1. Who we are

MOI Sydney Pty Ltd (ACN 684 349 200, ABN 62 684 349 200), trading as Museum of Illusions Sydney (“MOI Sydney”, “we”, “us” or “our”), operates the Museum at Shop 6, 413-421 George Street, Sydney NSW 2000, Australia. Our registered office is C/- Key Solutions Group, Level 8, 15 Help Street, Chatswood NSW 2067, Australia.

This Privacy Policy explains how we collect, hold, use and disclose personal information in connection with the Sydney Museum, our website, ticketing, customer service, events, marketing, photography services, CCTV, recruitment and employment-related activities. We operate this framework in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), together with other applicable Australian and New South Wales laws.

Privacy contact: [email protected]. Our Group Privacy Officer coordinates privacy requests and complaints for MOI Sydney.

2. Personal information we collect and hold

• Identity and contact information: name, email address, telephone number, address or postcode where needed.
• Booking and transaction information: Museum visit date/time, ticket type and quantity, booking/order reference, discounts, refunds, complaints and purchase history.
• Payment information: payment status, amount, method, reference and limited card information made available by our payment provider. We do not receive or store full payment-card details.
• Customer service, group and event information: enquiries, correspondence, school/company details, event contacts and operational notes.
• Marketing and preference information: channel consent, consent source/date, unsubscribe status, campaign engagement, preferences and audience segments.
• Website, device and analytics information: IP address, browser/device information, pages and events, cookie identifiers and advertising/analytics data according to your choices.
• Photographs and video: images provided by you, generated through an optional photo service such as Sharingbox, or captured under a separate photography/filming authorisation.
• CCTV and security information: video footage and incident information used for safety, security and incident management.
• Accessibility and health information: only where you choose to provide information reasonably necessary to support access needs or respond to an emergency.
• Recruitment and workforce information: application, qualification, employment, payroll, access/security and workplace information, subject to the employee-records rules explained in our workforce notices.

3. How we collect personal information

We collect personal information directly from you when you book or buy tickets, visit the Museum, contact us, complete a form, subscribe to marketing, use an optional photo service, apply for a role, attend an event or otherwise interact with us. We may also receive information from ticketing/payment providers, corporate or school organisers, group companies, recruitment providers, marketing/analytics providers and other service providers where permitted by law.

Where practicable, you may deal with us anonymously or using a pseudonym for general enquiries. Identification is usually required where it is necessary to make or manage a booking, process a payment/refund, verify a privacy request, handle a safety incident, employ a person or comply with law.

4. Why we collect, hold, use and disclose information

Purpose	What this means
Tickets and visits	Process bookings and payments, issue tickets, manage admission, refunds and customer service.
Museum operations and safety	Operate the Museum, manage events, investigate incidents, protect visitors, staff, exhibits and property.
Marketing	Send email, SMS or telephone marketing where we have the consent or other authority required by Australian law; manage preferences and measure campaign performance.
Analytics and improvement	Understand attendance, website use, demand, offers and customer experience; produce aggregated or de-identified reporting where practicable.
Photography	Deliver guest-requested photos through optional services and, only where separately authorised, use identifiable images for MOI marketing.
Recruitment and employment	Assess candidates and administer employment, workplace access, payroll, safety and legal obligations.
Legal/compliance	Keep records, respond to complaints and privacy requests, defend claims, prevent fraud and comply with regulatory or court requirements.

5. Sensitive information

Health information and other sensitive information are collected only where reasonably necessary for our functions and where the consent or other legal authority required by the Privacy Act applies. Please do not provide diagnoses, medical documents or other sensitive information unless it is genuinely needed. For accessibility requests, we generally need only the minimum information necessary to make reasonable arrangements.

6. Direct marketing

MOI Sydney uses an express opt-in approach for promotional email, SMS and telephone marketing. Marketing choices are separate from ticket purchase. We do not treat an email address or mobile number provided solely to receive a ticket, receipt, service message or Sharingbox photograph as marketing consent.

Commercial emails and SMS messages identify the sender and include a functional unsubscribe method. We aim to action opt-outs immediately and, in any event, within the timeframe required by the Spam Act. Telemarketing is conducted in accordance with the Do Not Call Register requirements and applicable calling standards. You can withdraw marketing consent at any time.

