Skip to main content
Post an event

Legal information

Privacy Policy

How Find What’s On collects, uses, stores and protects personal information.

Last updated 5 October 2026

On this page

1. Policy statement

Find What’s On Pty Ltd (Find What’s On, we, us or our) respects the privacy of personal information provided to us.

We manage personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply, together with any other overriding requirements of law or contract.

2. What is personal information?

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable. It may be recorded in any form and does not need to be true to be personal information.

3. Personal information we collect

The information we collect depends on how you deal with us. It may include:

  • your name, email address, telephone number and postal address;
  • account details, login and email-verification status;
  • business, event, special and listing information you submit;
  • communications, support requests, complaints and feedback;
  • marketing preferences;
  • general demographic information such as age range or gender where voluntarily provided; and
  • technical information such as IP address, browser type, device information, referring pages and website usage data.

When you communicate with us through a social media service or another third-party application, we may receive information associated with that communication in accordance with your settings and the third party’s privacy practices.

4. Why we collect and use personal information

We collect and use personal information so we can:

  • create and administer accounts and verify email addresses;
  • provide, review, publish and manage business, event and special listings;
  • respond to enquiries, support requests, complaints and feedback;
  • identify you and maintain our relationship with you;
  • operate, secure, analyse and improve the Website and Services;
  • send service messages and information you request; and
  • send marketing where you have consented or where otherwise permitted by law.

If you do not provide information we reasonably require, we may not be able to create your account, publish your Content, respond to you or provide a requested service. Where lawful and practical, you may deal with us anonymously or using a pseudonym.

5. How we disclose personal information

We use and disclose personal information for the purpose for which it was collected, related purposes you would reasonably expect, purposes you consent to, and where required or authorised by law.

We may disclose information to:

  • hosting, email, analytics, security, support and other service providers that help us operate Find What’s On;
  • professional advisers and contractors who need the information to provide services to us;
  • law enforcement, courts, regulators and government agencies where required or authorised by law; and
  • a purchaser, related entity or adviser involved in a genuine sale, merger or restructure of the business, subject to appropriate confidentiality controls.

Information you choose to publish in a public business, event or special listing will be visible to Website visitors.

6. Direct marketing

We may use your contact details to provide information about Find What’s On products, services and updates where you have consented or where permitted by law. You may unsubscribe using the link in a marketing message or by contacting us. Service and account messages may still be sent where necessary.

7. Cookies and website analytics

Cookies are small files stored by your browser. We may use cookies and similar technologies to provide Website functionality, keep accounts secure, remember preferences, measure usage and improve performance.

We may use third-party analytics and online service providers. These providers may use cookies and may process technical information on servers outside Australia. You can configure your browser to reject or alert you about cookies, although some Website features may not work correctly.

Ticketing privacy

When you register for or purchase a native FWO ticket, we collect the purchaser and attendee information shown in the booking flow. This can include names, contact details, order and ticket references, event selections, check-in status, support messages, and refund or dispute records.

We use this information to calculate and confirm the order, issue and protect tickets, provide transactional event and safety updates, support attendees, operate check-in, prevent duplicate or fraudulent use, and administer cancellations, refunds, disputes and financial reconciliation.

We share only the information reasonably needed for those purposes with the event organiser and authorised venue staff. Payment and financial evidence is shared with our payment provider and relevant service providers when needed to process or reconcile a transaction, refund or dispute. We may also disclose information where required by law or to protect people, the event or the platform.

Full card details are collected and handled by the payment provider, not stored by FWO. FWO retains provider references and minimum financial evidence needed to confirm outcomes, prevent duplicate processing, support refunds or disputes, and maintain an audit trail.

FWO's native ticket checkout does not ask you for medical, dietary or accessibility information. Please do not include sensitive information in a free-text field. If FWO later needs a specific accessibility or safety detail for an event, the relevant flow will give a contextual collection notice, seek any required consent, explain the limited use, and restrict access to people who need it for that event.

