Privacy Policy

Effective Date: 6 August 2026

Prepared in accordance with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs). Queensland’s Information Privacy Act 2009 applies to Queensland public sector agencies and their contracted service providers rather than directly to private tourism operators; where relevant, we note QLD-specific practices below.

Before publishing: insert the exact registered legal entity name and ABN that operates Wilson Island Resort, and confirm the named Privacy Officer contact, in the highlighted fields below.

Wilson Island Resort (“the Resort,” “we,” “us,” or “our”) is operated by [Legal Entity Name], ABN [XX XXX XXX XXX], trading as Wilson Island Resort. We respect your privacy and are committed to handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This Policy explains what personal information we collect, how we collect, use, disclose, store and protect it, and how you can access or correct it or make a complaint.

Wilson Island respectfully acknowledges the Traditional Custodians of the Country on which we operate – the Gooreng Gooreng, Bailai, Gurang and Taribelang Bunda peoples – and pays respect to their Elders past, present and emerging.

Scope and Application
Definitions
Personal Information We Collect
How We Collect Your Personal Information
Cookies and Website Tracking Technologies
Why We Collect, Use and Disclose Your Personal Information
Direct Marketing
Who We Share Your Personal Information With
Cross-Border Disclosure of Personal Information
Data Quality
Data Security and Retention
Notifiable Data Breaches
Access to and Correction of Your Personal Information
Anonymity and Pseudonymity
Government-Related Identifiers
Minimum Age and Children’s Privacy
Complaints and How to Contact the Regulator
Changes to This Policy
Contact Us

1. Scope and Application

This Policy applies to personal information collected, used, held or disclosed by Wilson Island Resort in connection with our website, reservations, guest stays, on-island experiences, and marketing communications.
Wilson Island Resort and Heron Island Resort are associated Southern Great Barrier Reef properties operated within the same corporate group. Every Wilson Island stay begins with transit through Heron Island, where guests check in and collect snorkelling equipment before a boat transfer to Wilson Island. Personal information may accordingly be shared between the two properties for booking, transfer, and operational purposes – see Section 8.
This Policy does not apply to information about our employees or job applicants, which is handled under separate internal policies, or to information that is de-identified or publicly available.
This Policy may be supplemented by additional terms that apply to a specific transaction, such as our booking Terms & Conditions.

2. Definitions

Personal information has the meaning given in the Privacy Act 1988 (Cth): information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not.

Sensitive information is a subset of personal information that includes information such as health information, and is subject to higher protection requirements under APP 3.

APP entity means an organisation regulated by the Privacy Act 1988 and the Australian Privacy Principles.

Third party means any individual or organisation other than Wilson Island Resort and the individual the information is about.

Use means the handling of personal information within Wilson Island Resort; disclosure means making personal information available to someone outside Wilson Island Resort.

3. Personal Information We Collect

The personal information we collect depends on your interaction with us and may include:

Identity and contact details – name, address, email, telephone number, and date of birth (to confirm you meet our minimum age requirement of 18 years).
Booking and stay information – reservation dates, occupancy, exclusive-use booking details, special requests, dietary or accessibility requirements, and correspondence with our reservations team.
Payment information – billing details and payment card information, including the 20% deposit and balance payment for your stay, processed by us or our payment providers; card surcharge information (1.65%) is calculated based on your chosen payment method.
Travel and transfer details – itinerary information needed to coordinate your transit through Heron Island and boat transfer to Wilson Island, which may be shared with Heron Island Resort (see Section 8).
Health-related information (sensitive information) – dietary requirements, allergies, mobility, or other health-related information you choose to share so we can accommodate your stay. We only collect this with your consent and only to the extent reasonably necessary.
Website and device information – IP address, browser and device type, pages viewed, and referring website, collected automatically through cookies and analytics tools, including through our online booking platform.
Information you provide voluntarily – enquiries submitted through our contact form, feedback, and employment applications.

4. How We Collect Your Personal Information

4.1 Wherever reasonable and practicable, we collect personal information directly from you – through our website and online booking platform, our contact form, by telephone, email, or in person during your stay.

4.2 We may also collect personal information from third parties who are authorised to disclose it to us, including travel agents, online travel agencies, group booking organisers, and Heron Island Resort where your itinerary transits through that property.

