Effective date: April 2026
This Privacy Policy explains how the VenueSumo group of companies collects, uses, discloses, stores and protects personal information in connection with the VenueSumo platform, websites, mobile applications and related services (the “Services”). It applies globally, regardless of where you are located.
In this Policy, “VenueSumo”, “we”, “us” and “our” means, depending on the context:
- VenueSumo Pty Ltd (ABN 98 667 285 145), of 1/597 Church Street, Richmond VIC 3121, Australia; and
- VenueSumo LLC (FEIN 36-5148636), of 26 S Rio Grande St, Salt Lake City, UT 84101-1179, United States,
together with our related bodies corporate and affiliates. The entity that is your contracting party is determined by the Software Subscription Agreement and the VenueSumo Terms and Conditions of Use.
This Policy is incorporated by reference into our Terms and Conditions of Use and should be read alongside them. Capitalised terms not defined in this Policy have the meanings given to them in the Terms and Conditions.
1. Who this Policy applies to
This Policy applies to personal information we handle about:
- visitors to our websites;
- prospective customers, leads and people who enquire about or request a demonstration of the Services;
- authorised administrators and users of customer accounts (our customers’ “Users”);
- end-guests of our customers’ venues, whose information is uploaded to, or collected through, the Services (for example, via bookings, ticketing, waivers, memberships or point-of-sale); and
- job applicants, suppliers and business contacts.
Controller and processor roles
Under data protection laws such as the EU/UK General Data Protection Regulation (together, “GDPR”), we act in two different capacities:
- Controller. When we decide the purposes and means of processing — for example, in managing our own website, marketing our Services, operating our customer accounts, or handling enquiries — we are a “controller” (or “business” under the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, “CCPA/CPRA”)).
- Processor. When our customers use the Services to collect or manage personal information about their own guests, staff or contacts, our customers are the controller of that information and we act as a “processor” (or “service provider” under CCPA/CPRA) on their behalf. Our processing of that information is governed by the Terms and Conditions of Use and, where required, a separate data processing agreement.
This Policy primarily describes the information we handle as a controller. Where we act as a processor, our customer’s privacy notice applies to the people whose data they upload, and we will support our customers to meet their own obligations.
2. The information we collect
The types of personal information we collect depend on how you interact with us. We may collect the following categories:
Information you provide directly
- Identity and contact details — name, job title, email address, postal address and phone number;
- Account details — username, password (hashed), role, permissions and preferences;
- Billing and payment information — billing address, tax identifiers and limited payment metadata (full card details are handled by our payment processors and are not stored by us);
- Communications — correspondence, support tickets, chat transcripts and feedback; and
- Recruitment information — where you apply for a role, information contained in your application, CV, references and relevant background checks.
Information collected automatically
- Device and technical information — IP address, device identifiers, operating system, browser type, language and referring URLs;
- Usage information — pages viewed, features used, actions taken, timestamps and aggregated performance data; and
- Cookies and similar technologies — as described in section 9.
Information uploaded by our customers (we act as processor)
When our customers use the Services to run their venues, they may upload or generate personal information about their own guests and staff, including:
- names, contact details and (where relevant) dates of birth;
- booking, ticketing, waiver, membership and attendance records;
- transaction and point-of-sale records;
- photos or imagery uploaded for guest or staff profiles; and
- other information our customers choose to collect through the Services.
We do not control what our customers choose to collect. If you are an end-guest and have questions about this information, please contact the venue directly.
Information about children
The Services are not marketed to children. However, our customers may use the Services to process information about minors (for example, party bookings or waiver signatures by a parent or guardian). Our customers are responsible for obtaining all necessary parent or guardian consents before uploading such information to the Services.
Sensitive information
We do not seek to collect sensitive information (such as health information, racial or ethnic origin, or biometric data). If sensitive information is provided to us, we will only use it for the purpose it was provided, with consent where required, or as otherwise permitted by law.
