TourHub Australia Pty Ltd
Privacy policy.
This policy explains what personal information TourHub Australia Pty Ltd (TourHub, we, us) collects when you use 408visa.com, a service operated by TourHub Australia Pty Ltd, or contact us, why we collect it, who we share it with, how long we keep it, and the rights you have over it. It is written to meet the Australian Privacy Principles in the Privacy Act 1988 (Cth) and, because many of the people we work with are in the United Kingdom and the European Union, the UK GDPR and the EU General Data Protection Regulation.
It is written in plain English on purpose. If anything in it is unclear, email hello@408visa.com and we will explain.
- 1. Who we are
- 2. What we collect
- 3. Why, and on what basis
- 4. Who we share it with
- 5. Where it goes
- 6. If you become a client
- 7. How long we keep it
- 8. How we protect it
- 9. Your rights
- 10. Cookies and tracking
- 11. Other things you should know
- 12. Contact and complaints
1. Who we are
The organisation responsible for your personal information (the data controller, in GDPR terms) is TourHub Australia Pty Ltd, an Australian company operated by its director, Ali Winton, and based in New South Wales, Australia.
Privacy contact: hello@408visa.com. Put “Privacy” in the subject line and it reaches Ali directly.
2. What we collect
We only collect what we need to answer you and do the job. We never buy data about you or build profiles.
When you send an enquiry
The enquiry form asks for your name, your company and role, your email address, your phone number (optional), the country you are travelling from, what kind of enquiry it is, and details of the project: the artist or production, dates, cities, how many people are travelling, whether you already have an Australian promoter or host, how many people need visas, your intended arrival date, how urgent it is, and anything you choose to write in the message box. If you pick a call time, we also record the date and time you asked for and the time zone your device reported, so we can convert it correctly.
When you request a call
The short booking form asks for your name, your email address, the time you asked for, your time zone, and, optionally, what the call is about.
When you email us
Whatever you send: your address, the content, and any attachments.
Automatically, to run and protect the site
Like every website, this one is delivered by servers that see your IP address, browser type and the pages you request. Ours is hosted by Netlify, which keeps short-lived request logs for security and performance. We run no analytics scripts, advertising pixels or cross-site tracking on this site. See section 10.
Please don’t put passport numbers, dates of birth or other sensitive details in the enquiry form. It is not built for them. If we take on your project we will tell you exactly how to send visa documents securely.
3. Why we collect it, and on what basis
| What we do | Why | GDPR basis |
|---|---|---|
| Answer your enquiry | To understand your project and reply with the right information or a quote. | Steps at your request before entering a contract (Art. 6(1)(b)) |
| Arrange a call | To confirm, move or decline the time you asked for. | Steps at your request before entering a contract (Art. 6(1)(b)) |
| Deliver the work | Tour planning, logistics, visa coordination and everything in section 6. | Performance of a contract (Art. 6(1)(b)); legal obligations (Art. 6(1)(c)) |
| Run and protect the site | Serve pages, stop abuse, keep the forms working. | Our legitimate interest in a working, secure website (Art. 6(1)(f)) |
| Keep business records | Australian tax and company law require us to keep certain records. | Legal obligation (Art. 6(1)(c)) |
We do not use your details for marketing. If you enquire, you will hear from us about that enquiry and nothing else. We do not run a newsletter.
4. Who we share it with
We do not sell personal information, and we do not share it with anyone who is not needed to answer you or deliver the work.
Service providers who help us run this website
- Netlify, Inc. (United States): hosts the site, stores form submissions, and sends us an email each time one arrives.
- Our email provider: your enquiry lands in a mailbox hosted by a third-party email service, as all email does.
People and organisations involved in your project
Only if we are working on your project, and only what each of them needs:
- Australian promoters, venues, host or sponsoring organisations, and production companies
- The Department of Home Affairs, for visa applications
- The Media, Entertainment & Arts Alliance or the Musicians’ Union of Australia, for the union consultation that Australian entertainment visas require
- Registered migration agents or entertainment lawyers, if your matter needs registered advice and you agree to engage them
- Travel, accommodation, transport, freight, crew and production suppliers we book on your behalf
- Accountants, insurers and professional advisers, and any authority we are legally required to respond to
5. Where your information goes
TourHub is in Australia, so your information comes to Australia. Our website providers are in the United States. Australia does not have an adequacy decision from the European Commission or the UK Government.