4.3 At or before the time we collect personal information, we will take reasonable steps to notify you (or ensure you are aware) of our identity and contact details, the purposes of collection, the consequences if you do not provide the information, and how to access this Policy and make a complaint, consistent with APP 5.

4.4 If we receive unsolicited personal information that we could not have lawfully collected, we will destroy or de-identify it as soon as practicable where lawful and reasonable to do so, consistent with APP 4.

4.5 Where reasonable and practicable, you may interact with us anonymously or using a pseudonym (for example, a general enquiry) – see Section 14.

5. Cookies and Website Tracking Technologies

Our website uses cookies, analytics tools, and similar technologies to operate the site, remember your preferences, understand how visitors use our website, and support our online booking system (hosted on our third-party booking platform). Most browsers accept cookies automatically; you can change your browser settings to decline or be alerted to cookies, though some site features, including online booking, may not work correctly if you do.

6. Why We Collect, Use and Disclose Your Personal Information

We collect, use, and disclose personal information for purposes including to:

process and manage your reservation, deposit, balance payment, and any exclusive-use booking;
verify that you meet our minimum age requirement of 18 years;
process payments and prevent, detect and investigate fraud;
communicate with you about your booking, including seasonal closure dates (1 February – 1 April) and any date changes;
coordinate your transit and transfer arrangements through Heron Island Resort;
provide dining and on-island experiences you request;
with your consent, send you marketing and promotional communications (see Section 7);
operate, maintain, and improve our website and booking systems;
comply with our legal, regulatory, tax, and accounting obligations, including obligations under our Great Barrier Reef Marine Park Authority permit and conservation partnerships with Queensland Parks and Wildlife Service and the Gidarjil Land and Sea Rangers; and
manage and develop our business and guest experience.

We only use or disclose personal information for a purpose other than the purpose for which it was collected where you would reasonably expect this, where you consent, or where otherwise permitted by APP 6 (for example, to lessen or prevent a serious threat to life, health or safety).

7. Direct Marketing

With your consent, we may send you offers, newsletters, and promotional information about Wilson Island Resort and associated properties by email or other means. Every marketing communication includes a simple way to opt out, and you may also opt out at any time by contacting us (Section 19). We do not use or disclose sensitive information (such as health-related information) for direct marketing purposes.

We may disclose your personal information to:

Heron Island Resort, through which every Wilson Island stay transits, for the purpose of coordinating check-in, equipment collection, and boat transfer;
our online booking and property management platform provider (currently Newbook, an Australian-based reservations platform);
payment processors and financial institutions, to process deposits and balance payments;
boat transfer operators, to coordinate your travel to and from the island;
travel agents, online travel agencies, or group organisers through whom your booking was made;
Queensland Parks and Wildlife Service and the Gidarjil Land and Sea Rangers, only where necessary for conservation, safety, or permit-compliance purposes (for example, seasonal access arrangements) and generally not involving your personal contact details;
the Great Barrier Reef Marine Park Authority and other regulators, where required by our operating permits or by law;
our professional advisers (lawyers, auditors, insurers), where reasonably necessary;
a prospective buyer or its advisers, in connection with a sale, merger, or restructure of our business; and
any other party where you consent, or where disclosure is required or authorised by law.

We do not sell your personal information to third parties.

9. Cross-Border Disclosure of Personal Information

Some of our service providers – including website hosting and analytics providers, and members of our corporate group who support reservations and guest services – may store or process personal information outside Australia, including in Canada and the United States. Our online booking and property management platform is Australian-based and primarily stores data within Australia.

Before disclosing personal information to an overseas recipient, we take reasonable steps, consistent with APP 8, to ensure the recipient does not breach the APPs in relation to that information – for example, through contractual protections. We remain accountable for personal information handled by our overseas service providers in accordance with the Privacy Act, except where an exception under APP 8.2 applies. If you have questions about a specific overseas disclosure, contact our Privacy Officer (Section 19).

10. Data Quality

We take reasonable steps to ensure the personal information we collect, use, and disclose is accurate, up to date, and complete, having regard to the purpose of the use or disclosure, consistent with APP 10. You can help us do this by keeping us informed of any changes to your contact or booking details.

