Privacy Policy

1. About this Privacy Policy

Nominate Pty Ltd ("Nominate", "we", "us" or "our") operates online platforms and services used by sporting organisations, clubs, associations, event organisers, members, participants, competitors, officials, administrators, customers and members of the public.

Our services include, among other things:

• online membership administration;
• event entries and registrations;
• event draws and schedules;
• competition and event results;
• rider and participant records;
• horse and animal records;
• ticketing;
• venue, stable and camping bookings;
• club administration;
• payment processing;
• live scoring and results;
• online databases;
• communications and notifications; and
• software and technology services provided to sporting and other organisations.

Nominate is committed to protecting personal information and handling it responsibly.

This Privacy Policy explains how Nominate collects, holds, uses and discloses personal information and how individuals can exercise their rights in relation to that information.

Nominate complies with the Privacy Act 1988 (Cth) ("Privacy Act") and the Australian Privacy Principles ("APPs") to the extent they apply to Nominate.

This Privacy Policy is intended to satisfy the requirements of APP 1 concerning the management of personal information.

2. Nominate's role in relation to personal information

Nominate provides technology and database services to sporting organisations, clubs, associations, event organisers and other organisations.

In some circumstances, Nominate collects and handles personal information directly for its own purposes.

In other circumstances, Nominate handles personal information on behalf of an organisation that has engaged Nominate to provide services.

For example, a sporting organisation may engage Nominate to operate its membership database. In that situation, Nominate may process personal information supplied by or collected for that organisation in accordance with the organisation's instructions and the services it has contracted Nominate to provide.

The organisation may remain responsible for determining:

• why the information is collected;
• what information is required;
• how membership or participation is administered;
• who within the organisation may access information;
• what information is disclosed to members or the public;
• how long certain records must be retained; and
• whether information may be used for particular organisational purposes.

Nominate nevertheless remains responsible for its own acts and practices concerning personal information and will implement appropriate privacy and security measures in relation to information it holds or handles.

Nothing in an agreement between Nominate and an organisational client removes any obligation imposed directly on Nominate by applicable privacy law.

3. What is personal information?

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or recorded in material form or not.

Depending on the service being provided, Nominate may handle information including:

• name;
• address;
• email address;
• telephone number;
• date of birth;
• gender;
• emergency contact details;
• membership number;
• club or organisation membership;
• registration information;
• competition information;
• event entries;
• event participation;
• results;
• rankings;
• points;
• qualifications;
• accreditation;
• licences;
• photographs;
• video recordings;
• payment and transaction information;
• correspondence;
• account information;
• IP addresses;
• device information;
• login information;
• user activity;
• location information where provided or reasonably inferred from the service;
• information concerning complaints or disputes;
• information concerning disciplinary or integrity matters;
• health or accessibility information where collected for an authorised purpose; and
• other information that may identify an individual.

4. Information concerning horses and other animals

Nominate's equestrian services may collect and display information concerning horses and other animals.

This may include:

• horse name;
• registration number;
• breed;
• colour;
• sex;
• age or date of birth;
• ownership information;
• rider information;
• competition history;
• event entries;
• results;
• performance records;
• photographs;
• veterinary or health information where specifically collected;
• breeding information; and
• other information supplied by an owner, rider, organisation or event organiser.

Information concerning an animal is not necessarily personal information.

However, information concerning an animal may constitute personal information where it identifies, or can reasonably be used to identify, an individual.

Where this occurs, Nominate will handle the information in accordance with applicable privacy obligations.

5. Sensitive information

Sensitive information receives additional protection under the Privacy Act.

Depending on the services provided, Nominate may handle sensitive information including:

• health information;
• disability information;
• biometric information;
• racial or ethnic information;
• religious or philosophical beliefs;
• political opinions or associations;
• professional or trade association membership; and
• criminal record information.

Nominate will only collect, use or disclose sensitive information where permitted or required by law and, where required, with the individual's consent.

Nominate will not require sensitive information merely because it would be convenient to collect it.

Where sensitive information is handled on behalf of an organisational client, Nominate will generally handle that information in accordance with the client's authorised purposes and instructions, subject to Nominate's legal obligations.