3. How we use personal information
We use personal information for the following purposes:
- to provide, operate, secure, maintain and improve the Services;
- to create and administer accounts, authenticate Users and manage permissions;
- to process payments and manage billing;
- to respond to enquiries, demo requests and support tickets;
- to send service communications (such as notices about changes, outages or security incidents);
- to send marketing and promotional communications — where permitted by law and, where required, with your consent (you can unsubscribe at any time);
- to carry out credit, identity and risk checks on prospective and existing customers;
- to detect, investigate and prevent fraud, abuse or security incidents;
- to develop new products and features, including analytics and research;
- to comply with our legal, regulatory and tax obligations; and
- to establish, exercise or defend legal claims.
Legal bases (for individuals in the EU, EEA and UK)
Where GDPR applies, we rely on the following legal bases for processing personal information:
| Legal basis | Example uses |
| Performance of a contract | Providing the Services to you, administering your account, processing payments and responding to support requests. |
| Legitimate interests | Operating, improving and securing our Services; managing our business; conducting business-to-business marketing; preventing fraud and abuse. We balance our interests against your rights and freedoms. |
| Legal obligation | Meeting tax, accounting, regulatory and law enforcement obligations. |
| Consent | Sending certain direct marketing, using non-essential cookies, and processing any sensitive information. You can withdraw consent at any time. |
| Vital interests / public interest | In rare situations, to protect someone’s life or in connection with an investigation or legal process. |
4. How we share personal information
We share personal information only as described below. We do not sell personal information, and we do not “share” it for cross-context behavioural advertising within the meaning of the CCPA/CPRA.
Within the VenueSumo group
We share information between VenueSumo Pty Ltd, VenueSumo LLC and our related bodies corporate to operate the Services, provide global support and manage our business consistently.
Service providers
We use trusted third-party service providers to help us operate the Services. These include:
- cloud hosting and infrastructure providers;
- payment processors;
- analytics, error-monitoring and product-usage providers;
- customer support, communications and messaging platforms;
- identity verification and anti-fraud providers; and
- professional advisers (lawyers, accountants, auditors).
These providers only process personal information on our instructions and under written agreements that require them to protect it.
With our customers
If you are a User, we share information with the customer whose account you are authorised to access. If you are an end-guest of a venue, your data is processed by us on behalf of, and is accessible to, that venue.
Business transfers
If we are involved in a merger, acquisition, financing, reorganisation, insolvency, or sale of some or all of our assets, personal information may be transferred as part of that transaction. We will take reasonable steps to ensure the recipient continues to protect personal information consistently with this Policy.
Legal and safety
We may disclose personal information where we reasonably believe it is necessary to:
- comply with a law, regulation, subpoena, court order or other legal process;
- cooperate with law enforcement, regulators or other government authorities;
- enforce our agreements or investigate suspected breaches; or
- protect the rights, property or safety of VenueSumo, our customers or others.
5. International data transfers
VenueSumo operates globally. Your personal information may be accessed, processed or stored in countries outside the country in which you are located, including Australia and the United States. The data protection laws of those countries may differ from those of your home country.
When we transfer personal information internationally, we rely on appropriate transfer mechanisms, which may include:
- for transfers from the EEA or UK — the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, an adequacy decision, or another lawful transfer mechanism;
- for transfers from Australia — taking reasonable steps to ensure the overseas recipient handles personal information consistently with the Australian Privacy Principles (APP 8), or relying on an exception under the Privacy Act 1988 (Cth);
- for transfers of California personal information — service provider or contractor agreements meeting CCPA/CPRA requirements.
You may contact us using the details in section 12 to request more information about the safeguards we have in place for international transfers.
6. How we protect personal information
We take reasonable technical, physical and organisational measures designed to protect personal information from misuse, interference, loss and from unauthorised access, modification or disclosure. These include:
- encryption of data in transit and, where appropriate, at rest;
- access controls, authentication and role-based permissions;
- regular backups and redundant, geographically distributed infrastructure;
- network, application and endpoint security controls;
- staff training on privacy and security; and
- vendor risk management.
