Privacy policy

Sydney Buses Australia Pty Ltd

1. About this policy

Sydney Buses Australia Pty Ltd, trading as Sydney Buses & Coaches ("we", "us" or "our"), is committed to protecting your personal information. This policy explains what we collect, why we collect it, who we give it to, how we keep it safe, and how you can access or correct it.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy is the statement required by APP 1, and it is published here so you can read it before you give us anything.

It describes this website as it is actually built, down to the names of the things it stores in your browser. Some of what it describes — website analytics, the map on the contact page, the extra anti-spam check — is only active when we switch it on, and the wording on this page is generated from those same settings. What you are reading is therefore true of the site as you loaded it, not a generic description of what a website might do.

By requesting a quote, asking for a call back, opening an account or making a booking with us, you agree that we may handle your personal information as described here.

2. What we collect

We collect only what we reasonably need to quote for and deliver transport. The quote form asks a different set of questions depending on the kind of trip, so not all of this applies to you. Depending on how you deal with us, it may include:

• Your name, mobile number and email address
• Your organisation or company, an event or school name, and any purchase-order or cost-centre reference for account work
• Trip details: pick-up and drop-off addresses, extra stops, dates, times, how long you need the vehicle, whether it is one way or return, and overnight locations for multi-day work
• Group details: how many passengers, how many supervising adults, the age range for youth groups, luggage and any oversized items or equipment
• Accessibility requirements you choose to tell us, so we assign a suitable vehicle
• Flight, cruise, venue or event details where they affect the timing of your transfer
• How you would prefer to be contacted and the best time to call
• Anything you write in the notes field, how you heard about us, and the content of our later correspondence with you
• Whether you ticked the box asking for occasional updates — it is off unless you tick it

Alongside the answers, each enquiry records where it came from: the page you submitted it on, the page you first landed on, the site that referred you, and any campaign tags that were in the link you clicked. This is attribution for the business — it tells us which pages and which channels produce enquiries — and it is attached to your enquiry rather than used to build a profile of you.

This website does not take payments and never asks you for a card number.

We do not ask for sensitive information as defined in the Privacy Act, and we ask that you do not send it to us unless it is genuinely necessary for your booking — for example a mobility requirement that determines which vehicle we assign. Where you do give us that information, we use it only for that purpose.

We do not knowingly collect personal information directly from children. Bookings for school and youth groups are made by the school or organisation, and we deal with them, not with the students travelling.

3. How we collect it

Wherever it is reasonable and practicable, we collect personal information directly from you. On this site that means the guided quote form, the short call-back strip, the business-account enquiry, the call-back box inside the help panel, and the newsletter subscribe box — or by email and over the phone when you call the office.

Before you send a quote request, the form tells you that your details are used only to prepare and discuss your quote, and links to this page. The only optional extra is the tick box for occasional updates, which is off unless you turn it on.

We also receive information about people from someone else — for example a school, an event organiser, a wedding planner or an employer arranging transport on behalf of a group. Where that happens we handle the information under this policy, and we only use it for the booking it was given to us for.

Some technical information is collected automatically by the website. That is described in the cookies and analytics section below.

4. Why we collect it and how we use it

We use your personal information to:

• Prepare a written quote and answer your enquiry
• Arrange, schedule and deliver your booking, including giving the driver the run sheet they need to find you
• Send you booking confirmations, driver details and trip updates
• Take payment and issue invoices and receipts
• Deal with variations, delays, incidents, complaints and insurance matters
• Keep the business records we are required to keep, including for tax and safety purposes
• Tell automated submissions apart from real enquiries, as described below
• Understand which pages and which channels bring us enquiries, so we can improve the site
• Send you occasional updates, but only where you have asked to receive them

We do not use your information for a purpose you would not reasonably expect. If we ever need to use it for something unrelated, we will ask you first unless the law requires or permits otherwise.

5. What happens to an enquiry you send

When you send a quote request, a call-back request or a business-account enquiry, your answers are saved as a private record in this website's own database and given a reference beginning with SB-. That record is never published: it is excluded from search, from feeds and from the sitemap, it has no public web address, and it can only be opened by someone signed in to the site with permission to manage it.

At the same time the office is emailed a copy of the enquiry so a real person can start on your quote. The reply-to address on that email is yours, so hitting reply reaches you directly. If you gave us an email address, you also receive a confirmation containing your reference and the trip as you described it.

Office staff can export the list of enquiries as a spreadsheet in order to work through quotes. The export contains the same information as the records themselves — it is a different format, not extra data.

One technical value is stored with each enquiry: a one-way hash of the internet address the submission came from. The address itself is not kept and the hash cannot be turned back into one. It exists so that repeated abuse from the same source can be recognised and rate-limited.

The newsletter box is separate. It stores an email address on its own, with no trip details attached, and only ever because someone typed it in and pressed subscribe.

