Privacy Policy
Merquello Royal Hotel — operated by
Effective date: 1 July 2025
1. Introduction
(ACN 678 345 912 / ABN 48 678 345 912), whose registered address is , owns and operates the Merquello Royal Hotel and this website at merquelloroyalhotel.com (the "Website"). In this Privacy Policy we are referred to as "we", "us" or "our".
We are committed to handling your personal information responsibly and in accordance with the Privacy Act 1988 (Cth) (the "Privacy Act") and the Australian Privacy Principles (APPs) contained in Schedule 1 to that Act. This Privacy Policy explains what personal information we collect through the Website, why we collect it, how we use and disclose it, and what rights you have in relation to it.
Please read this Privacy Policy carefully before using the Website or submitting any personal information to us. By continuing to use the Website, you acknowledge that you have read and understood this Privacy Policy.
2. Data Controller and Contact Details
is the entity responsible for the personal information collected through this Website. If you have any questions, concerns or requests relating to this Privacy Policy or the handling of your personal information, please contact our Privacy Officer using the details below.
| Detail | Information |
|---|---|
| Legal entity | |
| ACN | 678 345 912 |
| ABN | 48 678 345 912 |
| Registered address | |
| Privacy enquiries email | privacy@merquelloroyalhotel.com |
We aim to respond to all privacy-related enquiries within 30 days of receipt.
3. Personal Information We Collect
We collect personal information only to the extent necessary for the purposes described in this Privacy Policy. The categories of personal information we collect through this Website are set out below.
3.1 Contact and Reservation-Request Information
When you complete a contact form, accommodation enquiry or reservation request on the Website, we collect the information you provide, which may include:
- Full name
- Email address
- Telephone number
- Postal or billing address
- Intended arrival and departure dates
- Room or suite preferences
- Number and age range of guests in your party
- Any special requests or accessibility requirements you choose to share
- Payment card details (collected and processed via our secure payment service provider; we do not store full card numbers on our own systems)
- Any other information you voluntarily include in a free-text message field
3.2 Device, Browsing and Technical Information
When you visit the Website, certain information is automatically collected by our servers and, where you have given consent, by cookies and similar technologies. This information may include:
- IP address
- Browser type and version
- Operating system and device type
- Referring URL and exit page
- Pages viewed and time spent on each page
- Date and time of each visit
- Search terms used within the Website
- Clickstream data
3.3 Cookie and Consent Data
We use cookies and similar tracking technologies on the Website. When you first visit the Website, you are presented with a cookie consent notice. The choices you make, together with a record of the date and time of your consent or withdrawal, are stored as consent data. Full details of the cookies we use and the purposes they serve are set out in Section 5 of this Privacy Policy.
3.4 Special-Category Personal Data
We do not routinely seek to collect special-category personal data through this Website. If you voluntarily include such information in a free-text field (for example, as part of an accessibility or dietary request), we will handle it with additional care and use it only for the purpose for which it was provided.
3.5 Casino-Related Age Verification
Our property includes a casino facility. The minimum age for entry to and participation in any gaming activity at the casino is 18 years. We do not use this Website to conduct age verification for casino entry; that process takes place in person at the property in accordance with applicable Victorian gaming laws. However, where Website enquiries relate to casino services, we may ask you to confirm that you are aged 18 or over before we respond to those enquiries.
4. How We Collect Personal Information
We collect personal information through the following means:
- Directly from you — when you complete and submit a form on the Website, send us an email via a mailto link, or interact with any interactive feature on the Website.
- Automatically — through server logs, cookies and similar technologies when you browse the Website, as described in Section 3.2 and Section 5.
- From third-party booking platforms — where you initiate a reservation through an authorised third-party channel and that channel transmits your details to us to fulfil the booking.
Where we collect personal information about you from a third party, we take reasonable steps to ensure that you were made aware that your information might be shared with us for that purpose, or that we are otherwise authorised to collect and use it under the Privacy Act.
6. Purposes for Which We Use Your Personal Information and Legal Bases
We use the personal information we collect for the purposes set out below. We handle personal information in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). Where we rely on a specific justification for handling your information, we describe that justification alongside the relevant purpose.
| Purpose | Description | Justification under the Privacy Act |
|---|---|---|
| Responding to enquiries | Handling and responding to questions, reservation requests, and other communications you send through the Website. | Necessary to take steps at your request prior to entering into, or to perform, a contract with you; or otherwise with your consent. |
| Processing reservations | Creating, managing and confirming accommodation and related bookings, including communicating pre-arrival information. | Necessary to perform a contract with you. |
| Payment processing | Facilitating secure payment for bookings made through or confirmed via the Website. | Necessary to perform a contract with you. |
| Website operation and security | Maintaining the technical operation, security and integrity of the Website, including fraud prevention and abuse detection. | Our legitimate interests in protecting our systems and our guests. |
| Analytics and improvement | Analysing aggregated usage data (with your consent to analytics cookies) to understand how visitors interact with the Website and to improve its content and usability. | Your consent. |
| Personalisation | Remembering your preferences (such as language or currency settings) to provide a more consistent experience. | Your consent (where achieved through preference cookies) or our legitimate interests in providing a coherent user experience. |
| Legal and regulatory compliance | Retaining records as required by applicable Australian laws and regulations, including tax, gaming and anti-money-laundering obligations. | Compliance with a legal obligation. |
| Responding to legal claims | Establishing, exercising or defending legal claims or rights in connection with our business. | Our legitimate interests in protecting our legal position. |
We will not use your personal information for any purpose that is incompatible with the purposes listed above without first notifying you and, where required, obtaining your consent.
