PRIVACY POLICY OF SUR—UNDER

At SUR—UNDER, we are committed to protecting the privacy of our clients, contacts, customers, employees, facilitators, contractors and suppliers (“you” and, when relating to you, “your”).

This Privacy Policy explains how SUR UNDER PTY LIMITED (ACN 687 583 937), trading as SUR—UNDER (“we”, “us” or “SUR—UNDER”), collects, holds, uses, discloses and protects your personal information and health information.

We aim to comply with the Privacy Act 1988 (Cth), the Australian Privacy Principles, the Health Records and Information Privacy Act 2002 (NSW), the Health Privacy Principles and other applicable laws.

THE KINDS OF PERSONAL INFORMATION WE COLLECT

1.1 The kinds of personal information we may collect include:

1.1 (a) Contact and identity details, such as your name, date of birth, pronouns where voluntarily provided, address, email address, telephone number and emergency contact details;

1.1 (b) Health and sensitive information relevant to your safe participation in our breathwork classes, private sessions, workshops, events and other services. This may include information about medical conditions, injuries, pregnancy, medications, mental health considerations, contraindications, accessibility requirements and previous breathwork experiences;

1.1 (c) Information regarding your consent choices, service preferences, interests and the services you may wish to purchase or participate in;

1.1 (d) Information regarding your bookings, attendance, waitlists, cancellations, no-shows, class packs, memberships and participation in classes, private sessions, workshops, events and studio hire;

1.1 (e) Transaction and billing information, including amounts paid, invoices and refunds. Payment card information may be processed by a third-party payment provider rather than stored directly by us;

1.1 (f) Communications and feedback, including enquiries, emails, complaints, reviews, testimonials, survey responses, direct messages and other correspondence;

1.1 (g) Photographs, video or audio recordings where appropriate notice and consent have been provided;

1.1 (h) Website and device information, such as your IP address, browser or device type, pages viewed, referral source, cookies, pixels and similar analytics or advertising information;

1.1 (i) If you are an employee, facilitator, contractor or prospective team member, information regarding your qualifications, skills, experience, insurance, availability and employment or contracting history; and

1.1 (j) If you are a supplier, studio hirer or prospective supplier, information about your business, services, products, prices, qualifications, insurance and payment details.

HOW WE COLLECT PERSONAL INFORMATION

2.1 We collect personal information by various means, including when:

2.1 (a) You contact us with a question, enquiry, request or complaint;

2.1 (b) You make a booking, purchase a service, join a waitlist or manage a membership or class pack;

2.1 (c) You complete an intake, health-screening, consent, waiver, cancellation, enquiry or feedback form;

2.1 (d) You attend or participate in a class, private session, workshop, event, corporate experience or studio hire;

2.1 (e) You sign up for our newsletter, marketing communications or promotions;

2.1 (f) You visit our website, respond to advertising or interact with us through social media;

2.1 (g) You provide a review or testimonial or consent to photography, filming or audio recording;

2.1 (h) You apply to work with us or provide services to us; or

2.1 (i) Information is provided by a person authorised by you, an emergency contact, a referring practitioner or organisation, a booking or payment provider, or an event or corporate organiser.

2.2 Where lawful and practicable, you may interact with us anonymously or by using a pseudonym.

2.3 If you do not provide us with necessary contact, booking, consent or health information, we may not be able to safely provide the service you require.

2.4 If you do not provide accurate and current personal information, we may not be able to provide the most appropriate service or achieve the purpose for which the information was requested.

2.5 Please do not provide health or other sensitive information through public social-media comments or channels that are not designed for confidential information.

THE PURPOSES FOR WHICH WE COLLECT, HOLD, USE AND DISCLOSE PERSONAL INFORMATION

3.1 We collect, hold, use and disclose personal information in order to:

3.1 (a) Respond to your enquiries, bookings and requests;

3.1 (b) Provide and personalise breathwork classes, private sessions, workshops, events, studio hire and related services;

3.1 (c) Assess contraindications, discuss modifications and support your safe participation and wellbeing;

3.1 (d) Respond appropriately to distress, health concerns or emergencies;

3.1 (e) Manage bookings, memberships, class packs, payments, refunds, attendance and customer support;

3.1 (f) Administer studio hire, corporate services, facilitators, contractors and suppliers;

3.1 (g) Respond to complaints, incidents, claims, legal processes and requests to access or correct information;

3.1 (h) Improve our services, perform quality assurance, train team members and analyse de-identified business trends;

3.1 (i) Send service-related communications and, where permitted, marketing communications;

3.1 (j) Publish photographs, video, audio or testimonials where appropriate consent has been provided;

3.1 (k) Prevent fraud, protect our clients, team, property and business; and

3.1 (l) Comply with our legal, insurance, taxation and regulatory obligations.

