Your Privacy
Privacy Policy
Explore Sydney Harbour respects your privacy. This policy explains what personal information we collect, how we use and protect it, who we share it with, and the rights you have — whether you are in Australia, Europe, the United Kingdom or the United States.
Last updated: 14 June 2026 · Effective: 14 June 2026
1. Who we are
Explore Sydney Harbour provides self-drive guided speedboat tours on Sydney Harbour, departing from Rose Bay, New South Wales, Australia.
In this policy, "Explore Sydney Harbour", "ESH", "we", "us" and "our" refer to the business operating as Explore Sydney Harbour [Sailfish Holdings Pty Ltd trading as Explore Sydney Harbour, ABN 61 615 109 110"]. We are the data controller responsible for the personal information described in this policy.
You can reach us at any time using the details in the How to contact us section.
2. Scope of this policy
This policy applies to personal information we collect through our website at exploresydneyharbour.com.au, when you book or take a tour, buy a gift voucher, subscribe to our emails, or otherwise contact us.
We are committed to handling personal information in accordance with the privacy laws that apply to our customers, including:
the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and the Spam Act 2003 (Cth);
the EU General Data Protection Regulation (GDPR) and the UK GDPR and Data Protection Act 2018, where they apply to visitors and customers in the European Economic Area (EEA) and United Kingdom; and
United States privacy laws including the California Consumer Privacy Act, as amended by the CPRA (CCPA/CPRA), and comparable state laws, where they apply to US residents.
If you do not agree with this policy, please do not use our website or services.
3. Quick summary
The table below is a plain-English overview. The rest of this policy gives the full detail.
Topic
In short
What we collect
Your name, contact details, booking and tour details, payment confirmation (not full card numbers), emails you send us, and limited technical data from our website.
Why
To take and manage your booking, run your tour safely, process payments and refunds, respond to enquiries, meet legal obligations, and — only with your consent — send you our guide and occasional offers.
Who we share with
Trusted service providers (e.g. our booking/payment platform, email and analytics providers) and authorities where required by law. We do not sell your personal information.
Marketing
Only if you opt in. You can unsubscribe at any time using the link in every email.
Your rights
Access, correction, deletion, objection and more — depending on where you live (see Section 13).
4. Information we collect
Information you give us
Booking & contact details — your name, email address, phone number, the tour, date and time you select, the number of participants, and any notes you provide (for example accessibility, language, dietary or medical information you choose to share so we can run your tour safely).
Gift voucher details — your name and contact details as the purchaser, and the recipient's name and email if you ask us to deliver a voucher to them.
Payment information — payments are processed by our third-party booking and payment providers. We receive confirmation that a payment succeeded and limited transaction details. We do not collect or store your full card number or security code on our own systems.
Communications — the content of emails, calls, text messages and form submissions when you contact us, and reviews or feedback you provide.
Marketing preferences — your email address and consent if you request our Insider Guide or subscribe to updates.
Information we collect automatically
Technical & usage data — when you visit our website we may collect your IP address, device and browser type, the pages you view, referring website, and the date and time of your visit, through cookies and similar technologies (see Section 9).
Information from third parties
Booking platform — when you book or pay, our booking provider passes us the booking and contact details you entered.
Reviews & social media — if you tag us or leave a public review (for example on TripAdvisor or Google), we may see the information you have chosen to make public.
5. How we use your information
We use personal information to:
take, confirm, manage and deliver your booking, gift voucher or tour;
operate the tour safely, including responding to safety, accessibility or medical matters you have told us about;
process payments, refunds, reschedules and cancellations;
send booking confirmations, reminders, weather updates and other service messages relating to your tour;
respond to your enquiries and provide customer support;
send you our Insider Guide and marketing communications where you have consented;
improve our website, services and customer experience, including through analytics;
protect our business and customers, prevent fraud and resolve disputes; and
comply with our legal, tax, insurance and regulatory obligations.
6. Legal bases for processing (EEA & UK)
If you are in the EEA or the UK, the GDPR requires us to have a legal basis for using your personal information. We rely on the following:
Performance of a contract — to take and deliver your booking, process payment, and provide the tour or voucher you have purchased.
Consent — to send marketing emails and our Insider Guide, and to set non-essential cookies. You can withdraw consent at any time.
Legal obligation — to comply with tax, accounting, safety and other laws that apply to us.
Legitimate interests — to run, secure and improve our business, respond to enquiries, prevent fraud and keep records — where these interests are not overridden by your rights.
7. Bookings & payment processing
Our bookings and online payments are handled through FareHarbor, our third-party booking and reservation platform. We may also offer Afterpay as a payment option, and other payment methods from time to time. When you book or pay:
the details you enter are processed by the relevant provider under their own privacy and security arrangements;
card payments are encrypted and handled by the payment provider — we do not see or store your full card details; and
we receive the booking and contact information needed to deliver your tour, together with confirmation of payment.
Please review the privacy terms of FareHarbor, Afterpay and any other payment provider you use, as their handling of your data is governed by their own policies.
8. Marketing & the Insider Guide
If you request our "Sydney Harbour Insider Guide" or subscribe to our updates, we will email you the guide and may send occasional tips and offers from Explore Sydney Harbour.
