Folklore Privacy Policy

Effective date: 7 September 2026 Last updated: 7 September 2026 Version: 1.0

1. About this policy

Folklore Murder Mystery Events ("Folklore", "we", "us", "our") is a registered business name of Lorekeeper Pty Ltd (ABN 36 700 584 701). We design and run social deduction and murder mystery events for the public, for private groups, and for workplaces across Australia.

This policy explains what personal information we collect about you, why we collect it, who we share it with, and what control you have over it. It applies to everything we do: our website at playfolklore.com, our ticketed public events, private and corporate bookings, our mailing list, and our social media channels.

We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth). Because of our current size, some of these obligations do not yet apply to us by law. We have chosen to follow them anyway, because our guests and our corporate clients are entitled to expect it.

If anything here is unclear, ask us. Contact details are in section 21.

2. What we mean by "personal information"

Personal information is any information or opinion about an identified individual, or an individual who is reasonably identifiable, whether or not it's true, and whether or not it's recorded in a material form.

Sensitive information is a subset that gets extra protection: health information, racial or ethnic origin, religious beliefs, political opinions, sexual orientation, criminal record, and biometric information. We collect very little of it, and only where we've explained in section 4.

3. What personal information we collect

3.1 When you book or buy a ticket

Your name, email address and phone number
Billing details, and the card type and last four digits shown to us by our payment provider (we never see or store your full card number)
If you pay with Apple Pay or Google Pay, a device-specific or merchant-specific account number rather than your actual card number
The event, date, venue and ticket type you booked, and your booking history with us
Any notes you give us about your group, such as group size, occasion, seating or grouping requests
Discount or promotional codes used

3.2 When you make an enquiry or book a corporate event

Your name, work email, phone number, job title and organisation
Details of the event you're planning, including group size, preferred dates, venue, budget, objectives
Correspondence between us, including emails, quotes and invoices
Where your organisation gives us an attendee list, the names and contact details of your attendees (see section 12)

3.3 When you attend an event

Your first name or the name you choose to play under
Accessibility requirements, dietary requirements or allergies you tell us about, and anything else you ask us to accommodate
Photographs, video and audio recordings taken at the event (see section 6)
Feedback, survey responses and any review you choose to leave

3.4 When you join our mailing list or follow us

Your name and email address, and your phone number if you opt in to SMS
Which of our emails you open and which links you click
Your interactions with our social media accounts and advertising, including comments, messages, reactions and ad clicks

3.5 When you visit our website

Your IP address, device type, browser, approximate location, referring page and the pages you view
Cookies and similar identifiers set by us and by our analytics and advertising partners (see section 8)

We only collect personal information that we reasonably need to run our events and our business. Where it's practical, you can deal with us anonymously or under a pseudonym. See section 13.

4. Sensitive information

Two situations bring us into contact with sensitive information:

Dietary requirements, allergies and accessibility needs. Where our events involve food, drink or a venue with access considerations, you may choose to tell us about an allergy, a dietary requirement, a medical condition or a mobility need. Some of this is health information. We collect it only with your consent, only to run your event safely and comfortably, and we share it only with the venue or supplier who needs to act on it. We delete it once the event has passed and any incident window has closed.

Content warnings and comfort. Our games involve themes of deception, accusation and fictional violence. If you tell us about a topic you'd rather avoid, we treat that as confidential, use it only to brief your Storyteller, and don't retain it after the event.

You are never required to give us sensitive information. If you'd prefer not to disclose the reason for a requirement, tell us the practical accommodation you need and we'll work with that.

5. How we collect personal information

We collect personal information directly from you wherever we reasonably can: when you buy a ticket, complete a form, email or message us, speak to us at an event, or subscribe to our list.

We also collect it from other sources, including:

Our website and booking system (Wix), when you buy a ticket or request a booking online
The person who made the booking, when someone books on behalf of a group, such as the organiser of a birthday, a hens' night, or a workplace team
Your employer or event organiser, for corporate bookings
Venue partners, where a booking is made through the venue
Publicly available sources such as your organisation's website, LinkedIn or social media, where we're responding to a business enquiry or preparing a corporate proposal
Analytics and advertising platforms, which give us aggregated and pseudonymised information about how people find and use our website

If you're booking for a group: please make sure the people you're booking for know that their details are being given to us and can read this policy. It's a short link: playfolklore.com/privacy.