If you book for another attendee, you must be authorised to provide their information and make this notice available to them. Optional FWO marketing permission is separate from accepting ticket terms, is not preselected, recorded as an auditable consent choice, and can be withdrawn from My tickets. Transactional ticket, safety, cancellation, change and refund messages do not depend on marketing consent. Before FWO sends ticket marketing, each marketing message must provide a working unsubscribe option.

Ticketing records are kept only for as long as reasonably needed for event delivery, support, security, fraud prevention, payment reconciliation, disputes, tax or other legal obligations and audit. Access is limited by role. Financial and contractual acceptance evidence is append-only; deletion or de-identification must follow applicable lifecycle and legal requirements, not a promise of automatic deletion immediately after an event. You can use the privacy contact details on this page to ask about access, correction or a privacy complaint.

ATDW licensed tourism content

Some event information and images are supplied by the Australian Tourism Data Warehouse (ATDW). To display this licensed content under our distribution arrangement, Find What's On uses ATDW-supplied delivery measurement on eligible pages, images and provider links. We treat this as strictly necessary processing for providing that content, not as optional FWO analytics.

When ATDW content is displayed or an ATDW-supplied link is opened, your browser makes a direct request to an approved ATDW service. ATDW may receive your IP address, browser user-agent, request time, the Find What's On site origin permitted by our referrer policy, and ATDW product, distributor, language and delivery-method identifiers. ATDW cookies may also be sent or set where browser policy permits. Find What's On does not add your name, email address, account or profile details, payment information, precise location or FWO search history to these ATDW requests.

Choosing Necessary only, closing the cookie prompt or declining optional analytics does not disable this required ATDW measurement. Optional FWO analytics are separate and run only if you choose Allow optional analytics. You can change that choice through Cookie settings. If you do not want the required ATDW requests, do not open pages or links containing identified ATDW content.

8. Storage, security and retention

Personal information is mainly stored using cloud and internet-based service providers. We take reasonable technical and organisational steps to protect it against misuse, interference, loss and unauthorised access, modification or disclosure.

No online system is completely secure. We retain information for as long as reasonably required for our business, legal, security and record-keeping purposes, then securely delete or de-identify it where appropriate.

Suspected data breaches

If we suspect a personal-information breach affecting accounts, businesses, marketing, Local Demand, ticketing, support or another FWO service, we take steps to contain and assess it, preserve necessary investigation evidence, and reduce harm. We notify affected people and the Office of the Australian Information Commissioner where the Privacy Act requires it. Notification includes practical protective steps and a contact route. Detailed response procedures are maintained internally.

9. Overseas service providers

FWO uses the services listed in our service-provider register for hosting, accounts, payments, email and selected features. Our primary Supabase database region is Sydney, Australia. That does not mean all processing, support, security logs, email or backups stay in Australia. Overseas processing may include the United States and other countries identified by each provider's current subprocessor list. A provider's sending or primary hosting region is not a guarantee about all of its processing.

Where required, we take reasonable steps to ensure overseas recipients handle personal information consistently with applicable Australian privacy requirements. We do not treat use of FWO as blanket consent to waive those protections. External social or other services you choose to open handle your communications under their own privacy terms. Contact us for information about a particular service or overseas recipient.

10. Accessing and correcting your information

You may ask for access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Contact us using the details below.

We may need to verify your identity before responding. In some circumstances the law allows us to refuse access; if that happens, we will explain the reason where we are permitted to do so.

11. Sensitive information

Please do not send health, racial or ethnic origin, religious belief, criminal-history, trade-union or other sensitive information unless a specific flow explains why it is needed. Native ticket checkout does not request medical, dietary or accessibility details. Where FWO intentionally collects sensitive information, the relevant flow must give a contextual notice, collect only what is reasonably necessary and obtain required consent unless a lawful exception applies. Merely sending information voluntarily is not treated as blanket consent.