6. Personal information concerning children

Nominate's services may be used to administer sporting activities involving children and young people.

As a result, Nominate may collect personal information concerning individuals under 18 years of age.

This may include:

• name;
• date of birth;
• membership information;
• parent or guardian information;
• emergency contacts;
• event participation;
• competition results;
• photographs and video;
• qualifications;
• registration information;
• health or accessibility information where reasonably necessary; and
• other information required to administer participation.

Nominate recognises that children and young people may require additional privacy protection.

Where appropriate, Nominate will deal with parents or guardians when obtaining consent or exercising rights concerning a child's personal information.

Nominate will take reasonable steps to ensure that information concerning children is only accessible to persons authorised to access it.

7. How Nominate collects personal information

Directly from individuals

For example when an individual:

• creates a Nominate account;
• registers for membership;
• enters an event;
• purchases a ticket;
• makes a booking;
• makes a payment;
• contacts Nominate;
• submits a form;
• communicates with an event organiser;
• participates in an event;
• subscribes to communications; or
• uses a Nominate website or application.

From organisational clients

Nominate may receive personal information from:

• sporting organisations;
• clubs;
• associations;
• event organisers;
• administrators;
• membership organisations; and
• other customers using Nominate services.

From third parties

Where permitted by law, Nominate may receive information from:

• payment providers;
• technology providers;
• affiliated organisations;
• event partners;
• sporting bodies;
• publicly available sources;
• fraud-prevention services;
• identity verification services; and
• persons authorised by the individual.

8. Why Nominate collects personal information

Nominate may collect, hold, use and disclose personal information for purposes including:

• creating and maintaining user accounts;
• administering memberships;
• processing event entries;
• processing registrations;
• administering competitions;
• producing draws and schedules;
• publishing results;
• administering rankings and points;
• administering clubs and associations;
• administering venues;
• processing bookings;
• processing payments;
• issuing tickets;
• providing customer support;
• communicating with users;
• providing software services to organisational clients;
• maintaining databases;
• maintaining accurate records;
• preventing fraud;
• protecting system security;
• detecting misuse;
• investigating incidents;
• complying with legal obligations;
• responding to lawful requests from regulators or authorities;
• resolving complaints and disputes;
• improving Nominate's systems;
• developing and testing software;
• analysing system performance;
• maintaining backups;
• recovering systems following an incident;
• conducting research and statistical analysis using appropriately de-identified information; and
• other purposes reasonably necessary to provide Nominate's services.

Nominate will not use or disclose personal information for an unrelated purpose unless permitted or required by law.

9. Information collected for sporting organisations and clubs

Where Nominate operates a membership or event system on behalf of a sporting organisation, club or association, personal information may be collected for that organisation's authorised purposes.

Examples include:

• establishing membership;
• renewing membership;
• maintaining membership records;
• administering competition eligibility;
• processing event entries;
• administering registrations;
• communicating with members;
• publishing draws;
• publishing results;
• administering rankings;
• maintaining sporting records;
• administering qualifications or accreditation;
• administering disciplinary or integrity processes; and
• other purposes specified by the organisation.

The relevant sporting organisation or club may have its own privacy policy. Individuals should therefore also review the privacy policy of the organisation with which they are dealing.

10. Publicly available competition information

Sporting competitions frequently require certain information to be publicly available.

Depending on the sport and event, information may include:

• competitor name;
• horse name;
• class;
• competition number;
• draw position;
• results;
• placing;
• points;
• rankings;
• performance statistics;
• team information;
• club or organisation;
• photographs; and
• other information ordinarily associated with sporting participation.

Nominate may publish this information where authorised by the relevant event organiser or sporting organisation and where permitted by applicable law.

Nominate does not determine the sporting rules governing whether particular competition information should be publicly displayed unless Nominate has expressly agreed to do so.

11. Use and disclosure of personal information

Nominate may use and disclose personal information for the purposes described in this Privacy Policy.