7. Disclosure of Personal Information
We do not sell, rent or trade your personal information to third parties for their own marketing purposes. We may disclose your personal information to the following categories of recipients only to the extent necessary for the purposes described in this Privacy Policy.
7.1 Service Providers
We engage third-party service providers to assist us in operating the Website and delivering our services. These providers act on our instructions and are required by contract to handle personal information securely and only for the purposes we specify. They include:
- Website hosting and infrastructure providers
- Payment processing service providers
- Reservation and property management system providers
- Email and communication platform providers
- Website analytics service providers (where you have consented to analytics cookies)
- IT security and fraud prevention service providers
7.2 Professional Advisers
We may share personal information with our legal advisers, accountants and insurers where necessary in the ordinary course of our business operations or to protect our legal rights.
7.3 Regulatory and Government Bodies
We may disclose personal information to government agencies, law enforcement bodies or regulators where we are required to do so by law, or where disclosure is necessary to prevent or report suspected unlawful activity.
7.4 Business Transfers
In the event of a proposed or actual merger, acquisition, restructure or sale of all or part of our business, your personal information may be disclosed to the relevant counterparties and their advisers as part of due diligence, and may be transferred to a successor entity. If this occurs, we will take reasonable steps to ensure that the successor entity handles your personal information in a manner consistent with the Privacy Act.
7.5 With Your Consent
We may share your personal information with other third parties where you have expressly consented to such sharing.
8. Overseas Disclosure of Personal Information
Some of the third-party service providers we use to operate the Website may store or process personal information on servers located outside Australia. Before disclosing your personal information to an overseas recipient, we take reasonable steps to ensure that the recipient either:
- is subject to a law or binding scheme that, overall, provides a level of protection for individuals that is at least substantially similar to that provided by the APPs; or
- has agreed by contract to handle your personal information in accordance with the APPs.
Where we disclose personal information to an overseas recipient in circumstances where we are not able to ensure it will receive equivalent protection, we will seek your consent to that disclosure or will otherwise rely on an applicable exception under the Privacy Act. By using the Website and providing personal information to us, you acknowledge that such overseas disclosures may occur in the circumstances described above.
The countries in which our service providers may process personal information include, but may not be limited to, the United States of America, member states of the European Union, Singapore and the United Kingdom. This list may be updated as our service provider arrangements change.
9. Retention of Personal Information
We retain personal information only for as long as is reasonably necessary to fulfil the purposes for which it was collected, unless a longer retention period is required or permitted by law. The following general retention principles apply to personal information collected through this Website.
| Category of Information | General Retention Period |
|---|---|
| Enquiry and contact-form data (where no booking results) | 12 months from the date of the enquiry, or such shorter period as the enquiry is resolved, unless you request deletion earlier. |
| Reservation and guest-booking records | 7 years from the date of the relevant stay or booking, in accordance with applicable Australian tax and commercial record-keeping obligations. |
| Payment transaction records | 7 years from the date of transaction, in accordance with applicable financial record-keeping obligations. |
| Website server logs and technical data | Up to 12 months from collection, unless longer retention is required for security or fraud investigation purposes. |
| Cookie consent records | Retained for the duration of the cookie consent record required to demonstrate compliance with applicable privacy obligations, generally up to 3 years. |
When personal information is no longer required, we take reasonable steps to destroy or de-identify it securely.
10. Security of Personal Information
We take the security of your personal information seriously. We implement reasonable technical and organisational measures designed to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure. These measures include:
- Encryption of data in transit using Transport Layer Security (TLS) technology
- Access controls that restrict access to personal information to authorised personnel who require it to perform their duties
- Contractual requirements imposed on our service providers to maintain appropriate security standards
- Regular internal reviews of our information security practices
- Secure disposal and destruction of personal information that is no longer required
No method of electronic transmission or storage is completely secure. While we take reasonable steps to protect your personal information, we cannot guarantee absolute security. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately at privacy@merquelloroyalhotel.com.
10.1 Data Breach Notification
We are subject to the Notifiable Data Breaches (NDB) scheme under the Privacy Act. If we suffer an eligible data breach that is likely to result in serious harm to any individual whose personal information is involved, we will notify the affected individual(s) and the Office of the Australian Information Commissioner (OAIC) as required by law and as soon as practicable after we become aware of the breach.
11. Your Rights in Relation to Your Personal Information
The Privacy Act and the APPs provide you with certain rights in relation to the personal information we hold about you. These rights are described below, together with information on how to exercise them.
