Privacy Policy

This policy explains how Tumgo ("Tumgo", "we", "us") handles personal information you give us, in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth).

1. What we collect

When you send us a query — through a service page's form, WhatsApp, or email — we collect:

• Your name, mobile number, and email address.
• Details of the service you're asking about — for example, travel dates and destinations for flights and tours; hospital preference, medical category, and urgency for Medical Tourism; visa type and destination country for Visa & Immigration or Student Visa Consultancy; or event details for Concierge Services.
• Any other information you choose to give us in a query's notes field.

Some of this — particularly Medical Tourism details — can be "sensitive information" under the Privacy Act. We only collect it because you've volunteered it to get a quote for that specific service, and treat it with the extra care sensitive information requires.

2. How we use it

We use your information to:

• Respond to your query and provide a quote.
• Arrange the booking with the relevant supplier once you've confirmed.
• Contact you about a query or an existing booking.
• Send you travel deals and offers by email — only if you have left the marketing box ticked on a form. You can untick it before sending. Every deals and offers email carries an unsubscribe link; emails about your own request or booking do not, because you need to receive those.

We don't use your information for anything beyond responding to your specific query unless you've opted in as above.

3. Who we share it with

We disclose the minimum necessary to the suppliers involved in fulfilling your query — for example, an airline or hotel for a flights/tours booking, a hospital or medical facilitator for Medical Tourism, an immigration lawyer or visa processing body for Visa & Immigration or Student Visa Consultancy, or a university for Student Visa Consultancy. Some of these suppliers may be located outside Australia — where that's the case, it's because the service itself (the hospital, the university, the visa authority) is located there, not an optional step. We don't sell your information, and we don't share it with anyone else for their own marketing purposes.

4. Storage and security

We keep your information only as long as reasonably needed to respond to your query, manage a booking, or meet a legal or accounting requirement, and take reasonable steps to protect it from misuse, loss, and unauthorised access.

If you use "My trips", we keep a sign-in record for your safety: the time of each sign-in attempt, the IP address it came from, the approximate country worked out on our own server (your address is not sent to anyone else), and the browser and device type. We use it to spot sign-ins that are not yours, to warn you by email when a new device signs in, and to protect payments. A browser you choose to remember holds a random token in a cookie for 30 days; you can sign any device out from the Security page. Sign-in records are kept for up to 12 months. Staff sign-ins to our office system are recorded the same way.

Closed accounts. When an account is closed, by you or by us (for example a test account, a duplicate, or no activity for over two years), we tell you by email with the reason and the account stops working straight away. We do not erase it on the same day, so a mistake can still be put right. If you never had an invoice or payment with us, your personal details are removed 90 days after closing. If you did, Australian tax law requires us to keep booking and payment records for five years, so your details are kept for five years after your last invoice or payment and then removed. Only the amounts and dates stay in our accounts, without your name or contact details. This follows Australian Privacy Principle 11, which asks us to destroy or de-identify personal information once it is no longer needed.

5. Access, correction, and opting out

You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it, and you can opt out of marketing emails at any time. When you are signed in, you can change your own name, email, phone and billing details under My account, and send us a support request. Otherwise just tell us via info@tumgo.com.au or WhatsApp.

6. Complaints

If you think we've mishandled your personal information, contact us first using the details above so we can address it directly. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

7. Changes to this policy

We may update this policy from time to time; the version on this page is always the current one.