Depending on the circumstances, information may be disclosed to:

• the sporting organisation, club or association for which the information is being collected or maintained;
• event organisers;
• authorised administrators;
• officials;
• authorised service providers;
• payment processors;
• hosting and infrastructure providers;
• professional advisers;
• insurers;
• regulators;
• government authorities;
• courts and tribunals;
• law enforcement agencies;
• persons authorised by the individual; and
• other recipients where permitted or required by law.

Nominate will take reasonable steps to ensure that disclosures are appropriate for the purpose for which the information was collected.

12. Access by organisational clients

Nominate provides authorised administrators with access to personal information necessary to operate the services purchased by their organisation.

The level of access available to an administrator depends on:

• the service being provided;
• the organisation's configuration;
• the administrator's role;
• permissions assigned by the organisation;
• the information concerned; and
• applicable legal requirements.

Nominate uses access controls to restrict access to authorised users.

Organisations using Nominate are responsible for ensuring that their administrators only access information for legitimate organisational purposes.

Nominate may maintain records of administrator access and system activity for security, audit and operational purposes.

13. Data ownership and control

Where an organisation provides personal information to Nominate for the purpose of operating a membership, event or other service, Nominate does not acquire ownership of that personal information merely because it is stored within Nominate's systems.

Nominate's rights to access, process and retain information are governed by:

• applicable law;
• the contractual arrangements with the organisation;
• the purpose for which the information was collected;
• the individual's rights under applicable privacy legislation; and
• the operation of the relevant Nominate service.

Nothing in this section prevents Nominate from retaining information where it is reasonably necessary or required by law to do so.

14. Disclosure between sporting organisations

Where an individual participates in multiple organisations using Nominate, information held for one organisation will not automatically be made available to another organisation merely because both organisations use Nominate.

Access to information will depend on:

• the relevant service;
• the permissions configured for the organisation;
• the purpose for which the information was collected;
• applicable contractual arrangements;
• the individual's authorisation; and
• applicable privacy law.

Where information is shared between organisations, Nominate will take reasonable steps to ensure that the disclosure is authorised and appropriate.

15. Direct marketing

Nominate may send direct marketing communications where permitted by law.

These may include information concerning:

• Nominate products;
• Nominate services;
• new features;
• events;
• software services;
• promotions; and
• other services relevant to Nominate users.

Nominate will comply with applicable requirements of the Privacy Act and Spam Act 2003 (Cth).

Individuals may unsubscribe from marketing communications at any time.

Unsubscribing from marketing communications will not prevent Nominate from sending essential service communications, including account notifications, membership notifications, transaction confirmations, security notifications, event notifications or other communications necessary to administer a service.

16. Cookies and website information

Nominate websites and applications may use cookies and similar technologies.

These may collect information including:

• IP address;
• browser type;
• device information;
• operating system;
• pages viewed;
• access times;
• referring websites;
• session information; and
• website preferences.

Nominate may use this information to operate its websites, maintain security, authenticate users, maintain sessions, analyse usage, improve services, diagnose technical problems and prevent fraud or misuse.

17. Payment information

Payments made through Nominate may be processed using third-party payment service providers.

Nominate may receive information such as:

• transaction amount;
• transaction date;
• payment status;
• transaction identifier;
• payer name;
• email address; and
• other information required to reconcile the transaction.

Where payment card information is processed by a third-party payment provider, Nominate does not necessarily receive or retain the complete card number or security code.

Payment providers: Braintree, Paypal

18. Security of personal information

Nominate takes reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, unauthorised modification and unauthorised disclosure.

Nominate's security measures may include:

• authentication;
• role-based access controls;
• encryption;
• secure communications;
• network security;
• monitoring;
• logging;
• system hardening;
• backup systems;
• disaster recovery procedures;
• physical security;
• staff access controls;
• staff training;
• security testing; and
• contractual controls over service providers.

Nominate will not publish detailed information about its security architecture where doing so could reasonably compromise the security of its systems.

19. Data breach response

Nominate maintains procedures for responding to suspected or actual data breaches.

A data breach may involve unauthorised access, unauthorised disclosure, loss of personal information, compromised credentials, malicious activity, ransomware, accidental disclosure or other unauthorised handling.

Nominate will assess suspected breaches in accordance with applicable law.