11. Data Security and Retention

11.1 We take reasonable technical and organisational steps to protect personal information we hold from misuse, interference, loss, and unauthorised access, modification, or disclosure, consistent with APP 11. These steps include restricting system access to staff who need it, securing our website and booking systems, and using contractual protections with service providers who handle personal information on our behalf.

11.2 We retain personal information only for as long as it is reasonably necessary for the purposes for which it was collected, or as required by law (for example, tax and accounting record-keeping obligations, generally up to seven years). Where we no longer need personal information and are not required by law to retain it, we take reasonable steps to destroy or de-identify it.

12. Notifiable Data Breaches

If we become aware of a data breach involving personal information we hold that is likely to result in serious harm to any individual affected (an “eligible data breach”), we will comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988. This includes carrying out a reasonable and expeditious assessment (generally within 30 days of becoming aware of a suspected breach), and, where an eligible data breach is confirmed, notifying the Office of the Australian Information Commissioner (OAIC) and affected individuals as soon as practicable, with a statement describing the breach, the information involved, and the steps we recommend individuals take.

13. Access to and Correction of Your Personal Information

13.1 You may request access to the personal information we hold about you by contacting our Privacy Officer (Section 19). We will respond within a reasonable period (generally within 30 days) and will provide access unless an exception under APP 12 applies (for example, where giving access would have an unreasonable impact on the privacy of others, pose a serious threat to life or safety, or where the request is frivolous or vexatious). If we refuse access, we will provide written reasons and information about how to complain.

13.2 You may ask us to correct personal information you believe is inaccurate, out of date, incomplete, irrelevant, or misleading. We will take reasonable steps to correct it, consistent with APP 13, or, if we disagree, we will take reasonable steps to associate a statement with the information noting your view and provide written reasons for our decision.

13.3 We may need to verify your identity before providing access to, or correcting, your personal information.

14. Anonymity and Pseudonymity

Where lawful and practicable, you may interact with us without identifying yourself or by using a pseudonym – for example, for a general enquiry about the Resort. This is not practicable for bookings, payments, age verification, or on-island stays, which require identifying information for safety, contractual, and regulatory reasons.

15. Government-Related Identifiers

We do not adopt government-related identifiers (such as a Medicare number, passport number, or driver’s licence number) as our own identifier for an individual. We only collect and use such identifiers where reasonably necessary to verify your identity or age, or to comply with a legal requirement.

16. Minimum Age and Children’s Privacy

Wilson Island Resort welcomes guests aged 18 years and over only, and we do not accept bookings for children. Accordingly, we do not knowingly collect personal information from children in connection with a Wilson Island booking or stay. Personal information about a child may still be collected in limited circumstances where your itinerary connects through Heron Island Resort as part of a broader family travel arrangement – in that case, the Heron Island Resort Privacy Policy applies to that portion of your information handling.

17. Complaints and How to Contact the Regulator

17.1 If you have a concern about how we have handled your personal information, please contact our Privacy Officer (Section 19) in the first instance. We will acknowledge your complaint, investigate it, and aim to respond within 30 days.

17.2 If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC), which regulates compliance with the Privacy Act 1988 nationally:

Mail: GPO Box 5288, Sydney NSW 2001
Phone: 1300 363 992 (Mon–Thu, 10am–4pm AEST/AEDT)
Online complaint form: oaic.gov.au (Make a privacy complaint)
Website: oaic.gov.au

17.3 Queensland’s Office of the Information Commissioner (OIC) oversees the Information Privacy Act 2009, which applies to Queensland government agencies and their contracted service providers. As a private tourism operator, Wilson Island Resort is generally regulated by the federal Privacy Act 1988 rather than the Queensland IP Act; however, where we deliver services under a Queensland government contract or permit (including our conservation partnership arrangements), we will comply with any applicable privacy obligations under that arrangement.

18. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or in applicable law. The current version will always be available on our website with its effective date. We encourage you to review it periodically.

19. Contact Us

Confirm the Privacy Officer’s name/title before publishing; the reservations contact below is used as a placeholder.

Privacy Officer: Wilson Island Resort
Location: Wilson Island, Southern Great Barrier Reef, Queensland, Australia
Email: reservations@wilsonisland.com
Phone: 1800 336 051

Contents