Your choice, always. We only send marketing emails where you have opted in. Every marketing email contains an unsubscribe link, and you can opt out at any time. We never share or sell your details to other businesses for their own marketing.
Unsubscribing from marketing will not stop service messages that we need to send about a booking you have made (for example a confirmation, reschedule or weather notice).
9. Cookies & analytics
Our website uses cookies and similar technologies to make the site work, remember your preferences, and understand how the site is used so we can improve it. Cookies fall into broad categories:
Essential cookies — needed for the site and booking process to function.
Google Analytics cookies — help us understand which pages are popular and how visitors move through the site.
Marketing cookies e.g. Meta Pixel — may be used to measure the effectiveness of our advertising.
Where required by law (including in the EEA and UK), we ask for your consent before setting non-essential cookies, and you can change your choices at any time through our cookie settings. You can also control cookies through your browser settings. Some embedded features — such as our booking calendar, maps and fonts — are provided by third parties that may set their own cookies.
10. Who we share your information with
We share personal information only as needed to run our business and as described here. We share with:
Service providers who help us operate — including our booking and payment platforms (FareHarbor, Afterpay), email and marketing tools, website hosting, analytics, and map and font providers — who may only use the data to provide their service to us;
Professional advisers such as our accountants, insurers and lawyers, where reasonably necessary;
Authorities and third parties where we are required or permitted by law, to comply with a legal request, or to protect the safety, rights or property of our guests, our staff or others; and
A successor if our business is sold or reorganised, subject to this policy.
We do not sell your personal information, and we do not "sell" or "share" it for cross-context behavioural advertising as those terms are defined under United States privacy laws, except as may occur through standard advertising cookies if enabled — which you can opt out of (see Section 13).
11. International data transfers
We are based in Australia, and some of our service providers are located in other countries, including the United States and the European Union. This means your personal information may be stored or processed outside the country where you live.
When we transfer personal information across borders, we take reasonable steps to ensure it is protected to a standard consistent with this policy and applicable law. For transfers of EEA or UK personal data to countries without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum) where required.
12. Storage, security & retention
We take reasonable steps to protect personal information from misuse, loss, and unauthorised access, modification or disclosure — including using reputable providers, encryption in transit for payments, access controls and secure storage.
No method of transmission or storage is completely secure, so we cannot guarantee absolute security. We keep personal information only for as long as we need it for the purposes described in this policy, or for as long as required to meet legal, tax, accounting, insurance and dispute-resolution obligations, after which we securely delete or de-identify it.
13. Your privacy rights
Your rights depend on where you live. In all cases, you can contact us using the details in Section 17 to exercise them, and we will respond within the time required by law. We will not discriminate against you for exercising your rights.
Everyone
You can ask us to access the personal information we hold about you, to correct it if it is inaccurate, and to stop sending you marketing.
Australia
Under the Australian Privacy Principles you may request access to, and correction of, your personal information. If you have a privacy concern, please contact us first so we can resolve it. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
European Economic Area & United Kingdom (GDPR / UK GDPR)
If the GDPR or UK GDPR applies to you, you have the right to:
access your personal data and receive a copy;
have inaccurate data corrected and incomplete data completed;
have your data erased ("right to be forgotten") in certain circumstances;
restrict or object to our processing in certain circumstances, including objecting to direct marketing;
data portability — to receive certain data in a portable format; and
withdraw consent at any time, without affecting processing already carried out.
You also have the right to lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office at ico.org.uk).
United States — California (CCPA/CPRA) and other states
If you are a California resident, you have the right to:
know the categories and specific pieces of personal information we have collected, the sources, purposes, and the categories of third parties we disclose it to;
delete personal information we have collected, subject to legal exceptions;
correct inaccurate personal information;
opt out of any "sale" or "sharing" of personal information and limit the use of sensitive personal information (we do not sell personal information — see Section 10); and
be free from discrimination for exercising your rights.
You may submit a request using the contact details in Section 17, and you may use an authorised agent. Residents of other US states with comparable privacy laws may have similar rights, which we honour where they apply.
14. Children's privacy
Our website and services are directed to adults. Bookings must be made by a person aged 18 or over, and participation is subject to the age requirements set out in our Terms & Conditions and FAQ. We do not knowingly collect personal information directly from children. Where a child takes part in a tour, their details are provided to us by a booking adult, parent or guardian. If you believe a child has provided us with personal information without appropriate consent, please contact us and we will delete it.
15. Third-party links
Our website may link to or embed third-party sites and services (for example maps, social media, review platforms and our booking calendar). We are not responsible for the privacy practices of those third parties, and we encourage you to read their privacy policies.
16. Changes to this policy
We may update this policy from time to time to reflect changes in our practices or the law. The "Last updated" date at the top shows when it was last revised. Material changes will be posted on this page, and where appropriate we will notify you.
17. How to contact us
If you have any questions, requests or complaints about your privacy or this policy, please contact us:
Explore Sydney Harbour
Email: info@exploresydneyharbour.com.au
Phone: 0468 328 000 (within Australia) · +61 468 328 000 (international)
11/15 Huddart Ave, Normanhurst NSW 2076, Australia
We will acknowledge your request and respond within the timeframe required by the law that applies to you.