Privacy Policy

Who we are

Madison Spa Resort
ABN 35 691 490 918
80 Meninya Street, Moama NSW 2731
Email: info@madisonsparesort.com.au
Resort: (03) 5482 3011 · Spa: 0437 623 771

Registered business names for this entity include Madison Day Spa Retreat and Madisons Table Restaurant and Bar.

What this policy covers

This policy covers the public website, the spa booking drawer, staff dashboard login, and related emails we send about a booking or enquiry. Hotel stays and gift vouchers booked through Bookus Direct, and spa appointments processed through Square, are also handled by those providers under their own terms and privacy policies.

What we collect

Depending on how you deal with us, we may collect:

• Name, email address and phone number
• Booking details (treatment, date, time and Square booking reference)
• Stay or voucher details you enter on the Bookus booking site
• Messages you send us by email or phone
• Limited technical data such as IP address, browser type and pages viewed, from server logs and, if enabled, Google Analytics 4
• Staff login details for the website dashboard

We do not ask for medical history, symptoms or other sensitive health details on this website. Please do not include that information in a booking form. If you tell us something about a treatment need by phone or email so we can deliver the service, we use it only for that purpose.

How we collect it

We collect personal information when you:

• Book a spa treatment on this site
• Book a stay or voucher through Bookus Direct
• Email, call or message us
• Browse the site (logs and optional analytics)
• Sign in to the staff dashboard

Why we collect it

We use personal information to:

• Confirm, change or cancel spa bookings and stays
• Contact you about an appointment, voucher or enquiry
• Take payment through Square or Bookus where you choose to pay
• Run and improve the website
• Meet legal, accounting and insurance obligations

If you do not provide contact details, we cannot complete an online spa booking or reply to you.

We do not sell your personal information.

Who we share it with

We share information only as needed to operate the resort and this website:

• Square — spa catalogue, customer records and appointment bookings (United States)
• Bookus Direct (madisonspa.bookus.direct) — hotel stays and gift vouchers
• Railway — website hosting and database (typically United States)
• Resend — transactional email such as staff login codes (typically United States)
• Google — Analytics 4 if that measurement ID is switched on (United States)
• Glass Half Full AI — hosts and supports this website as our service provider
• Professional advisers, insurers or authorities where the law requires it

Overseas disclosure

Personal information submitted through this website is likely to be disclosed to overseas recipients. For our ordinary stack those recipients are in the United States (Railway, Square, Resend, and Google if analytics is on). Bookus may also process booking information outside Australia. Those providers are not always subject to the Australian Privacy Principles. We take reasonable steps in the circumstances, including using reputable hosted services over HTTPS.

Cookies, analytics and pixels

Essential cookies are used for the staff dashboard session (HttpOnly, SameSite=Lax, Secure on HTTPS). The public site works without that cookie.

If Google Analytics 4 is enabled, it measures how the site is used. You can block analytics cookies in your browser.

We do not run Meta, TikTok or other advertising pixels on this site. We do not use browsing on treatment pages to retarget you with ads.

Direct marketing

This website does not add you to a marketing list when you book or browse. Square or Bookus may send transactional messages about a booking you made. If we later send promotional email or SMS, we will only do so with consent, and every commercial message will identify us and include a working unsubscribe.

Security and how long we keep information

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access. No internet transmission is completely secure.

We keep booking and customer records for as long as needed to provide the service and for legal, accounting and insurance reasons. Staff session cookies expire. When information is no longer required, we take reasonable steps to destroy or de-identify it.

Access, correction and complaints

You can ask for access to, or correction of, personal information we hold about you, or complain about how we have handled it, by emailing info@madisonsparesort.com.au or calling the numbers above.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Notifiable data breaches

If we have reasonable grounds to believe that an eligible data breach has occurred that is likely to result in serious harm, we will notify affected individuals and the Australian Information Commissioner as soon as practicable, as required by the Notifiable Data Breaches scheme.

Automated decisions and children

We do not use a computer program on this website to make decisions that could significantly affect your rights or interests (for example automated eligibility or credit-style checks).

Madison Spa Resort is an adults-only property. This website is not directed at children.

Changes

We may update this policy from time to time. The “Last updated” date at the top of this page will change when we do.

Related

Use of this website is also covered by our Website Terms.