1. Who we are

Colourful Fantasy ("we", "us", "our") is a face painting and entertainment service operated by Nadia Zuleta and based in Sydney, New South Wales, Australia. We operate the website colourfulfantasyaus.com.

This Privacy Policy explains how we collect, use, disclose, and store personal information in accordance with the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles (APPs) issued by the Office of the Australian Information Commissioner (OAIC). If you are a resident of the European Economic Area (EEA) or the United Kingdom, we also process your data in accordance with the EU/UK General Data Protection Regulation (GDPR) where it applies.

2. What information we collect

We collect the following categories of personal information:

Booking enquiry data— your name, phone number, optional email address, event date, event type, approximate number of children, event location, and any message you send via our booking form.
WhatsApp message metadata— when you click our WhatsApp button, your WhatsApp display name, phone number, and the content of the messages you choose to send are received by us via the WhatsApp Business platform (operated by Meta Platforms Ireland Ltd).
Technical and analytics data— IP address, device type, browser, referring URL, pages viewed, and approximate geographic region (city or region only, never street-level). This is collected via Google Analytics 4 and Google Tag Manager, and only after you have given consent through our cookie banner.
Advertising attribution data— UTM parameters and Google Click Identifiers (gclid) that tell us which ad or campaign referred you. Stored only in your browser's session storage and, with your consent, sent to Google Ads for conversion measurement.

We do not knowingly collect personal information from children under 13. Bookings are placed by a parent or guardian on behalf of the children attending the event.

3. How we use your information

To respond to your enquiry and arrange your booking.
To send you a quote and a booking confirmation.
To process the booking deposit (currently AUD 50) and the final payment.
To improve the website, measure ad performance, and decide where to invest in marketing.
To comply with Australian tax and consumer-law obligations.

We do not sell your personal information to third parties. We do not send marketing emails unless you have explicitly opted in.

4. Cookies and tracking technologies

Our website uses cookies and similar tracking technologies. These are grouped as follows:

Strictly necessary— keep the site working (security, form submission, remembering your preferences). Always on.
Analytics— Google Analytics 4 (GA4) via Google Tag Manager (GTM). Off by default. Only runs after you click "Accept" on our cookie banner or explicitly enable analytics in the cookie preferences sheet.
Marketing— Google Ads conversion tracking and remarketing. Off by default. Only runs after you opt in via our cookie banner.

You can change your choice at any time via the "Cookie settings" link in the footer. Google Analytics is configured with IP anonymisation, Google Signals disabled, and a 14-month data retention window.

5. Who we share data with

We share personal information only with the following service providers, and only to the extent required for them to deliver their service to us:

Vercel Inc.(USA) — website hosting.
Neon— database hosting (Sydney region, ap-southeast-2).
Google LLC— Google Analytics 4, Google Tag Manager, and Google Ads. Used only with your consent.
Meta Platforms Ireland Ltd— WhatsApp Business. Used only when you initiate a chat with us.

6. International transfers

Some of the service providers above are located outside Australia. When personal information is transferred overseas, we take reasonable steps under APP 8 to ensure that the overseas recipient handles the data in a way consistent with the APPs, including by relying on Standard Contractual Clauses or equivalent safeguards where appropriate.

7. How long we keep your data

Booking enquiries— up to three years from the date of your event, to comply with Australian tax record-keeping obligations.
Analytics data— 14 months in Google Analytics 4.
Marketing identifiers (gclid, UTM)— purged from your session when you close the browser tab; aggregated in Google Ads for up to 90 days.

8. How we protect your information

We take reasonable steps under APP 11 to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. These include encrypted transport (HTTPS), access controls on our database, and minimising the amount of personal information we collect in the first place.

9. Your rights

Under the Privacy Act 1988 and the Australian Privacy Principles you have the right to:

Access the personal information we hold about you (APP 12).
Correct inaccurate or out-of-date information (APP 13).
Complain to us, and, if not resolved, to the OAIC at oaic.gov.au.

If GDPR applies to you, you additionally have the right to erasure, restriction of processing, data portability, and to object to processing. To exercise any of these rights, contact us using the details in Section 10.

10. How to contact us

Email: colourfulfantasyaus@gmail.com
Phone / WhatsApp: +61 433 858 993
Business: Colourful Fantasy, Sydney NSW, Australia
Website: colourfulfantasyaus.com

We aim to respond to privacy enquiries within 30 days, in line with OAIC guidance.

11. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available at colourfulfantasyaus.com/privacy with the date of the last revision shown at the top of the page.