Mobilise Travel – Privacy Policy
Version: 1.0 · Effective date: 30.09.2026 · Entity: Energy Logistics & Travel Pty Ltd (ACN 650 903 585) trading as "Mobilise Travel" (ABN 75 650 903 585)
1. About this Policy
Mobilise Travel ("Mobilise," "we," "us" or "our") is an Australian travel and personnel logistics provider servicing the energy, marine, resources, renewables and construction sectors, as well as corporate, leisure and cruise travellers. Moving people safely means we handle a significant amount of personal information, some of it sensitive, and we take that responsibility seriously.
This Privacy Policy explains how we collect, hold, use and disclose personal information, and how you can access or correct your information or make a complaint. We are bound by the Privacy Act 1988 (Cth) ("Privacy Act") and the Australian Privacy Principles ("APPs"). This Policy forms part of the Mobilise Travel Booking Terms & Conditions ("Terms"), and terms defined in the Terms (such as Client, Traveller, Guest, Principal Supplier, Personnel Data and Corporate Booking) have the same meaning here.
This Policy applies to the personal information of:
• Travellers whose travel or movement we arrange on behalf of an employer or other Client, including employees, contractors and crew;
• Guests travelling on Leisure or Cruise Bookings, and their travelling companions;
• Client contacts, including travel bookers, arrangers, approvers and account managers;
• Emergency contacts and next of kin nominated by Travellers or Guests;
• Supplier and business contacts;
• Website visitors and anyone who contacts us; and
• Job applicants.
The handling of employee records of our own current and former staff is generally exempt from the Privacy Act and is not covered by this Policy.
2. The personal information we collect
The information we collect depends on the services we provide to you or your organisation. It may include:
• Identity and contact details – full name as it appears on your passport or travel document, date of birth, gender as recorded on your travel documents, nationality, address, phone numbers, email addresses, employer, job title and employee or contractor identifiers.
• Travel documents – passport details, visas, electronic travel authorities (such as ESTA or eTA), Resident Return Visa details, and trusted or known traveller numbers.
• Booking and travel information – itineraries, travel history, seat, meal, accommodation and car hire preferences, loyalty and frequent flyer program numbers, and travel spend.
• Workforce and logistics information – rosters and rotation schedules, site, vessel, rig or platform allocations, project and cost codes, and mobilisation and demobilisation records.
• Certification and compliance information – safety and survival training tickets (for example BOSIET, HUET or TBOSIET), competency and trade certifications, seafarer documentation, and their expiry dates.
• Emergency contact and next-of-kin details.
• Payment information – card details (handled in accordance with PCI DSS), billing details and account information.
• Location and movement information – travel status, check-in and arrival confirmations, and movement tracking used for duty of care and emergency response.
• Communications – emails, messages and records of calls with our team. Calls to our office and 24/7 lines may be recorded for quality, training and incident review purposes.
• Website and technical information – IP address, browser and device information, and how you use our website (see section 10).
• Recruitment information – CVs, cover letters, references and interview notes, if you apply to work with us.
3. Sensitive information
Some information we handle is "sensitive information" under the Privacy Act, which receives a higher level of protection. We only collect sensitive information where it is reasonably necessary for our services and you have consented (or your consent has been obtained on your behalf), or where the law otherwise permits. This may include:
• Health information – medical fitness status (for example offshore or pre-employment medical expiry, or fitness to fly or sail), medical conditions, mobility or accessibility needs, pregnancy (where required by a Cruise Line or operator), vaccination status, and medication or medical equipment that affects your travel;
• Dietary requirements, which may indicate health information or religious beliefs; and
• Information required by government authorities for visa or entry applications that we assist with, which may include criminal record declarations.
We keep this to a minimum. Wherever possible we record a status and expiry date (for example "offshore medical valid to 30 June") rather than the underlying medical record, and we ask Clients not to send us more health information than we need to deliver the service.
4. How we collect personal information
We collect personal information:
• Directly from you – when you make or change a Booking, complete a traveller profile or form, call or email us, or use our website or booking platforms;
• From your employer or our Client – including through their HR, rostering and workforce management systems that integrate with ours, traveller profile tools and online booking tools;
• From people booking on your behalf – such as a travel arranger, colleague, family member or travelling companion;
• From Principal Suppliers and travel systems – such as airlines, operators, Cruise Lines and global distribution systems (GDS), for example schedule changes, check-in status and ticketing records; and
• Automatically – through cookies and similar technologies on our website.
Where we collect your information from someone else (such as your employer or a travelling companion), we rely on that person or organisation to have told you about the disclosure and to have obtained any consent required. If you give us personal information about another person, you must have their authority to do so and should let them know about this Policy.
5. Why we collect, use and disclose personal information
We collect, use and disclose personal information to:
• arrange, confirm, change and manage Bookings, Mobilisations and Demobilisations;
• coordinate personnel logistics, including rostering support, movement coordination and certification and compliance tracking;
• meet carrier, aviation security, maritime, immigration and border requirements, including advance passenger information;
• support duty of care, including traveller tracking, disruption management, emergency response, cyclone evacuation and contacting your emergency contacts;
• invoice, reconcile and report to our Clients, including spend, compliance, SLA/KPI and emissions (ESG) reporting;
• provide customer service and handle enquiries, complaints and disputes;
• manage supplier programs and loyalty memberships;
• maintain, test and improve our services, systems, training and quality assurance;
• detect and prevent fraud and misuse;
• meet our legal, regulatory, tax, audit and accreditation obligations;
• send marketing communications where permitted (see section 9); and
• assess job applications.