11.1 Right of Access
You have the right to request access to the personal information we hold about you. We will respond to a valid access request within 30 days. In some circumstances the Privacy Act permits us to refuse access or to provide access in a limited form; if this applies, we will explain our reasons in writing.
11.2 Right to Correction
If you believe that personal information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, you may request that we correct it. We will take reasonable steps to correct the information within 30 days of receiving a valid correction request or, if we are unable to do so, to attach a notation to the information indicating that you dispute its accuracy.
11.3 Right to Withdraw Consent
Where we process your personal information on the basis of your consent (for example, in relation to non-essential cookies), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal. You can manage cookie-based consents through our cookie preference centre; for other consent-based processing, please contact us at privacy@merquelloroyalhotel.com.
11.4 Anonymity and Pseudonymity
Under APP 2, you have the option of not identifying yourself, or of using a pseudonym, when dealing with us in relation to this Website, unless it is impracticable for us to deal with you in that way or we are required or authorised by law to deal with identified individuals. For example, if you wish to submit a general enquiry without identifying yourself, you may do so; however, we will not be able to process a reservation request or respond substantively to account-specific queries without sufficient identifying information.
11.5 How to Exercise Your Rights
To exercise any of the rights described in this section, please submit a written request to:
Privacy OfficerEmail: privacy@merquelloroyalhotel.com
We may ask you to verify your identity before we process your request. This is to ensure that personal information is not disclosed to, or altered at the request of, any person other than the individual to whom it relates. We will not charge a fee for submitting an access or correction request, although we may charge a reasonable fee for providing access where permitted by law.
12. Responsible Gaming and Relevant Regulatory Resources
The casino facilities at the Merquello Royal Hotel are available only to persons aged 18 years or over. We are committed to supporting responsible gaming at our property.
The Victorian Commission for Gambling and Liquor Regulation (VCGLR) is the independent statutory authority responsible for regulating gambling in Victoria. The VCGLR publishes guidance on responsible gambling practices and makes available information about self-exclusion options and support resources for individuals who wish to limit or cease their gambling activity. You can access these public resources at the VCGLR's official website.
Gambling Help Online is a national service that provides free and confidential support for people concerned about their own or someone else's gambling. It can be reached at gamblinghelponline.org.au or by calling 1800 858 858 (available 24 hours a day, 7 days a week).
If you wish to enquire about voluntary self-exclusion arrangements at our property, please contact us directly at our front desk or by email at privacy@merquelloroyalhotel.com. Any personal information you provide in connection with a self-exclusion request will be handled with the utmost discretion and used solely for the purpose of administering and enforcing the self-exclusion arrangement.
13. Links to Third-Party Websites
The Website may contain links to third-party websites, including booking platforms, local attractions and partner services. This Privacy Policy applies only to the Website operated by at merquelloroyalhotel.com. We are not responsible for the privacy practices or content of any third-party websites. We encourage you to read the privacy policies of any external websites you visit.
14. Children's Privacy
This Website is not directed at children under the age of 18, and we do not knowingly collect personal information from children under that age. If you are a parent or guardian and believe that your child has submitted personal information to us through this Website without your consent, please contact us at privacy@merquelloroyalhotel.com and we will take reasonable steps to delete that information promptly.
15. Complaints and How to Make Them
If you believe that we have mishandled your personal information or have not complied with the Privacy Act or the APPs, we encourage you to contact us in the first instance so that we have the opportunity to address your concern.
15.1 Internal Complaint Process
Please submit your complaint in writing to:
Privacy OfficerEmail: privacy@merquelloroyalhotel.com
We will acknowledge your complaint promptly and aim to provide a substantive response within 30 days. If your complaint is complex or requires further investigation, we will keep you informed of our progress and expected timeframes.
15.2 Complaint to the Office of the Australian Information Commissioner (OAIC)
If you are not satisfied with our response to your complaint, or if we have not responded within 30 days, you may refer your complaint to the Office of the Australian Information Commissioner (OAIC). The OAIC is the independent national regulator responsible for privacy and freedom of information. The OAIC can investigate complaints about alleged interferences with privacy under the Privacy Act.
You can contact the OAIC as follows:
- Website: www.oaic.gov.au
- Post: GPO Box 5218, Sydney NSW 2001
- Phone: 1300 363 992
16. Governing Law
This Privacy Policy is governed by and is to be construed in accordance with the laws of the State of Victoria and the Commonwealth of Australia. Any dispute arising in connection with this Privacy Policy or the handling of your personal information will be subject to the non-exclusive jurisdiction of the courts of Victoria, Australia.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, the Website, or applicable laws and regulations. When we make material changes, we will update the effective date shown at the top of this Privacy Policy and publish the revised version on the Website. We encourage you to review this Privacy Policy periodically to stay informed about how we handle your personal information.
Continued use of the Website after the publication of an updated Privacy Policy constitutes your acknowledgement of the changes. Where required by law, we will seek your fresh consent to any material new uses of your personal information.
18. Contact Us
If you have any questions, concerns or requests regarding this Privacy Policy or the personal information we hold about you, please do not hesitate to contact our Privacy Officer:
Privacy OfficerEmail: privacy@merquelloroyalhotel.com