Privacy Policy

Last updated 31 October 2026. Version 2.3, replacing the version dated 25 October 2026.

1. About this Policy

This Privacy Policy sets out our commitment to protecting the privacy of personal information provided to us, or otherwise collected by us, offline or online, including through our website (Site).

In this Privacy Policy, 'we', 'us', or 'our' means:

Entity: XLR8 Media, operated by XLR8 Media Holdings Pty Ltd ATF Llewellin Family Trust, ABN 75 533 606 065, Level 17/9 Castlereagh St, Sydney NSW 2000.

We are committed to complying with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), and the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act.

2. Personal Information We Collect

2.1 Information from Clients

When you engage our Google Ads services, we may collect:

Your name and the name of your business or agency
Your email address and phone number
Your business address and ABN
Credit card details for payment processing (handled via PCI DSS compliant processors)
Campaign preferences, target suburbs, and service requirements
Website URLs and digital assets used in advertising campaigns
Performance data from your advertising campaigns (impressions, clicks, click-through rate, ad position and calls, and conversions or leads where they are tracked)
Communications between you and our team

2.2 Information about People Who Respond to Our Clients' Campaigns

When someone responds to an advertising campaign we run for a client (a prospective lead), we may collect personal information about them. What we collect depends on how the campaign is set up:

Calls made from the call button in an ad: the caller's phone number and the date and time of the call
Lead forms, where a campaign uses one: the details the person enters, such as their name, email address, phone number, enquiry details and property information
Conversion tracking on a client's website, where it is set up: the actions a person takes after clicking an ad, such as submitting an enquiry form, and the details collected by that form

This information is collected for the purpose of delivering it to you as the campaign client and is handled in accordance with our standard data security practices. Call details are emailed to the client the next business day.

2.3 Information from Website Enquiries

When you send an enquiry or check suburb availability through our Site, we collect the details you enter: your name, phone number, email address, agency, suburb and message. We use them to reply to you, and a copy is kept on our web server as a backup in case an email does not arrive.

2.4 Information Collected Automatically

When you visit our Site, we may automatically collect:

Your IP address and browser type
Device and operating system information
Pages visited and time spent on our Site
Referring website and clickstream data
Location data (at suburb or city level, where permitted)

3. How We Use Personal Information

We collect, hold, use, and disclose personal information for the following purposes:

To provide Google Ads campaign management services to you
To contact and communicate with you about your campaigns and account
For internal record keeping, invoicing, and administrative purposes
To deliver call details and lead contact details to you as the campaign client
For analytics, platform improvement, and business development
To send you service updates, performance reports, and renewal communications
For advertising and marketing, including promotional information about our services
To comply with our legal obligations and resolve disputes
To consider employment applications where relevant

4. Disclosure of Personal Information to Third Parties

We may disclose personal information to:

Google LLC, for the purpose of creating, managing, and optimising your Google Ads campaigns
Payment processors, for the purpose of processing campaign fees and invoices
Our employees, contractors, and related entities for the purpose of providing services to you
Credit reporting agencies, courts, tribunals, and regulatory authorities in the event of payment default or legal proceedings
Courts, tribunals, regulatory authorities, and law enforcement officers, as required by law
Analytics and advertising platforms (such as Google Analytics) for Site performance measurement

We do not sell personal information to third parties.

5. Overseas Disclosure

Our website is hosted in Sydney, Australia. Client and campaign information is stored in Google products such as Google Workspace and Google Sheets, and our email runs on Microsoft 365. Website enquiries are sent to us through our email delivery provider, Brevo, which may process them outside Australia. These and some of our other service providers may store or process data outside Australia, including in the United States and Singapore. Where data is transferred overseas, we take reasonable steps to ensure the recipient complies with the Australian Privacy Principles or is subject to a comparable privacy regime.

6. Data Security

We are committed to ensuring that personal information we collect is secure. We implement suitable physical, electronic, and managerial procedures to safeguard personal information against misuse, interference, loss, and unauthorised access, modification, or disclosure.

Despite these measures, no system is completely secure. We cannot guarantee the security of information transmitted over the internet. Transmission is carried out at your own risk.

7. Notifiable Data Breaches

In the event of a data breach that is likely to result in serious harm to any individual whose information is involved, we will:

Assess the breach promptly and take steps to contain it
Notify affected individuals as soon as practicable
Report the breach to the Office of the Australian Information Commissioner (OAIC) where required under the NDB scheme
Take remedial action to prevent future breaches

If you become aware of any actual or suspected security breach involving your information, please contact us immediately at info@xlr8.media.

8. Data Retention

We retain personal information for the following periods:

Client contact information: duration of relationship plus 7 years
Campaign and performance data: duration of relationship plus 7 years
Financial records and invoices: 7 years (as required by Australian tax law)
Caller phone numbers from ad calls: shortened to the first four digits after 90 days
Lead form and conversion details, where collected: 12 months from campaign end, unless earlier deletion is requested
Website enquiries that do not lead to an engagement: 2 years
Communications (email, phone records): 3 years unless longer retention is required
Site analytics data: up to 14 months (the Google Analytics retention setting)

9. Cookies and Web Beacons

We may use cookies on our Site from time to time. Cookies are text files placed in your browser to store preferences. Cookies, by themselves, do not tell us your email address or other personally identifiable information. However, they do allow third parties such as Google and Facebook to cause our advertisements to appear on your social media and online media feeds as part of retargeting campaigns.

We may also use web beacons (clear GIFs) to monitor visitor behaviour, count page visits, and deliver cookies. You can control cookies through your browser settings, though disabling them may affect Site functionality.

10. Your Rights

10.1 Access

You may request details of the personal information we hold about you. An administrative fee may be payable. In certain circumstances permitted by the Privacy Act 1988, we may decline access requests.

10.2 Correction

If you believe any information we hold about you is inaccurate, out of date, incomplete, irrelevant, or misleading, please contact us. We will take reasonable steps to correct it.

10.3 Deletion

You may request deletion of your personal information, subject to legal retention requirements. Where deletion is not possible (e.g., financial records required by law), we will advise you accordingly.

10.4 Opt-Out of Marketing

To unsubscribe from our email database or marketing communications, contact us using the details below or use the unsubscribe facility in any marketing email.

11. Privacy Complaints

If you believe we have breached the Australian Privacy Principles or this Privacy Policy, please contact us:

Contact: Email: info@xlr8.media | Phone: 02 8287 3333 | Post: Level 17/9 Castlereagh St, Sydney NSW 2000

We will acknowledge complaints within 2 business days and respond within 30 days with an outcome or progress update.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

12. Amendments

We may, at any time and at our discretion, vary this Privacy Policy by publishing the amended version on our Site with a new 'Last Updated' date. We recommend you check our Site regularly. For material changes, we will notify active clients by email.

13. Contact Us

Email: info@xlr8.media
Phone: 02 8287 3333
Address: Level 17/9 Castlereagh St, Sydney NSW 2000
Website: xlr8.media
ABN: 75 533 606 065

Last Updated: 31/10/2026 | Version 2.3 | Replaces version dated 25/10/2026