3.2 We do not sell health information.

3.3 We do not use health information for direct marketing without consent.

3.4 We do not use identifiable photographs, recordings or testimonials for marketing merely because a person attended a SUR—UNDER service.

HEALTH INFORMATION AND CONFIDENTIALITY

4.1 Health information is sensitive information and is handled with additional care.

4.2 We collect health information only where it is reasonably necessary to safely provide our services and where you have consented or another lawful basis applies.

4.3 A “yes” response on a health-screening form does not automatically prevent you from participating. It helps us determine whether further discussion, professional clearance, modification, postponement or another safeguard may be appropriate.

4.4 Health-screening information and information disclosed during a private session are treated as confidential.

4.5 Access is restricted to SUR—UNDER’s Privacy Officer and, only where genuinely necessary for safety or service delivery, an authorised facilitator or service provider who is bound by confidentiality and privacy requirements.

4.6 Facilitators do not have routine access to client intake or health-screening records.

4.7 Confidentiality may be limited where disclosure:

4.7 (a) Is authorised or required by law;

4.7 (b) Is necessary to respond to a serious threat to life, health or safety;

4.7 (c) Is required to obtain urgent medical or emergency assistance; or

4.7 (d) Is otherwise permitted under applicable privacy law.

4.8 Any disclosure will be limited to what is reasonably necessary in the circumstances.

THE PARTIES TO WHOM YOUR PERSONAL INFORMATION MAY BE DISCLOSED

5.1 Subject to our confidentiality and privacy obligations, we may share relevant personal information with:

5.1 (a) Authorised employees, facilitators and contractors who require the information to deliver the services you request;

5.1 (b) Third-party service providers that assist with bookings, payments, website hosting, forms, communications, cloud storage, analytics, advertising, accounting, insurance, legal advice or IT security;

5.1 (c) Emergency services, medical professionals, your nominated emergency contact or another appropriate person where necessary to protect health or safety;

5.1 (d) Corporate clients, event organisers or studio-hire partners, but only to the extent necessary and without disclosing health information unless authorised or legally permitted;

5.1 (e) Regulators, courts, law-enforcement bodies, insurers or professional advisers where required or permitted by law; and

5.1 (f) A prospective purchaser or successor in connection with a genuine restructure, sale or transfer of the business, subject to appropriate privacy and confidentiality safeguards.

5.2 Our current service environment may include Squarespace, Momence, Linktree, Google Drive, Apple iCloud, email services and Meta platforms, including Instagram and Facebook. It may also include payment, form, analytics and advertising functionality integrated with those services.

5.3 Each third-party provider may process information under its own privacy terms as well as its agreement with us.

5.4 We may also disclose your information where required or permitted by law, including where there are reasonable grounds to suspect unlawful activity or misconduct relating to our functions or activities.

DISCLOSURE AND PROCESSING OUTSIDE AUSTRALIA

6.1 Some of our technology and service providers may store, back up, support or process personal information outside Australia, including in the United States and other countries in which they or their subcontractors operate.

6.2 The locations used by service providers may change from time to time.

6.3 Where personal information is disclosed or processed overseas, we take reasonable steps required by applicable law to assess provider safeguards and protect the information.

6.4 Overseas recipients may be subject to privacy laws that differ from Australian privacy laws.

MARKETING COMMUNICATIONS

7.1 We may send you newsletters, invitations, studio updates and information about our classes, memberships, private sessions, events and other services where you have consented or where otherwise permitted by law.

7.2 You may opt out of receiving marketing communications at any time by:

7.2 (a) Clicking the “unsubscribe” link included at the bottom of a marketing email; or

7.2 (b) Contacting us at hello@surunder.com.

7.3 We will action your request within a reasonable period.

7.4 Opting out of marketing communications will not prevent us from sending essential booking, membership, payment, safety or service-related communications.

PHOTOGRAPHY, FILMING, AUDIO AND TESTIMONIALS

8.1 We may photograph, film or record parts of our classes, events or studio.

8.2 We will provide notice and obtain appropriate consent before capturing or using identifiable client content.

8.3 Attending a class, private session or event does not, by itself, constitute consent to the use of your image, voice or personal story for marketing.

8.4 Wherever practicable, you may attend without appearing in promotional content.

8.5 Your consent may be limited to particular purposes or channels and may be withdrawn for future use by contacting hello@surunder.com.

8.6 Withdrawal of consent may not require us to recall material that has already been lawfully published or distributed, but we will consider reasonable requests for removal.

8.7 Testimonials and sensitive personal stories will only be used with specific permission. We will not materially alter a testimonial in a way that changes its meaning.

COOKIES, ANALYTICS AND ONLINE ADVERTISING

9.1 Our website and linked services may use cookies and similar technologies for website operation, security, bookings and preferences.

9.2 We may also use analytics, pixels or advertising tools to understand website use, measure campaigns and display relevant advertising.

9.3 These tools may collect device and online activity information and may involve providers such as Squarespace, Momence and Meta.

