Privacy Policy
Original policy effective: 2 April 2024
Current version effective: 7 August 2026
1. About this Privacy Policy
Pedal Set Go respects the privacy of participants, parents and carers, clients, employees, contractors, council representatives, community partners and website visitors.
This Privacy Policy explains how Pedal Set Go collects, holds, uses, shares and protects personal information and health information.
In this policy, “Pedal Set Go”, “we”, “our” and “us” refer to Pedal Set Go.
We aim to manage personal information consistently with applicable Australian privacy laws and recognised privacy principles. When delivering a program for a council, government agency, school, workplace or other organisation, we also follow the applicable contract, approved collection notice and reasonable written information-handling instructions.
2. Information we may collect
The information we collect depends on how a person contacts us, books a service or participates in a program.
It may include:
name, email address, telephone number and other contact details;
age, age group or date of birth where relevant to a program;
the name and contact details of a parent, carer, guardian or person making a booking;
emergency contact information;
height, bike requirements, riding experience, confidence, goals and preferred learning support;
information about a bike, e-bike or other equipment being used;
health, disability, accessibility or support information relevant to participation and safety;
booking, attendance, payment and transaction information;
limited payment information provided by a payment processor, such as card type, payment status and the last few digits of a payment card;
waivers, declarations, acknowledgements and consent records;
photograph, video, testimonial and promotional consent choices;
feedback, survey responses and correspondence;
incident, injury, first-aid and insurance information;
information needed for council, workplace, school or stakeholder reporting;
business contact details for clients, suppliers, contractors and program partners; and
technical website information, such as IP address, browser type, device information, referring pages and website activity.
We do not intentionally collect more information than is reasonably necessary for our services, safety, administration, reporting or legal obligations.
3. How we collect information
We may collect information:
directly from a participant;
from a parent, carer, guardian or person making a booking;
through our website, contact forms, booking forms and newsletter forms;
by email, telephone, text message or social media;
through paper or electronic waivers and registration forms;
through Humanitix, Eventbrite, Squarespace or another booking system;
through a booking or registration system operated by a council or program partner;
from a council, school, workplace, community organisation or other commissioning organisation;
from an authorised person acting on a participant’s behalf;
during a lesson, course, ride, workshop or event;
when managing an incident, complaint or insurance matter; and
automatically through cookies and similar website technologies.
Where practicable, we collect personal and health information directly from the person concerned or their parent, carer, guardian or authorised representative.
4. Why we collect and use information
We may collect and use information to:
respond to enquiries and provide information about our services;
recommend an appropriate lesson, course, ride or program;
create, confirm, change and manage bookings;
process payments, refunds and invoices;
plan and safely deliver bike education, guided rides, workshops and events;
understand a participant’s goals, experience, equipment and support requirements;
make reasonable adjustments for disability, accessibility, health or learning needs;
communicate changes, safety information and program instructions;
manage attendance, waiting lists and cancellations;
provide first aid or respond to an emergency;
record and manage incidents, complaints, insurance matters or legal claims;
meet council, school, workplace, grant, contract and stakeholder reporting requirements;
evaluate and improve our programs;
produce aggregated or de-identified reports and case studies;
administer consent for photographs, videos and testimonials;
send newsletters or marketing communications where separate consent has been provided;
protect our participants, team, equipment, systems and legal rights;
meet record keeping, taxation, insurance and legal requirements; and
perform other purposes explained at the time of collection or authorised by law.
Where participation information is required for safety or program administration, choosing not to provide it may mean we cannot provide the service or may need to modify participation.
Optional photograph, testimonial and marketing consent is not a condition of participating unless clearly stated for a particular service.
5. Health and sensitive information
We may ask for health, disability, accessibility or support information where it is reasonably necessary for safe and inclusive participation.
This may include information about:
an injury or medical condition relevant to riding;
allergies or first-aid requirements;
asthma, a heart condition or another condition affected by physical exertion;
anxiety, panic attacks or other responses that could affect participation;
disability, mobility or accessibility requirements;
medication or an emergency action plan; and
other information a participant considers relevant to their safety or support.
We do not require unrelated medical histories.
We use health and sensitive information to:
assess and manage participation risks;
make reasonable adjustments;
brief instructors or ride leaders who need the information;
provide first aid or seek emergency assistance;
manage an incident or insurance matter; and
meet applicable program or contractual requirements.