For unsolicited sensitive information, we assess whether we could lawfully have collected it. Where required by law, and lawful and reasonable to do so, we destroy or de-identify information we could not have collected. We restrict its use and access during that assessment.

The Website contains links to third-party websites. Those websites are not governed by this Privacy Policy. Please review their privacy policies before providing personal information.

13. Changes to this policy

We may update this Privacy Policy from time to time. The current version will be posted on the Website with an updated date.

14. Privacy complaints

If you believe we have mishandled your personal information, please contact us first at hello@findwhatson.com. Tell us what happened and the outcome you are seeking. We will review your complaint and aim to respond within 30 days.

If you are not satisfied with our response, you may be able to lodge a written complaint with the Office of the Australian Information Commissioner (OAIC). Visit the OAIC privacy complaints page, email oaicintake@oaic.gov.au, call the OAIC Enquiries Line on 1300 363 992 for assistance, or write to GPO Box 5288, Sydney NSW 2001.

15. Contact us

For privacy questions, access or correction requests, or complaints, email hello@findwhatson.com.

Local Demand and your analytics choice

When Local Demand is turned on and you choose Allow optional analytics, we may record eligible event searches to help businesses understand what people are looking for nearby. Choosing Necessary only, making no choice or using an unreadable preference stops new collection. You can change your choice through Cookie settings. Changing it stops future collection but does not remove information already sent.

We record the search topic or category, time of the search, a broad search-area grid, search radius and a grouped result count. We do not show businesses your name, email address, precise location or individual search history. Small samples are hidden and businesses see combined insights rather than individual records.

To prevent duplicate or abusive submissions, we create a pseudonymous code from your IP address and browser details. We do not store the original IP address or browser details in Local Demand records. A marker kept for the current browser session prevents the same search from being counted more than once.

Detailed contribution records are scheduled for deletion after 15 days and rate-limit records after 2 days. Daily combined data is scheduled for deletion when it is more than 400 days old. Automated cleanup and monitoring must be working before collection starts, and collection pauses if cleanup is overdue. Backups, logs and restored data follow FWO's operational retention requirements.

Businesses may receive an aggregate preview in their weekly email only when the current primary owner has opted into that email. They can unsubscribe at any time.

Service-provider register

This register describes FWO's service providers, why we use them and the information involved. Information is shared only as needed for the relevant service; not every visitor uses every feature. We review this register when our providers or processing arrangements change. Linked provider lists describe their subprocessors, not a statement that every listed company receives your information.

  • Supabase: account/authentication, application records and uploaded files. Primary project region: Sydney, Australia. Support and subprocessors may involve other countries, including the United States; see Supabase subprocessors and its data-processing terms.
  • Vercel: application hosting, request processing, security and operational logs, including technical request information such as IP addresses and browser details. Processing may occur in the United States and other countries where it or its subprocessors operate; see Vercel data-processing terms.
  • Stripe: payment processing, payment and reconciliation evidence, including transaction details and relevant customer or organiser information. Card details are collected by Stripe. Stripe uses international processing, including the United States; an Australian connected account is not an Australia-only data-residency guarantee. See Stripe privacy information and data-processing terms.
  • Resend: contact, team, account/service and opted-in email communications, receiving email addresses and message content needed for those communications. Stored data is held in the United States; sending region does not change that. See Resend security and data location.
  • Google Places: address/location search and selected-place lookup when used; search input and request information are sent through the relevant flow. Google operates internationally, including the United States. See Google's privacy policy.
  • OpenAI: AI assistance where you use a relevant FWO feature. Requests contain the prompt and context needed for that feature; do not include sensitive information. Processing may occur in the United States and other countries described in OpenAI's subprocessor list; it should not be assumed to remain only in Australia.
  • ATDW: licensed tourism content and required browser delivery measurement described above. ATDW receives the limited technical request data described there. Delivery infrastructure may involve overseas processing; specific countries may vary.

If you follow a social-platform or other external link, that service handles the information you provide under its own privacy terms. Contact us using the details in this policy if you need more information about a provider or overseas recipient.