6. Anti-spam checks on the forms

We do not use a CAPTCHA. Nobody should have to identify traffic lights to ask about a bus. Instead the forms carry a few checks that run quietly in the background:

• Two hidden fields that a normal browser leaves empty and an automated script usually fills in. They are never saved with your enquiry.
• A signed timestamp created when the page was built, and a measurement taken in your browser of how long the form was open before you sent it. A form completed in a couple of seconds, or sent from a copy of the page captured a day or more earlier, counts against the submission.
• Checks on what was written. These are not a fixed list, and they include: how many links the enquiry contains; whether the passenger numbers are physically possible; whether the email address belongs to a known throwaway or SMS gateway service; whether the text contains invisible formatting characters; how much vocabulary it shares with known spam; whether the pick-up or drop-off reads as nothing but an overseas country; and whether the name and the notes are written in a non-Latin script.
• A count of how many times the same name or the same email address has been submitted in the past 24 hours, so a scripted flood can be recognised. Both are stored as a one-way hash, the same way the internet address is, and the counter is discarded after a day.
• A limit on how many submissions can arrive from one connection in an hour, counted against the hashed address described above rather than the address itself.

The hidden fields and the timing values themselves are used for one decision only — whether this looks like a machine — and are stripped out before your enquiry is stored. Those raw values never become part of your record.

Where a submission is quarantined, the reasons it was flagged are kept alongside it so that a person can review the decision. Those reasons are short codes rather than measurements — they record that a form was completed unusually quickly, for instance, not the number of seconds it took — and they are deleted with the submission after 30 days. No check described here is used to build a profile of you, to score you as a customer, or for any purpose other than telling an automated submission from a real one.

Most of these signals cannot set an enquiry aside on their own. Only the outright giveaways do that — a hidden field that was filled in, an enquiry that is nothing but links, or a group larger than any operator could field are examples rather than the whole list. Everything else, the script a name is written in included, has to be corroborated by something before a submission is quarantined, so that an ordinary enquiry that happens to look unusual in one respect still reaches us.

A submission judged to be automated is quarantined rather than deleted, so that a genuine enquiry caught by mistake can be found and answered. Quarantined submissions are deleted automatically 30 days after they arrive. If you send us something and hear nothing, please call the office — that is the fastest way to fix a false positive.

7. Cookies, browser storage and analytics

What this site itself stores in your browser

These are set by this website and are readable only by this website. None of them is a cross-site tracking identifier and none of them is sent to another company; the first-visit source cookie can hold an advertising network's click identifier, as described above, and that stays inside this website. One of them — the quote form's saved answers — does hold what you have typed into the form, including your name and contact details, for as long as that tab is open:

• sbq_src — a cookie this site sets on your first visit, recording where you arrived from: the referring website, the page you landed on, and any campaign tags that were in the link you clicked. It lasts 90 days, is restricted to this site, and holds no name and no email address. Where you arrive by clicking an advertisement, it also records the ad network's own click identifier from that link — Google's gclid or Meta's fbclid — so the office can tell which campaign produced your enquiry. It is read once, at the moment you submit a form, and what it holds, click identifier included, is then stored with your enquiry as its source.
• sbq_state_v1 and sbq_prefill — session storage holding your answers as you move through the multi-step quote form, so a refresh or a stray back button does not wipe what you typed. That means they hold what you have entered so far, including your name, email address, mobile number, your notes and any accessibility detail. They live in the browser tab you are using, are never transmitted anywhere on their own, and are cleared when the form is sent or the tab is closed. On a shared or public computer, closing the tab is what clears them.
• sydb_chat_open and sydb_chat_seen — local storage remembering whether you had the help panel open and whether you have seen it before, so it does not reopen itself or re-announce itself on every page.
• If you sign in to the site's administration area, WordPress sets its own login and session cookies. Those apply to our staff, not to visitors.

The forms also carry a single-use security token in the page itself. It protects the form from being submitted from somewhere else, is not stored in your browser, and identifies the form rather than you.

Website analytics

Google Tag Manager and Google Analytics 4 are both supported by this site, but neither is configured at the moment: no measurement container and no analytics tag is loaded on any page, and this site sets no analytics cookie. This paragraph is generated from the site's own settings, so it will describe them by name as soon as either one is switched on.

The website's own code loads no advertising or remarketing tags, and nothing collected here is sold or passed to a data broker. It does still record the ad network's click identifier described in the list above if you arrive by clicking an advertisement, because that attribution is how the office knows which campaign an enquiry came from. That happens whether or not any analytics tag is switched on, and it stays inside this website.

Content loaded from other companies

Two typefaces, Barlow and Inter, are fetched from Google's font servers on every page. Your browser's request for them tells Google your internet address and which page asked for them. No cookie is set by that request.

The contact page can show a Google map of our depot, and it does not load unless you ask for it. Until you press "Load map", nothing is requested from Google for it and no Google cookie is set by it. The address, the phone number and a directions link are on the page in plain text, so you never have to load the map to find us. If you do load it, Google receives your internet address and sets its own cookies under Google's privacy policy rather than ours, for that page view.

Turning any of it off

You can block or delete cookies and clear site storage through your browser settings. The site, the quote form, the phone links and the no-JavaScript version of the form all keep working. What you lose is the form remembering your answers if you refresh, and the office knowing which channel brought you to us.