Access is limited to people who reasonably need the information for safety, administration or incident management.
We do not ordinarily provide identifiable health information to a council or program partner unless this has been explained and authorised, is necessary to respond to an emergency or serious safety risk, or is otherwise required or permitted by law.
Health information used in general reports, evaluations and case studies will be aggregated or de-identified wherever practicable. We will not publish identifiable health information in a case study without specific consent.
6. Information about children and young people
Pedal Set Go provides services to adults, children and young people.
For participants under 18, we generally collect information from or with the involvement of a parent, carer or guardian. Depending on the participant’s age, capacity and the program arrangements, we may also collect relevant information directly from the young person.
We take reasonable steps to:
collect only information needed for participation, support and safety;
direct important communications to a parent, carer or guardian where appropriate;
protect children’s personal and health information;
respect a child or young person’s views about photographs and participation;
obtain appropriate permission for photographs, videos and testimonials; and
avoid using children’s information for unrelated marketing.
A parent, carer or guardian should provide accurate information about any relevant health, accessibility, behavioural, communication or support requirements.
Guardian consent to a photograph does not mean we will disregard a child or young person who does not wish to be photographed.
7. Council, government and stakeholder programs
Some Pedal Set Go programs are commissioned, funded, supported or co-hosted by councils, government agencies, schools, community organisations, workplaces or other stakeholders.
Depending on the program:
the commissioning organisation may collect participant information and provide authorised access to Pedal Set Go;
Pedal Set Go may collect information for or on behalf of the commissioning organisation;
both organisations may be involved in administering the program; or
each organisation may separately hold information needed for the program.
For these programs, Pedal Set Go will:
collect, access and use only the information reasonably necessary to administer and safely deliver the program;
use information only for agreed program purposes and directly related safety, reporting, insurance, contractual or legal requirements;
restrict access to people who require the information for their work;
follow applicable contractual requirements and reasonable written directions from the commissioning organisation;
provide names, contact details, attendance information and consented photographs only where authorised and reasonably necessary;
use aggregated or de-identified information for evaluation, reporting and case studies wherever practicable;
not add participants to Pedal Set Go marketing or newsletter lists without separate consent;
promptly report suspected loss, unauthorised access, disclosure or misuse of program information to the commissioning organisation; and
return, delete, de-identify or retain information at the end of the program in accordance with the applicable contract, legal requirements and legitimate insurance or recordkeeping requirements.
The commissioning organisation’s privacy policy and any program-specific privacy collection notice may also apply. Participants should read those documents together with this policy.
Information supplied to or held for a council or government organisation may also be subject to public-sector record keeping and lawful information-access requirements. The relevant organisation is responsible for deciding requests made under those laws.
For information about the City of Sydney’s privacy practices, visit the City of Sydney privacy page or read its Privacy Management Plan.
8. Event registration and booking platforms
Bookings and registrations may be administered through Humanitix, Eventbrite, Squarespace or a booking system operated by a council or other program partner.
Pedal Set Go may sometimes receive authorised organiser, co-host, team-member or administrative access to an event controlled by another organisation.
Where we are given this access, we will:
access only the events and participant information required to deliver the program;
use individual, protected accounts and reasonable security controls, including multi-factor authentication where available;
not share login details or permit unauthorised access;
avoid downloading or exporting participant information unless it is reasonably necessary and authorised;
not use participant information for unrelated marketing without separate consent;
promptly notify the account owner or commissioning organisation of a suspected privacy or security incident; and
cease access and appropriately handle retained copies when the program or authorised access ends.
The booking platform and commissioning organisation may separately collect, hold and process information under their own privacy policies and collection notices.
Payment card information is processed by the relevant platform or payment provider. Pedal Set Go does not intentionally collect or store complete payment card numbers.
Relevant platform privacy information is available at:
9. Squarespace and our website
Our website is hosted through Squarespace.
Squarespace may process information submitted through:
website contact forms;
booking and purchasing functions;
newsletter subscription forms;
website cookies and analytics;
customer accounts, where enabled; and
other website features.
Information submitted through our website may be accessible to authorised Pedal Set Go team members through our Squarespace account.
Squarespace processes information under its own terms and privacy practices. Further information is available in the Squarespace Privacy Policy.