6. Photography, filming and audio at our events

This matters enough to have its own section, because our events are visually distinctive and we use footage from them to market Folklore.

What we do. We regularly photograph and film our events, and we use that material on our website, our social media channels, in paid advertising, in media coverage, in proposals to prospective clients, and in printed material. Where an event is being photographed or filmed, we tell you at the point of booking and again at the venue before play starts.

Your choice. You can opt out. Tell your Storyteller before the event begins, or email us in advance at info@playfolklore.com, and we will not use identifiable images of you in our marketing. Opting out doesn't affect your ticket, your seat, or how you're treated on the night. This is a routine request and no explanation is needed.

Group and wide shots. We may still capture wide shots of a room in which you are incidentally visible. If a specific image concerns you, ask us to remove it and we will.

Taking it down. If you've already appeared in something published and you'd like it removed, email us. We'll remove it from anything we control, meaning our website and our own social accounts, within a reasonable time, usually 10 business days. We'll make our best effort with material already shared onward by others or picked up by media, but we can't guarantee its removal from third-party sites.

Guests photographing each other. Other attendees may take their own photos and video. We ask everyone to be considerate, but we don't control what other guests capture or post.

Private and corporate events. For private bookings we photograph or film only where the organiser has agreed in advance, and we don't publish material from a private event without the organiser's permission and reasonable notice to attendees.

What we don't do. We don't use facial recognition or any biometric technology on event footage, and we don't sell or license event footage to third parties for their own marketing.

7. Why we collect, hold, use and disclose personal information

We use personal information to:

Run your event. Processing bookings and payments, confirming details, allocating Storytellers, briefing venues, managing seating and group composition, and accommodating any requirements you've told us about.
Communicate with you. Sending confirmations, reminders, changes, cancellations, refunds and post-event follow-ups.
Quote and propose. Preparing quotes, proposals and invoices for private and corporate bookings.
Market what we do. Sending you news about upcoming events, new games and offers, and running advertising on Meta, Google and other platforms. Sections 9 and 10 explain this in more detail.
Improve our games and our website. Analysing feedback, reviews and attendance patterns.
Show people what a Folklore event is like. Using event photography, video and testimonials in our marketing and in proposals to prospective clients.
Run the business. Accounting, tax, insurance, record-keeping, resolving disputes, and getting professional advice.
Keep our events safe and well run. Managing incidents, responding to complaints, and meeting our duty of care and our venue partners' requirements.
Meet our legal obligations. Complying with Australian law and responding to lawful requests from regulators, courts or law enforcement.

We will only use or disclose your personal information for the purpose we collected it for, for a directly related purpose you would reasonably expect, where you've consented, or where the law requires or permits it.

We do not sell your personal information.

8. Cookies, analytics and advertising technology

Our website is built and hosted on Wix, and uses cookies and similar technologies to make the site work, to understand how it's used, and to advertise.

Essential cookies are set by Wix to run the site: the booking flow, security, and remembering your session. The site won't work properly without them.
Analytics cookies, including Wix Analytics and Google Analytics, tell us which pages people visit, how they arrived, and where they drop off, so we can improve the site.
Advertising cookies and pixels, including the Meta Pixel and Google advertising tags, let us measure whether our ads work and show relevant ads to people who've visited our site.

Wix publishes its own cookie information and privacy policy at wix.com/about/privacy, which sets out the cookies Wix places on sites it hosts.

You can block or delete cookies through your browser settings, and you can opt out of personalised advertising through your Meta and Google account settings, or at youronlinechoices.com.au. Blocking essential cookies may stop parts of our booking flow from working.

Custom audiences. We may provide hashed (scrambled) email addresses to Meta or Google so we can advertise to our existing guests, or to build "lookalike" audiences of people with similar characteristics. Hashing means the platform can match the record without receiving a readable email address. If you'd rather not be included, email us at info@playfolklore.com and we'll exclude you.

9. Marketing and how to stop it

If you've bought a ticket, made an enquiry, or subscribed, we may send you news about upcoming events and offers by email or SMS. We do this consistent with the Spam Act 2003 (Cth). Every message identifies us and contains a working unsubscribe.

