepare proposals and to deliver our services
• to keep a record of our dealings with you
• to understand which pages and campaigns lead to enquiries, so that we can improve this website
• to meet our legal, tax and record-keeping obligations

We use and disclose personal information only for these purposes, for a directly related purpose you would reasonably expect, where you have consented, or where the law requires or authorises it.

If we send you marketing material it will be because you asked for it or because you are a client, and every message will carry a simple way to unsubscribe. You can tell us to stop at any time using the details in section 14, and we will stop.

05Where your information is stored

Enquiries submitted through this website are stored in a Supabase database hosted in Sydney, Australia, in the Amazon Web Services ap-southeast-2 region.

The website itself, and the small piece of server code that receives the form, run on Vercel. A submission passes through Vercel's infrastructure, which may be located outside Australia, before it is written to the Sydney database.

Correspondence with you also lives in our business email and, where relevant, our proposal and project records.

06Who else handles it

We use a small number of service providers to run this website and to tell us that an enquiry has arrived:

• Supabase, which stores enquiries. Australia (Sydney).
• Vercel, which hosts the website and receives the form submission. Australia and overseas.
• Resend, which delivers the notification email that tells us an enquiry has arrived. United States.
• Google, which provides Google Analytics 4. United States and other countries.

These providers act for us and may handle your information only to deliver the service we have engaged them for. Because Resend and Google are located overseas, the notification of your enquiry and the website's analytics data are disclosed outside Australia. As Australian Privacy Principle 8 requires, we take reasonable steps to ensure that overseas recipients handle your information consistently with the Australian Privacy Principles, though we cannot control the law of every country in which they operate.

We may also disclose personal information to our professional advisers, or where we are required or authorised to do so by law. We do not otherwise disclose it.

07Cookies and analytics

We use Google Analytics 4 to count visits and to understand which pages and campaigns lead to enquiries. It sets cookies in your browser and records information such as the pages you view, the approximate location derived from your IP address, and the type of device and browser you use. IP addresses are anonymised. We do not use analytics to identify you, and we do not combine analytics data with the contents of your enquiry.

This website does not run advertising or remarketing pixels. If that changes, this policy will be updated before the change goes live.

You can block or clear cookies in your browser settings, or install Google's opt-out browser add-on. Doing so does not stop the enquiry form from working.

08We do not sell your information

We do not sell, rent or trade personal information. We do not pass it to other organisations for their own marketing, and we do not add you to anyone else's list.

09Keeping your information secure

The enquiry form submits over an encrypted connection. Enquiries are written into a database table protected by row-level security, using a key that is permitted to insert an enquiry and nothing else, so the website itself cannot read back what has been submitted. Access to the stored enquiries is limited to the people at Stratosphere who need it.

No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

10How long we keep it

We keep an enquiry for as long as we have a business relationship with you, or a reasonable prospect of one, and then for seven years, which is the period our tax and record-keeping obligations generally require. After that we delete it or de-identify it.

You can ask us to delete your enquiry sooner. We will do so unless we are required to keep it.

11Access and correction

You may ask for a copy of the personal information we hold about you, and you may ask us to correct it if it is wrong, out of date, incomplete or misleading. Write to the email address in section 14 and tell us what you need.

We do not charge for making a request. We will respond within 30 days. If we refuse access or refuse to make a correction, we will tell you why in writing and explain how you can complain.

12Complaints

If you believe we have mishandled your personal information or breached the Australian Privacy Principles, tell us first. Use the details in section 14. We will acknowledge your complaint within five business days and give you a written answer within 30 days.

If you are not satisfied with our answer, you can take the matter to the Office of the Australian Information Commissioner, by phone on 1300 363 992, in writing to GPO Box 5218, Sydney NSW 2001, or online.

13Changes to this policy

We update this policy when our practices or our service providers change. The current version always sits at this address, with the date it took effect at the top of the page. Where a change is material we will describe it here.

14How to contact us

For any question about this policy, or to make an access, correction or privacy complaint request: