Who handles your information
Apollonaut Pty Ltd (ACN 703643485, ABN 74 703 643 485) operates apollonaut.com. We are the controller of the personal information we use to run this website, arrange admission, deliver tickets and support bookings made with us. Our operating address is Level 1, 63–73 Ann Street, Surry Hills NSW 2010, Australia.
This policy applies across our website, including our attraction guides and ticket pages. If an experience takes you to another seller’s checkout, that seller handles its own bookings and payments under its privacy notice. We still handle any enquiry you send directly to us. An attraction may separately collect information for entry or security under its own notice.
For a privacy question or request, email booking@apollonaut.com or write to our operating address.
Browsing, email and contact forms
Our hosting and security services process information about requests to the website, including IP address, browser, page requested, time and errors. Security controls use session identifiers and verification tokens to detect misuse or repeated submissions.
On the main Contact page, the email link opens your email app. When you use an attraction contact form, we collect the name, email address, subject and message you submit, plus a booking reference if you include one. We use that information to answer you and find any order you ask about. Please leave payment card details and unnecessary identity documents out of correspondence.
Essential storage protects booking and contact forms and remembers ticket selections while you book. Optional saved favourites keep experience identifiers on your device. Read our Cookie Policy for the storage we use and how to change your choices.
Ticket orders, payments and delivery
If you book through Apollonaut, we use the booking contact’s name, email and telephone number, including its country code. We record the attraction, date, time, product, ticket categories and quantities, prices and currency. We use references, order status, tickets and correspondence to arrange admission, handle changes and refunds, and provide support. For our current checkout, ticket quantities can include children without collecting each visitor’s name or date of birth. Any further information needed for a particular attraction will be identified when you book.
We send the provider handling your chosen payment the contact, order, amount and currency information needed for the transaction. We retain the payment reference, amount and status to reconcile the order or refund. Payment providers and participating financial institutions may also process device and payment information for authentication, fraud prevention and their own legal obligations.
Stripe. Where Stripe processes a card or supported wallet payment, card details are entered directly in its hosted payment interface. Our booking form does not receive your full card number or security code. See Stripe’s Privacy Policy.
Novalnet AG. If you select the option labelled “Novalnet” at checkout, Novalnet AG receives the customer, order and transaction information needed for that method. It handles the payment details and authentication information needed to process and secure the transaction. The information involved depends on the method you choose. See our Payment Policy.
We share the information needed to arrange entry with the attraction or ticket supplier and send tickets to the booking email address. When you request a resend or download, the ticket service uses the email address on the order and, for a direct PDF download, the booking reference to locate the tickets.
Our systems check submissions, update order status and help fulfil bookings. If the booked visit is unavailable, we seek your agreement to an alternative. Payment providers may carry out their own security checks. Contact us to ask for a review if you think a check has affected your booking incorrectly.
Page translation
Online translation is optional. If you allow it, GTranslate can send eligible public page text to Google for translation. Google can receive connection information such as your IP address and browser details. In booking flows that support label translation, only a catalogue of public labels is used. It excludes names, contact details, form values, booking references, selected visits and payment details. Protected customer pages and attraction contact forms are excluded from public-page translation.
Choosing English restores the original wording. You can withdraw permission in Cookie preferences. Withdrawal stops future optional use and does not reverse data already transmitted. For more information, see the Google and GTranslate privacy notices.
Who receives information
Kinsta hosts our website, and we use LatePoint on the website to manage booking records. Hostinger hosts our booking mailbox and handles enquiries, order emails and ticket attachments. Google processes the order notifications delivered to our operator’s Gmail mailbox. A notification can include the booking email, reference, chosen experience, visit details, quantities, amount and availability information.
Our team and the providers involved receive the information needed for their roles. We may share information with an attraction or ticket supplier to arrange admission, or with advisers and authorities where necessary for a legal obligation or claim. Ask us about the recipients for your order.
Purposes and legal grounds. Where the GDPR applies, we process information necessary to answer a pre-contract request you make or fulfil your booking under Article 6(1)(b), to meet a specific legal duty under Article 6(1)(c), and where necessary for our legitimate interests in site security, responding to general enquiries and handling disputes under Article 6(1)(f), subject to your interests and rights. We rely on consent under Article 6(1)(a) for optional features where consent is the basis. Without the required contact or booking details we may be unable to answer a form enquiry or supply tickets.
Your information may be processed in Australia, in the country of the attraction or in countries where our hosting, email, payment or translation providers operate. Where GDPR transfer rules apply to a transfer outside the EEA, the lawful basis for the transfer depends on its destination and purpose. It may be an adequacy decision, appropriate safeguards such as contractual protections, or a limited exception where its conditions are met. Contact booking@apollonaut.com to ask which recipients, destinations and safeguards apply to your booking and how to obtain relevant safeguards.
Security and retention
We use HTTPS and restrict access to people who need the information for their work. Booking and contact controls help prevent unauthorised access and duplicate submissions. Keep your booking reference, admission documents and private download links safe. Contact booking@apollonaut.com if you suspect someone has accessed them.
We keep order, payment-reference and delivery records as needed to supply tickets, handle enquiries, refunds and disputes, and meet accounting or other legal obligations. The appropriate period depends on the record, whether the order or a claim remains open and the law that applies. When no longer needed, we delete or de-identify information as the law permits. Expiry of a form session or ticket link does not in itself delete the order, emails, backups or a provider’s separate records.
An adult should arrange bookings for children. If a particular attraction needs information about a child, use the designated booking process and supply only what is requested.
Your privacy rights and how to complain
Email booking@apollonaut.com or write to our operating address to request access or correction, ask about recipients or make a complaint. Describe the information concerned and the outcome you seek. We may ask for proportionate proof of identity before releasing information.
Where the Australian Privacy Act 1988 applies, you can request access to and correction of your personal information. If we cannot resolve your privacy complaint, you can contact the Office of the Australian Information Commissioner.
Where the GDPR applies, you may have rights of access and a copy, correction, erasure, restriction and portability, subject to the applicable conditions. You may object to processing based on legitimate interests for reasons specific to you, or to direct marketing at any time. You can withdraw consent for future processing without affecting the lawfulness of earlier processing. Where the law protects against solely automated decisions with legal or similarly significant effects, you may have the right to request human review, express your view and contest the decision.
GDPR requests are usually free. We respond without undue delay, normally within one month. If complexity or the number of requests justifies an extension of up to two further months, we tell you why within the first month. Rights may be limited by legal retention obligations or other people’s rights. You may also complain directly to a supervisory authority, including where you live or work, or where you believe an infringement occurred.
Where to find updates
We update this policy when our practices change. Where a new use requires additional notice or consent, we address that separately. Last updated 31 October 2026.