No system is completely secure. If we become aware of a security incident affecting personal information, we will respond in accordance with applicable law, including any notifiable data breach obligations.
7. How long we keep personal information
We keep personal information for as long as we need it for the purposes set out in this Policy, and as required by law. The period will depend on the type of information and the purpose for which it is held. When determining retention periods we consider, amongst other things:
- the duration of the customer relationship and any ongoing support or warranty obligations;
- legal, tax, accounting and regulatory retention requirements;
- whether the information may be needed to defend or pursue legal claims; and
- operational requirements such as security, audit and continuity.
On termination of a customer’s subscription, customer data is handled in accordance with the Terms and Conditions of Use — typically, customers have 60 days to export their data before it is deleted or anonymised in accordance with our data retention policies.
8. Your privacy rights
Depending on where you live and the laws that apply to you, you may have some or all of the following rights:
- Access — to request a copy of the personal information we hold about you;
- Correction — to ask us to correct information that is inaccurate or out of date;
- Deletion / erasure — to ask us to delete information we no longer need;
- Portability — to receive certain information in a machine-readable format;
- Restriction / objection — to restrict or object to certain processing (including direct marketing);
- Withdraw consent — where we rely on consent, to withdraw it at any time (without affecting the lawfulness of processing before withdrawal);
- Opt-out of “sale” or “sharing” — we do not sell or share personal information within the meaning of CCPA/CPRA, but California residents may still submit a request to confirm this; and
- Non-discrimination — we will not discriminate against you for exercising your privacy rights.
To exercise any of these rights, please contact us using the details in section 12. We may need to verify your identity before responding. Where you are an end-guest of one of our customers’ venues, we will usually refer your request to that customer, as they are the controller of your information.
If you are in the EU/EEA or UK
You have the right to lodge a complaint with your local data protection authority. We would, however, appreciate the chance to address your concerns before you approach a regulator — please contact us first.
If you are in Australia
If you are not satisfied with how we have handled your personal information, you may complain to the Office of the Australian Information Commissioner at www.oaic.gov.au.
If you are in California
You have specific rights under CCPA/CPRA, including the right to know what personal information we have collected, used, disclosed or sold (we do not sell) in the preceding 12 months, the right to delete, the right to correct, and the right to limit use of sensitive personal information. You may exercise these rights by contacting us using the details in section 12. You may also designate an authorised agent to submit a request on your behalf.
9. Cookies and similar technologies
Our websites and the Services use cookies and similar technologies to operate, secure, analyse and improve the Services. We use:
- Strictly necessary cookies — required for the Services to work (for example, session management and security);
- Analytics cookies — to understand how the Services are used and to improve them;
- Functional cookies — to remember your preferences; and
- Marketing cookies — to measure the effectiveness of our marketing (where permitted, and with consent where required).
You can manage cookie preferences through our cookie banner (where shown) and through your browser settings. Disabling some cookies may affect how the Services work.
10. Third-party links and integrations
The Services may contain links to, or be integrated with, third-party websites, applications and services that are not operated by us. Those third parties are responsible for their own handling of personal information. We encourage you to review their privacy policies before providing any information to them.
11. Changes to this Policy
We may update this Policy from time to time. The latest version will be available at https://venuesumo.com/privacy-policy/ and will take effect on publication. Where changes are material, we will take reasonable steps to notify you, for example by email or by an in-product notice.
12. How to contact us
For privacy questions, requests or complaints, please contact us:
- Email: privacy@venuesumo.com
- Postal (Australia): VenueSumo Pty Ltd, 1/597 Church Street, Richmond VIC 3121, Australia
- Postal (United States): VenueSumo LLC, 26 S Rio Grande St, Salt Lake City, UT 84101-1179, United States
- Phone: Australia 1800 431 500; United States 844 705 2100; Global +61 3 4051 1110
If you are an end-guest of one of our customers’ venues and have a question about how your personal information is used, please contact that venue directly in the first instance.