9.4 Where consent is legally required, we will seek it.

9.5 You may be able to block some technologies through your browser or device settings, although parts of our website may then function differently.

SECURITY

10.1 The security of your personal and health information is important to us.

10.2 We use reasonable administrative, physical and technical safeguards proportionate to the sensitivity of the information.

10.3 These safeguards may include controlled access, strong passwords, multi-factor authentication where available, device security, secure cloud storage, confidentiality obligations, secure disposal, backups, incident-response procedures and periodic access reviews.

10.4 Digital health records are not to be stored in personal messages, public social media, shared marketing folders or on unsecured devices.

10.5 If paper records are introduced, they will be stored in a locked location with controlled access and securely destroyed when lawful to do so.

10.6 Payment card details are processed through third-party payment providers. SUR—UNDER does not ordinarily store complete payment card details.

10.7 No method of transmission or storage is completely secure. If an incident occurs, we will act promptly to contain, assess and respond to it.

RETENTION AND DISPOSAL

11.1 We retain personal information only for as long as reasonably necessary for the purposes described in this policy and to meet our legal, insurance, taxation, contractual and dispute-resolution requirements.

11.2 Where SUR—UNDER is required to apply NSW health-record retention requirements, adult health information will be retained for at least seven years from the last occasion on which a health service was provided.

11.3 SUR—UNDER does not currently offer its standard services to people under 18. If this changes, applicable health information will be retained until the person turns 25 and appropriate safeguarding and consent procedures will be introduced.

11.4 When information is no longer required and there is no lawful or legitimate reason to retain it, we will take reasonable steps to securely destroy or de-identify it.

11.5 Backups may retain residual copies until they are overwritten through the ordinary backup cycle, subject to access controls.

ACCESSING, CORRECTING OR UPDATING PERSONAL INFORMATION

12.1 You may contact us to request access to personal or health information we hold about you or ask us to correct or update it.

12.2 We may need to verify your identity or authority before responding to your request.

12.3 Unless we are permitted or required to refuse or limit access, we will endeavour to respond within a reasonable period, generally within 30 days.

12.4 Access may be provided electronically, by inspection or in another suitable form.

12.5 We will not charge you to make an access request. Where permitted, we may charge a reasonable amount for the cost of providing access. We will notify you of any applicable cost beforehand.

12.6 If we refuse or limit access or correction, we will provide written reasons where required and explain the available complaint options.

12.7 If we do not make a requested correction, you may ask us to associate a statement with the relevant record.

12.8 Requests may be submitted to hello@surunder.com.

PRIVACY INCIDENTS AND DATA BREACHES

13.1 We maintain a process to identify, contain, investigate, document and respond to suspected privacy incidents.

13.2 Where a data breach is likely to result in serious harm and the Notifiable Data Breaches scheme or another notification requirement applies, we will notify affected individuals and the Office of the Australian Information Commissioner as required.

13.3 We may also notify the Information and Privacy Commission NSW, insurers, service providers or other bodies where appropriate or required.

13.4 If you believe your information has been lost, accessed or disclosed without authority, please contact us immediately at hello@surunder.com.

NOTIFICATION OF CHANGES

14.1 We may amend this Privacy Policy from time to time.

14.2 The current version will be published on our website and made available upon request.

14.3 Material changes may also be communicated through our booking system, email or another appropriate channel.

COMPLAINTS AND CONTACT DETAILS

15.1 The Director of SUR—UNDER is the Privacy Officer.

15.2 If you have a question, request or complaint about this Privacy Policy or the way we have handled your information, please contact:

SUR UNDER PTY LIMITED
Trading as SUR—UNDER
Privacy Officer: Director
8A/11 Banksia Drive
Byron Bay NSW 2481
Email: hello@surunder.com

15.3 Please provide enough information for us to understand the issue and your desired outcome. Please do not send unnecessary health information by ordinary email.

15.4 We will acknowledge your complaint promptly, investigate it fairly and endeavour to provide a written response within 30 days.

15.5 If more time is reasonably required, we will explain why and provide an updated timeframe.

15.6 If you are not satisfied with our response, you may contact:

Office of the Australian Information Commissioner
Information and Privacy Commission NSW

These bodies may expect you to raise the matter with us first.

DISCLAIMER

This website has been created by SUR—UNDER for general informational purposes.

While reasonable care has been taken to ensure the accuracy and reliability of its content, SUR—UNDER does not guarantee that all information is complete, accurate or current.

Information provided through this website is not intended to replace individual medical, psychological or other professional advice, diagnosis or treatment.

You should seek advice from an appropriately qualified professional regarding your individual circumstances where necessary.

To the extent permitted by law, SUR—UNDER is not responsible for loss, damage, cost or expense arising from reliance on or use of information published on this website.

We may amend this Privacy Policy from time to time. The current version will be published on our website.