10. Payments and Stripe
Payments made through our website may be processed by Stripe or another payment provider identified at the time of payment.
The payment provider collects and processes the payment card details needed to complete the transaction. Pedal Set Go does not receive or store complete payment card numbers.
We may receive limited transaction information, including:
the name and contact details connected with a payment;
the amount and date of payment;
payment status;
card type;
the last few digits of the payment card; and
transaction, refund or dispute identifiers.
Stripe processes information under its own privacy practices. Further information is available in the Stripe Privacy Policy.
11. Newsletters and marketing
People may choose to subscribe to Pedal Set Go news and updates.
Newsletter subscription details may be held through Squarespace Email Campaigns or another service identified when a person subscribes.
We will:
send marketing communications only where a person has subscribed or otherwise consented;
not automatically subscribe council, school, workplace or event participants;
not use a council-supplied participant list for Pedal Set Go marketing;
not purchase marketing lists;
provide an unsubscribe option in marketing emails; and
process unsubscribe requests within a reasonable period.
A person may unsubscribe at any time by using the link in an email or contacting us.
We may still send non-marketing communications that are reasonably necessary to administer an existing booking, transaction or program.
12. Photographs, videos, testimonials and case studies
We may take or receive photographs, video recordings, testimonials or participant stories in connection with a program.
We will obtain appropriate consent before using an identifiable participant’s image or testimonial for promotional, reporting or case-study purposes.
Consent may be recorded through:
a booking or registration form;
a paper or electronic waiver;
a separate media consent form; or
another documented consent process approved for the program.
For a participant under 18, consent will generally be obtained from a parent, carer or guardian. We will also respect the child or young person’s expressed wishes.
Where consent permits, photographs or videos may be shared with the council, workplace, school or organisation responsible for the program and may be used in approved:
reports;
websites;
newsletters;
social media;
printed materials;
funding acquittals; and
program promotions.
A person may withdraw consent for new uses by contacting us. We will stop future use where reasonably practicable, but it may not always be possible to recall material already printed, distributed, lawfully published or provided to another organisation under the original consent.
Health information used in case studies will be de-identified unless specific consent has been obtained for an identifiable use.
13. When we may disclose information
We do not sell or rent personal information.
We may disclose information to:
Pedal Set Go employees, instructors, ride leaders, contractors and authorised team members;
councils, schools, workplaces, funding bodies and program partners;
Humanitix, Eventbrite, Squarespace, Stripe and other service providers used to administer our services;
technology, website, email, file-storage and administrative service providers;
professional advisers, including insurers, insurance brokers, accountants, solicitors and risk advisers;
first-aid providers, healthcare professionals, emergency services or police where necessary;
a parent, carer, guardian or authorised representative;
another body where a person has consented;
a purchaser or adviser involved in a proposed sale or restructuring of the business, subject to appropriate confidentiality; or
a regulator, court, law-enforcement body or other organisation where required or permitted by law.
Employees, instructors and contractors are expected to use participant information only for authorised Pedal Set Go work and to protect its confidentiality.
14. Overseas processing and storage
Some of our technology and service providers may process or store information outside Australia, including in the United States and other countries in which those providers or their subcontractors operate.
These providers may include Squarespace, Stripe, Eventbrite and other website, communications or payment services.
Where applicable and reasonably practicable, we select established providers with privacy and security controls and limit the information made available to them.
Their handling of information is also governed by their own privacy policies and applicable laws. Privacy protections in another country may differ from those in Australia.
Where a council or other commissioning organisation imposes specific data-location, access or security requirements, we will follow the applicable contract and approved systems for that program.
15. Cookies and website information
Our website and integrated services may use cookies and similar technologies to:
operate website functions;
remember preferences;
understand website use and performance;
maintain security;
process forms, bookings and payments; and
improve our website and communications.
Website information may include IP address, browser type, device type, approximate location, pages viewed, links followed and the date and time of a visit.
A person can control or delete cookies through their browser settings. Disabling cookies may affect some website functions.
Third-party services may set their own cookies under their respective privacy policies.
16. Information security
We take reasonable steps to protect personal and health information against loss, misuse, interference, unauthorised access, modification and disclosure.