If you are in the EU or UK: we rely on the fact that the transfer is necessary to answer your enquiry and take the steps you have asked for before a contract, and, once we are working together, to perform that contract (Article 49(1)(b) GDPR). Where a US provider processes data for us, it does so under the EU–US Data Privacy Framework and its UK extension, or under standard contractual clauses. We do not transfer your information anywhere else, and we do not transfer it for marketing.
If you are in Australia: under Australian Privacy Principle 8 we take reasonable steps to make sure overseas recipients handle your information in a way consistent with the Australian Privacy Principles. Our providers are established companies with published privacy and security programmes.
6. If you become a client
Visa coordination means handling more sensitive information than an enquiry does: passport copies, dates of birth, nationality, employment contracts, insurance certificates, professional biographies and evidence of funds, for each person travelling. This is collected by email or a secure link after we have agreed to work together, never through the website forms.
- We collect it only to prepare and lodge the applications, complete the union consultation, and support the Australian sponsor or host.
- It is shared only with the Department of Home Affairs, the relevant union, the sponsoring organisation, and any registered migration agent or lawyer engaged for your matter.
- It is deleted or returned once the visas are decided and any Australian sponsorship record-keeping obligations have ended (see section 7).
- Where TourHub acts as the Australian supporting entity for your production, we keep the records that role legally requires.
You will receive a short written collection notice at the start of any visa engagement that repeats this in the specific terms of your project. Visa coordination provided by TourHub is administrative and operational; it is not immigration advice, and we are not a registered migration agency.
7. How long we keep it
| Information | Kept for |
|---|---|
| Enquiries and call requests that don’t become a project | Up to 24 months after our last contact, then deleted from our mailbox and from Netlify’s form storage. |
| Project and client records | 7 years from the end of the project, which Australian tax and company law require, then deleted. |
| Visa application documents (passports, contracts, bank evidence) | Deleted or returned once the visas are decided and any sponsorship record-keeping obligation has ended, and in any case no longer than the project records above. |
| Website request logs (Netlify) | Short-lived, set by the provider, typically days to a few weeks. |
8. How we protect it
The site is served over HTTPS only. Form submissions are stored by Netlify with access limited to Ali. Our providers maintain their own security programmes. Access to client files is limited to the people working on your project.
Ordinary email is not end-to-end encrypted. Please do not send passport copies or bank documents until we ask for them, and use the method we give you when we do.
If we ever became aware of a data breach likely to cause you serious harm, we would notify you and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires, and, for EU or UK residents, the relevant supervisory authority within 72 hours where the GDPR requires it.
9. Your rights
Wherever you are, you can ask us what personal information we hold about you and ask us to correct it. We will respond within 30 days.
If you are in the EU or UK, you also have the right to:
- have your information erased, where we no longer need it or you withdraw consent we were relying on;
- restrict how we use it while a question about it is resolved;
- receive the information you gave us in a portable format;
- object to processing based on our legitimate interests;
- withdraw consent at any time, without affecting anything done before you withdrew it;
- complain to a supervisory authority: in the UK, the Information Commissioner’s Office; in the EU, the authority in your member state (the European Data Protection Board publishes the list).
To use any of these rights, email hello@408visa.com. We may need to confirm it is really you before acting, which we will do in the least intrusive way possible. There is no charge.
Providing information to us is voluntary. If you choose not to, we may simply be unable to answer your enquiry or take on the work.
10. Cookies and tracking
This website sets no cookies of its own and runs no advertising or social-media tracking. Nothing is stored in your browser by our code.
Because nothing non-essential is stored on your device, there is no cookie banner here.
The site’s typefaces are hosted on our own domain, so no request is made to Google or any other font service when a page loads.
11. Other things you should know
Children. This website is not directed at anyone under 18. Where a touring party includes a minor, their information is handled through a parent or guardian and only for the visa or travel arrangements the project requires.
Automated decisions. We make no automated decisions about you and do no profiling.
Links. The site links to other organisations. Their privacy practices are their own.
Changes. If this policy changes, the effective date at the top changes with it. Anything material will be explained here in a short note.
12. Contact and complaints
Questions, requests and complaints: hello@408visa.com, subject “Privacy”. We acknowledge complaints within 7 days and aim to resolve them within 30.
If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (Australia), the Information Commissioner’s Office (UK), or your national data protection authority (EU).