Where an incident constitutes an eligible data breach under the Privacy Act, Nominate will comply with the Notifiable Data Breaches scheme, including notifying the OAIC and affected individuals where required.

Where a breach affects personal information held by Nominate on behalf of an organisational client, Nominate will also notify the relevant client in accordance with the applicable contractual arrangements and applicable law.

20. Data retention

Nominate retains personal information only for as long as reasonably necessary for the purposes for which it is held or as required or authorised by law.

Retention periods may depend on:

• the nature of the information;
• the service provided;
• the relationship with the individual;
• the contractual requirements of an organisational client;
• legal and regulatory requirements;
• accounting requirements;
• dispute resolution;
• security requirements;
• backup and disaster recovery requirements; and
• whether the information forms part of a historical sporting record.

Some sporting records may need to be retained for extended periods because they constitute historical records of participation, competition results, qualifications, registrations or achievements.

When information is no longer required, Nominate will take reasonable steps to destroy or de-identify it unless retention is required or authorised by law.

21. Backups

Nominate maintains backup and recovery systems to protect the availability and integrity of its services.

Backups may contain personal information.

Backup information may therefore remain in existence for a period after information has been removed from an active database.

Nominate will manage backups in accordance with its security, retention and disaster recovery procedures.

Where information is required to be deleted or de-identified, Nominate will take reasonable steps to ensure that it is dealt with appropriately within its backup lifecycle.

22. Overseas disclosures and processing

Nominate's current publicly stated infrastructure is based in Australia. However, Nominate may use third-party technology, software or service providers that operate internationally.

Potential overseas providers may include providers of:

• software;
• email;
• payment processing;
• analytics;
• customer support;
• security services;
• cloud services;
• communications;
• artificial intelligence services; and
• other technology infrastructure.

Before disclosing personal information to an overseas recipient, Nominate will comply with APP 8 unless an exception applies.

Where APP 8 applies, Nominate will take reasonable steps to ensure that the overseas recipient does not breach the APPs in relation to the information. Nominate may also remain accountable under section 16C of the Privacy Act for certain acts or practices of an overseas recipient.

Nominate will maintain an internal register of material overseas recipients and review those arrangements periodically.

23. Artificial intelligence and automated processing

Nominate may use artificial intelligence, machine learning, algorithms or other automated technologies in connection with its services.

Examples may include:

• event scheduling;
• draw generation;
• data analysis;
• fraud detection;
• security monitoring;
• system optimisation;
• customer support;
• recommendations;
• administrative automation;
• software development and testing; and
• analysis of de-identified or aggregated information.

Nominate will not use personal information with an external artificial intelligence provider merely because doing so is technically possible.

Where personal information is provided to an AI or automated processing provider, Nominate will assess:

• the purpose of the processing;
• the type and sensitivity of information;
• whether personal information is necessary;
• whether the provider retains the information;
• whether the provider uses the information to train models;
• where the provider processes the information;
• security arrangements;
• contractual protections;
• deletion arrangements; and
• applicable Privacy Act requirements.

Nominate will take reasonable steps to prevent personal information being used for unrelated AI training or model development purposes unless that use is authorised by law or otherwise permitted.

24. Automated decisions that significantly affect individuals

From 10 December 2026, the Privacy Act requires an APP privacy policy to contain specified information where a computer program uses personal information to make, or substantially and directly assist in making, a decision that could reasonably be expected to significantly affect an individual's rights or interests.

Where these requirements apply to Nominate, this Privacy Policy will identify:

Categories of personal information used

Rider name, Horse Name

Categories of decisions made solely or substantially using automated systems

Scheduling and Validating data

Examples

Where applicable, automated systems may assist with:

• event scheduling;
• draw generation;
• allocation of competition times;
• administrative eligibility checks;
• fraud or security assessments; and
• other operational decisions.

An automated scheduling or draw system that merely determines competition order or timing will not necessarily constitute a decision that significantly affects an individual's rights or interests. Nominate will assess each system according to the circumstances and the requirements of the Privacy Act.

25. Access to personal information

An individual may request access to personal information Nominate holds about them in accordance with APP 12.

Requests should be made using the contact details in section 32.

Nominate may need to verify the individual's identity before providing access.