7. Cookies, analytics and advertising

Our website uses strictly necessary technologies for security and site operation and may use analytics and advertising technologies such as Google Analytics, Google Ads and Meta technologies. Under the MOI Group privacy standard, non-essential analytics, personalisation and advertising technologies are activated only after the relevant choice is made through our cookie/privacy settings. See our Cookie & Tracking Notice for details and settings.

8. Children and school groups

The Museum is for families and visitors of all ages, but our general website and ticketing services are not directed specifically to children. We minimise information about children. A child’s name may be provided for a birthday or group activity, and school/group organisers may provide operational information needed for the visit. We do not knowingly include children in behavioural advertising audiences. Separate parent/guardian permission is required where we seek to use a child’s identifiable image for MOI marketing.

9. CCTV

Visible CCTV may operate at the Sydney Museum for safety, security, incident investigation and protection of people and property. CCTV is not permitted in toilets, change rooms, showers or other bathing facilities. Footage is normally retained for up to 30 days and may be retained longer where it is required for an incident, investigation, legal claim or other lawful purpose. Further information is provided in our CCTV Notice and on signs at the Museum.

10. Sharing and service providers

We may disclose personal information to service providers and professional advisers who help us operate the Museum and our systems, including ticketing (such as ROLLER), payment providers (such as Adyen), optional photography providers (such as Sharingbox), CRM/marketing providers, analytics/data-warehouse providers, Microsoft/cloud/IT providers, security providers, professional advisers, insurers and authorities where required or permitted by law.

We may also disclose information to related Museum of Illusions group companies where needed for central IT, data/analytics, marketing, operational support, governance and reporting. Access is limited to authorised personnel and business purposes.

11. Overseas disclosures

Personal information may be disclosed to overseas recipients, including related Museum of Illusions entities and service providers. Countries in which recipients are likely to be located include the United States, Croatia, the United Kingdom and countries in the European Economic Area. Vendor and subprocessor locations may change over time.

Before an overseas disclosure to which APP 8 applies, MOI Sydney takes reasonable steps in the circumstances to require appropriate privacy and security handling. Under the Privacy Act, MOI Sydney may remain accountable for certain acts or practices of an overseas recipient.

12. Security and retention

We take reasonable technical and organisational measures to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. Measures include access controls, role-based permissions, multi-factor authentication, device/security controls, vendor safeguards, staff procedures and incident response.

We keep personal information only for as long as reasonably required for the relevant purpose or by law. As operational defaults: customer profile information is reviewed for deletion or de-identification after three years without relevant interaction; financial and company records are generally retained for at least seven years where required; CCTV is normally retained for up to 30 days; and marketing suppression information is retained in minimal form for as long as needed to honour an opt-out. Legal holds, disputes and other statutory requirements may extend these periods.

13. Access, correction and deletion/de-identification requests

You may request access to personal information we hold about you or ask us to correct information that is inaccurate, out-of-date, incomplete, irrelevant or misleading. Please contact [email protected]. We will verify identity proportionately and aim to respond within 30 calendar days.

You may also ask us to delete or de-identify information. Australian privacy law does not currently provide a general right to erasure equivalent to the EU GDPR, but APP 11 requires destruction or de-identification when personal information is no longer needed and no retention exception applies. We will assess deletion requests against that requirement and our legal/record-keeping obligations.

14. Privacy complaints

If you believe we have mishandled your personal information, contact [email protected] with enough detail for us to investigate. We aim to acknowledge complaints promptly and provide a substantive response within 30 days where practicable. If you are not satisfied after giving us a reasonable opportunity to respond, you may complain to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au.

15. Automated decision-making

MOI Sydney does not currently use personal information in solely automated decision-making that we expect to significantly affect an individual’s rights or interests. Australian privacy-policy transparency requirements for certain automated decision-making commence on 10 December 2026. We will update this Policy before using any in-scope automated decision-making.

16. Changes

We may update this Policy when our practices, systems or legal obligations change. The current version will be published on our website.