These steps may include:
restricting access to authorised people;
using passwords, individual accounts and multi-factor authentication where available;
maintaining appropriate permissions for booking and council systems;
using established website, payment and booking providers;
limiting the information downloaded from third-party systems;
keeping paper waivers and records at our office with access restricted;
securely disposing of records when they are no longer required;
maintaining confidentiality expectations for employees and contractors; and
reviewing access when a program or working relationship ends.
No electronic transmission or storage system can be guaranteed to be completely secure. If we become aware of a security issue, we will take reasonable steps to contain, investigate and respond to it.
17. Data breaches
A data breach may involve the loss of information or unauthorised access, use, modification or disclosure.
If we suspect a data breach, we will take reasonable steps to:
contain the incident;
protect affected information;
investigate what occurred;
assess the possible consequences;
preserve relevant records;
notify an affected council, client, insurer or service provider within any required contractual timeframe;
notify affected people or regulators where required by law; and
reduce the risk of a similar incident occurring again.
Where the information belongs to or is controlled by a council or program partner, we will cooperate with that organisation’s investigation and reasonable response requirements.
Privacy or security concerns should be reported promptly using the contact details at the end of this policy.
18. How long we keep information
We retain information only for as long as reasonably necessary for the purpose for which it was collected and for applicable legal, contractual, taxation, insurance and recordkeeping requirements.
Our general retention practices include:
adult participant waivers and consent records are generally retained for at least 7 years after participation;
records concerning a participant under 18 may be retained until the participant reaches at least 25 years of age;
incident, injury, complaint, insurance and legal records may be kept longer where a matter remains open or our insurer or legal adviser recommends further retention;
booking, payment and business transaction records are generally retained for at least 7 years;
newsletter subscription information is retained until the person unsubscribes or the list is no longer used;
consented photographs, videos and testimonials may be retained while they remain relevant to the authorised purpose, subject to any withdrawal of consent;
council or partner participant lists are returned, deleted or de-identified in accordance with the relevant contract or written instructions, unless continued retention is reasonably required for legal, safety, insurance or record keeping purposes; and
aggregated or properly de-identified information may be kept for reporting, evaluation and business planning because it no longer identifies a participant.
Deletion from active systems may not immediately remove information from secure backups. Backup information is protected and removed or overwritten through the relevant provider’s normal retention cycle.
19. Accessing and correcting information
A person may contact us to:
ask what personal information we hold about them;
request access to that information;
ask us to correct inaccurate or outdated information;
update a consent choice;
withdraw photograph or marketing consent for future use; or
request deletion where continued retention is not reasonably required.
A parent, carer, guardian or authorised representative may make a request on behalf of a child or another person where they have appropriate authority.
We may need to verify identity and authority before providing access or making a change.
In limited circumstances, we may be unable to provide access or delete information, including where retention is required for safety, insurance, contractual or legal reasons or where providing access would unreasonably affect another person’s privacy. If this occurs, we will explain the reason where we are permitted to do so.
We do not ordinarily charge for a privacy request.
If information was collected through a council-controlled system, the request may need to be directed to that council. We will help identify the appropriate contact where reasonably practicable.
20. Privacy complaints
A person who has a concern or complaint about privacy should contact Pedal Set Go using the details below.
Please provide enough information for us to understand:
what occurred;
the information or program involved;
the preferred contact details; and
the outcome being requested.
We aim to acknowledge a privacy complaint within 5 business days and provide a response within 30 calendar days. If we need more time, we will explain why and provide an updated timeframe.
If the complaint concerns a council-controlled booking system or information collected for a council program, the person may also contact that council directly.
Further privacy information and complaint guidance is available from:
The appropriate organisation will depend on who collected or controls the information and which privacy laws apply.
21. External websites
Our website may contain links to websites and services operated by other organisations.
We are not responsible for the content, security or privacy practices of an external website. People should review the privacy policy of the relevant website before providing personal information.
22. Changes to this policy
We may update this Privacy Policy when our services, systems, booking platforms, contractual requirements or applicable laws change.
The current version will be published on this page with its effective date.
We aim to review the policy at least annually and before adopting a significant new system or information-handling arrangement.
23. Contact Pedal Set Go
Privacy enquiries, access requests, corrections, complaints and consent changes can be directed to:
Pedal Set Go
Email: hello@pedalsetgo.com.au
Phone: 0435 295 291
Contact page: www.pedalsetgo.com.au/contact-us
Pedal Set Go is based in Newtown, Sydney, on Gadigal and Wangal Country.