Where information is held by Nominate on behalf of a sporting organisation, club or association, Nominate may refer the request to that organisation or consult with it before providing access where appropriate.

This does not prevent Nominate from complying with its own obligations under the Privacy Act.

Nominate will generally respond within a reasonable period.

Access may be refused where permitted or required by the Privacy Act or another law.

If access is refused, Nominate will provide written reasons where required.

26. Correction of personal information

Individuals may request correction of personal information that Nominate holds about them where the information is inaccurate, out-of-date, incomplete, irrelevant or misleading.

Where information is held on behalf of a sporting organisation, club or association, Nominate may need to involve that organisation in the correction process.

Nominate will take reasonable steps to ensure that personal information it holds is accurate, up-to-date and complete.

27. Identity verification

Nominate may require reasonable evidence of identity before providing access to, correcting or otherwise dealing with personal information.

Identity verification requirements will be proportionate to the sensitivity of the information and the risk of unauthorised access.

Nominate will not request unnecessary identification information merely for convenience.

28. Anonymity and pseudonymity

Where practicable, individuals may interact with Nominate anonymously or by using a pseudonym.

However, anonymity or pseudonymity may not be practicable where Nominate needs to establish a membership, process an event entry, process a payment, verify eligibility, administer an account, comply with legal obligations or provide a service requiring identification.

29. Government identifiers

Nominate will not adopt a government-related identifier as its own identifier unless permitted by law.

Nominate will only use or disclose government-related identifiers in accordance with applicable privacy legislation.

30. De-identified and aggregated information

Nominate may create and use de-identified or aggregated information for purposes including:

• statistical analysis;
• system development;
• service improvement;
• research;
• reporting;
• benchmarking;
• planning;
• security analysis; and
• business analysis.

Nominate will take reasonable steps to ensure that information described as de-identified cannot reasonably be used to identify an individual.

31. Data portability and export

Where Nominate provides a database or membership service to an organisation, the organisation may request export of information in accordance with its contractual arrangements with Nominate.

Where an individual requests information relating to themselves, Nominate will deal with the request in accordance with APP 12 and applicable contractual arrangements.

A request by an organisation to export its database does not automatically require Nominate to delete information where Nominate has an independent legal obligation or legitimate requirement to retain it.

32. Privacy contact

33. Privacy complaints

If an individual believes that Nominate has breached the Privacy Act, the APPs or this Privacy Policy, they may make a complaint to Nominate.

Complaints should provide enough information for Nominate to investigate the issue.

Nominate will:

1. acknowledge the complaint where appropriate;
2. assess the complaint;
3. investigate the relevant circumstances;
4. consult relevant personnel or organisations where necessary;
5. take reasonable steps to resolve the complaint; and
6. provide a response.

Nominate will generally aim to respond within 30 days, although complex matters may require additional time.

Nominate will not charge an individual for making a privacy complaint.

34. Complaints to the OAIC

If an individual is dissatisfied with Nominate's response, they may contact the Office of the Australian Information Commissioner (OAIC).

The OAIC generally recommends that an individual first raise the matter with the organisation concerned.

Information about making a complaint to the OAIC is available at www.oaic.gov.au.

35. Third-party websites and services

Nominate websites may contain links to websites or services operated by third parties.

Those services may have separate privacy policies.

Nominate is not responsible for the privacy practices of third parties that Nominate does not control.

Individuals should review the privacy policy of a third-party service before providing personal information to it.

36. Changes to this Privacy Policy

Nominate may update this Privacy Policy from time to time.

Changes may be required because of:

• changes to the Privacy Act;
• changes to the APPs;
• changes to Nominate's services;
• changes to technology;
• changes to service providers;
• changes to data handling practices;
• changes to security practices; or
• regulatory developments.

The current version will be published on the Nominate website.

The "Last updated" date at the beginning of this Privacy Policy identifies the date of the latest revision.

Where a significant change materially affects the way Nominate handles personal information, Nominate will take reasonable steps to notify affected individuals where appropriate.

37. Availability

This Privacy Policy is available free of charge on the Nominate website.

A copy may also be requested from Nominate.

38. Contact details