To stop marketing:

Click unsubscribe in any email
Reply STOP to any SMS
Or email info@playfolklore.com and we'll remove you

We'll action it promptly and in any case within five business days. You'll still receive operational messages about a booking you've made, such as confirmations, reminders, changes and refunds, because those aren't marketing.

10. Who we share your personal information with

We disclose personal information to:

Venue partners, where your event is at a hospitality venue: typically the booking name, group size, timing, and any dietary or accessibility requirements the venue needs to act on
Storytellers and event staff, including independent contractors who host our games, limited to what they need to run your event
Wix, which provides our website, hosting, booking and ticketing system, contact database, email marketing and site analytics. Wix holds our booking records and our mailing list on our behalf
Stripe, our payment provider, which processes card payments. Your card details go to Stripe directly and we never see or store your full card number. Stripe's Australian contracting entity is Stripe Payments Australia Pty Ltd
Apple and Google, where you choose to pay with Apple Pay or Google Pay. These services replace your card number with a token, so we never receive your card details
Google, for website analytics
Advertising platforms, as described in section 8
Photographers, videographers and designers we engage to produce marketing material
Our accountant, bookkeeper, insurers and professional advisers
The organisation that booked your event, for corporate bookings, for example confirming attendance numbers to the client's event organiser
Government agencies, regulators, courts or law enforcement, where the law requires or authorises it
A purchaser or successor, if we sell or restructure the business, in which case your information would transfer subject to the same protections

We require our service providers and contractors to protect personal information, to use it only for the purpose we've engaged them for, and not to disclose it further. Our Storyteller contracts include confidentiality and privacy obligations.

We do not disclose personal information to third parties for their own marketing purposes.

11. Overseas disclosure

Our main platforms are based overseas, so personal information you give us is stored and processed outside Australia. We'd rather tell you exactly where than leave it vague.

Wix. Our website, bookings, ticketing, contact database and email marketing all run on Wix. Wix.com Ltd is headquartered in Israel, and stores site data in data centres in the United States and Ireland. Wix also uses its own subsidiaries and sub-processors in a number of other countries, including the United Kingdom, Germany, Lithuania, Luxembourg, India, Ukraine, Brazil and Mexico, for infrastructure, support and communications. Wix publishes its current sub-processor list, and relies on Standard Contractual Clauses for cross-border transfers.

Stripe. Card payments are handled by Stripe. Our contracting entity is Stripe Payments Australia Pty Ltd, but Stripe operates globally and processes and stores payment data outside Australia, principally in the United States. Stripe publishes its own privacy policy and data processing terms.

Apple Pay and Google Pay. Where you pay with a mobile wallet, Apple or Google processes the transaction under its own privacy policy, principally in the United States. We receive a payment token rather than your card details.

Advertising and analytics. Meta and Google process the information described in section 8 in the United States and in other countries where they operate.

A note on Israel: the European Commission has recognised Israel as providing an adequate level of protection for personal information, which is the same standard applied to EU member states.

Before disclosing personal information overseas we take reasonable steps to ensure the recipient handles it consistently with the APPs. In practice, that means using established providers with published privacy and security commitments, documented sub-processor lists, and contractual data protection terms.

If you'd like more detail about where your particular information sits, email us at info@playfolklore.com and we'll tell you what we know.

12. Corporate, group and third-party bookings

Where an organisation books an event and gives us attendee details, we act on that organisation's instructions in relation to those details and use them only to run the event.

The booking organisation is responsible for making sure it has a proper basis to give us those details, and for telling its attendees that their information has been shared with us and how to find this policy.

Unless the client asks otherwise, we retain corporate attendee lists only for as long as needed to run the event and settle the invoice, and we don't add corporate attendees to our marketing list without their own consent. Corporate clients who need a specific data handling arrangement, a supplier privacy questionnaire completed, or a confidentiality deed should contact us at info@playfolklore.com. We're happy to work through it.

13. Dealing with us anonymously

You can deal with us anonymously or under a pseudonym where it's lawful and practicable. In practice:

You can play under a name of your choosing at an event
You can browse our website without identifying yourself
You can ask general questions by phone or social media without giving your name

We do need your real name and contact details to take a booking, process a payment, issue a refund, or send you a tax invoice.