8. Who we disclose it to

We do not sell personal information, and we do not trade contact lists. We may disclose your information to:

• The driver allocated to your booking, who receives the run sheet with the pick-up details and a contact number
• An accredited partner operator, in the limited circumstances where one supplies part of a service on our behalf, and only what they need to complete the trip
• Service providers who support the business — website hosting, email delivery, accounting software and payment processing — who are bound to use the information only for that purpose
• The technology providers described in the cookies and analytics section, which receive technical information about your visit rather than your enquiry
• Venues, accommodation providers or event organisers where a booking requires it and you have asked us to coordinate with them
• Our insurers and professional advisers, where a claim or a legal matter makes it necessary
• Government, regulatory or law-enforcement bodies, where we are required or authorised by law to do so

9. Direct marketing

Requesting a quote does not sign you up to marketing. We only send marketing communications where you have opted in — by ticking the updates box on the quote form, or by subscribing from one of our articles. Subscribers are stored as an email address on its own, separately from enquiries.

You can opt out at any time by contacting the office, and we will remove your address from the list. Operational messages about a booking you have made — a confirmation, driver details, a change of time — are not marketing and will continue while your booking is live.

10. Storing and protecting your information

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. That includes secured hosting, encrypted connections, access controls so that only staff who need a record can open it, and staff handling procedures.

Enquiry records live in the website's database and are reachable only from the signed-in administration area; copies also exist in our email and accounting systems. Payment card details are not stored on this website.

No transmission over the internet can be guaranteed completely secure. We work to protect your information once we have it, and we ask that you avoid sending anything sensitive by email that you do not need to.

11. Data breaches

If a data breach occurs that is likely to result in serious harm, we will act under the Notifiable Data Breaches scheme in the Privacy Act: we will assess it promptly, take steps to contain it, and notify the affected individuals and the Office of the Australian Information Commissioner as the scheme requires.

12. How long we keep it

Nothing on this website deletes your enquiry on a timer. A stored quote request stays in the site's database until someone at the office removes it, and copies of it also sit in our email and accounting systems for as long as our record-keeping obligations require — tax and business records must be kept for a period set by law.

The one deletion that does happen automatically is of submissions the anti-spam checks quarantined: those are removed 30 days after they arrive.

You can ask us to delete what we hold about you at any time using the contact details below. We will, unless we are required to keep a record — a completed booking that has been invoiced, for example, is part of our accounting history.

13. Overseas disclosure

Some of the providers this site and this business rely on store or process data on servers outside Australia, including in the United States and the European Union:

• Google, which serves the typefaces used on every page of this site, and which receives analytics or map data in the circumstances described in the cookies section.
• Our hosting, email delivery and accounting providers, which may store data on servers outside Australia.

Where that happens we take reasonable steps to ensure the recipient handles your information consistently with the Australian Privacy Principles, as APP 8 requires.

14. Dealing with us anonymously

You can read every page on this site, find our depot address and get directions to it, and check our rates and coverage without telling us anything about yourself. You can also ask a general question by phone without identifying yourself, and we will help where we can.

We cannot issue a written quote or take a booking anonymously, because we need a way to send the quote and a contact for the driver on the day.

15. Government identifiers

We do not adopt a government related identifier — a driver licence number, a Medicare number, a tax file number — as our own way of identifying you. Where a Working With Children Check number is exchanged for a school booking, it is our driver's number being supplied to you for verification, not yours being collected by us.

16. Accessing and correcting your information

You can ask for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. Contact us using the details below. If you have an SB- reference from a quote, quoting it lets us find the record immediately.

We will need to verify your identity before we release anything. We aim to respond within 30 days. There is no charge for making a request, though a reasonable cost may apply where a request takes substantial work to fulfil, and we will tell you before any cost is incurred.

If we decline access or refuse to make a correction, we will tell you why in writing and explain how to complain about that decision.

17. Complaints

If you believe we have mishandled your personal information, contact us first using the details below. Set out what happened and what you would like us to do. We will acknowledge your complaint, investigate it, and respond in writing.

If you are not satisfied with our response, you can take the matter to the Office of the Australian Information Commissioner at oaic.gov.au, which can investigate privacy complaints about Australian businesses.

18. Changes to this policy

We may update this policy from time to time. The current version is always the one published on this page, and a material change takes effect when it is published here.

The parts describing analytics, the map and the anti-spam check are produced from the site's own configuration, so they change at the moment the configuration does rather than waiting for someone to remember to rewrite this page.

19. How to contact us

For any privacy question, an access or correction request, a deletion request or a complaint, contact us:

• Sydney Buses Australia Pty Ltd
• 74 Edinburgh Rd, Marrickville NSW 2204
• Phone: 02 9469 6600
• Privacy enquiries: [email protected]

The Office of the Australian Information Commissioner publishes guidance on your privacy rights, and can investigate a complaint if you are not satisfied with our response. Its website is oaic.gov.au.

Terms & conditions Contact us