14. How we store, secure and dispose of personal information

Most personal information we hold sits inside the Wix platform, covering bookings, contacts and our mailing list, with the rest in our business email and file storage. We protect it with:

Access limited to people who need it. Storytellers see only what they need for their event
Multi-factor authentication on our Wix account, our email and our other core accounts
Strong, unique passwords held in a password manager
Encryption in transit, and encryption at rest where our providers offer it
Reputable providers chosen partly on their security posture
Contractual confidentiality obligations on our contractors
Periodic review of who has access to what

How long we keep it. We keep personal information only as long as we need it:

Booking and transaction records: 7 years, to meet Australian tax and record-keeping obligations.
Dietary, allergy and accessibility information: deleted once the event has passed and any incident window has closed.
Mailing list records: until you unsubscribe, plus a suppression record so we don't add you back by mistake.
Marketing photography and video: indefinitely, unless you ask us to remove your image.
Enquiries that don't become bookings: 24 months.
Website analytics: as set by the retention settings in Wix Analytics and Google Analytics.
Incident and complaint records: 7 years.

When we no longer need personal information and aren't required to keep it, we destroy it or de-identify it.

No system is completely secure. If something goes wrong, section 15 explains what we do.

15. Data breaches

If personal information we hold is lost, or accessed or disclosed without authorisation, we will investigate promptly, contain it, and assess whether it's likely to result in serious harm.

Where it is, we will tell the affected individuals and the Office of the Australian Information Commissioner as soon as practicable, explaining what happened, what information was involved, and what you can do to protect yourself, regardless of whether the Notifiable Data Breaches scheme technically applies to us at the time.

16. Accessing and correcting your information

You can ask us for a copy of the personal information we hold about you, and you can ask us to correct anything that's inaccurate, out of date, incomplete, irrelevant or misleading.

Email info@playfolklore.com. We'll ask you to verify your identity, then respond within 30 days. There's no charge for making a request; if a request requires substantial work we may charge a reasonable cost-based fee, and we'll tell you before we do anything that costs you money.

We can refuse access in limited circumstances set out in the Privacy Act, for example where giving access would unreasonably affect another person's privacy, or relate to a legal dispute. If we refuse, we'll explain why in writing and tell you how to complain.

You can also ask us to delete personal information we hold about you. We'll do that unless we're required to keep it, most commonly transaction records we must retain for tax purposes.

17. Automated decision-making

We do not use computer programs or artificial intelligence to make decisions about you that significantly affect your rights or interests. Bookings, refunds, complaints and event decisions are made by people.

We do use ordinary business tools that involve automation: email platform segmentation, advertising platform targeting, and website analytics. None of these decide anything of consequence about you.

If this changes, we'll update this policy to describe what information is used and what kinds of decisions are involved, consistent with the automated decision-making transparency requirements taking effect on 10 December 2026.

18. Children

Our public events are generally intended for adults, and some contain themes better suited to an older audience. We don't knowingly collect personal information from children under 15 through our website or mailing list. Where an event is booked for a group including young people, we deal with the adult organiser or the responsible adult, not with the children directly, and we won't publish identifiable images of a minor without the express permission of a parent or guardian.

If you believe we hold information about a child that we shouldn't, email us and we'll delete it.

19. Complaints

If you think we've mishandled your personal information, tell us first. We'd like the chance to fix it.

Step 1. Email info@playfolklore.com with the subject line "Privacy complaint", setting out what happened and what you'd like us to do. We'll acknowledge within 5 business days and give you a substantive response within 30 days.

Step 2. If you're not satisfied with our response, or we don't respond in time, you can complain to the Office of the Australian Information Commissioner:

Online: oaic.gov.au/privacy/privacy-complaints
Phone: 1300 363 992
Post: GPO Box 5218, Sydney NSW 2001

20. Changes to this policy

We'll update this policy as our business changes and as Australian privacy law changes. The current version is always at playfolklore.com/privacy, with the effective date at the top. If we make a change that materially affects how we handle your information, we'll tell our mailing list and note it here.

21. Contact us

Privacy enquiries Lorekeeper Pty Ltd (ABN 36 700 584 701), trading as Folklore Murder Mystery Events Email: info@playfolklore.com Web: playfolklore.com