We only use or disclose personal information for another purpose where it is related to the purpose of collection and you would reasonably expect it (or, for sensitive information, directly related), where you have consented, or where the law permits or requires it – for example, to lessen or prevent a serious threat to a person's life, health or safety.
Reporting to your employer. For Corporate Bookings, the Client is our customer. Your travel details, spend, compliance status and movement information may be reported to the Client. This includes leisure elements attached to a business trip where they are booked or paid for through the Client's account.
6. Technology, automation and AI
We use a range of technology to deliver our services, including GDS, back-office, online booking, profile management, email, CRM and project management platforms. We may, at times, also use automated and AI-assisted tools to help process bookings, draft communications, analyse data and improve efficiency. When we do:
• we use personal information only for the purposes described in this Policy;
• we assess technology providers for security and privacy before engaging them and, where the option is available, configure our tools so that personal information we provide is not used to train the provider's own models; and
• our people remain responsible for the service we provide to you.
Our booking tools may automatically check bookings against your employer's travel policy and flag or route bookings for approval. These checks apply the rules set by the Client, and approvals and decisions are made by people – the Client's approvers or our team. We do not make decisions that significantly affect your rights or interests solely by automated means. If that changes, we will update this Policy to describe the kinds of personal information used and the kinds of decisions made.
7. Who we disclose personal information to
We disclose personal information only as needed for the purposes in section 5. Recipients may include:
• Principal Suppliers – airlines, charter, helicopter and marine operators, Cruise Lines, accommodation providers, tour and excursion operators, and ground transport and car rental companies;
• Travel technology providers – GDS providers, online booking tools, back-office and profile management systems;
• Our Clients – your employer or the organisation that arranged your travel;
• Service providers – IT, cloud hosting, communications, email, CRM and project management providers, payment processors, insurers, and professional advisers such as lawyers, accountants and auditors;
• Travel industry partners – consolidators and industry groups we work with, to the extent needed to fulfil a Booking or access a supplier program;
• Government and regulatory bodies – border, immigration, customs, aviation and maritime security agencies, and law enforcement where required or authorised by law;
• Emergency parties – emergency services, medical and evacuation providers, and your nominated emergency contacts, where necessary to protect your health or safety;
• Complaint and accreditation bodies – such as the Australian Travel Industry Association (ATIA) and the Office of the Australian Information Commissioner (OAIC), when handling a complaint; and
• A purchaser or successor of all or part of our business, subject to confidentiality obligations.
We do not sell personal information.
8. Overseas disclosure
Travel is international by nature, and many of our services cannot be delivered without disclosing personal information outside Australia. Overseas recipients are likely to be located in:
• the destination and transit countries on your itinerary;
• the countries where Principal Suppliers, or the systems they use, are based; and
• the countries where our technology providers host or process data, which may include the United States, New Zealand, the United Kingdom, and member states of the European Union
Our service providers. Before we disclose personal information to an overseas technology or service provider acting on our behalf, we take reasonable steps (including due diligence and contractual protections) to ensure they handle it consistently with the APPs.
Travel suppliers and foreign authorities. When we pass your information to an overseas airline, operator, Cruise Line, accommodation provider or government authority to deliver your travel, those recipients handle it under their own laws and policies, and we cannot control how they do so. By making or authorising a Booking, you consent to these disclosures on the understanding that, for these recipients, we will not be taking steps to ensure they comply with the APPs, and that you may not be able to seek redress under the Privacy Act for their handling of your information.
9. Direct marketing
We may send marketing communications (such as news, offers and event invitations) to Client contacts and to Guests where you have agreed or would reasonably expect them. Every marketing message includes a simple way to opt out, or you can contact us to unsubscribe at any time.
Personnel Data supplied by a Client for Corporate Bookings is not used to market to individual Travellers unless the Traveller has separately consented.
10. Cookies and our website
Our website uses cookies and similar technologies to operate the site, remember your preferences and understand how it is used (for example through analytics tools). You can disable cookies in your browser settings, although some parts of the site may not work as intended. Our website may link to third-party websites, which have their own privacy practices.
11. Storage and security
We hold personal information electronically in secure systems, including cloud-hosted platforms, and in limited paper records. We take reasonable steps to protect it from misuse, interference, loss, and unauthorised access, modification or disclosure, including:
• role-based access controls and multi-factor authentication;
• encryption of data in transit, and at rest where supported;
• PCI DSS-aligned handling of payment card data, including not storing full card details beyond what is necessary;
• confidentiality obligations and privacy and security training for our team;
• security and privacy assessment of our technology providers; and
• monitoring and review of our systems and practices.
No system is completely secure, but we work continually to keep your information safe.
12. Retention
We keep personal information only for as long as we need it for the purposes in this Policy or to meet legal obligations. For example, financial and transaction records are generally kept for at least seven years to meet tax and corporations law requirements.
When a Client tells us a Traveller has left their organisation, or when our engagement with a Client ends, we deactivate the relevant profiles and destroy or de-identify Personnel Data within 1 month, unless we are required by law or our agreement with the Client to keep it longer. When information is no longer needed, we take reasonable steps to destroy or de-identify it.
13. Data breaches
We comply with the Notifiable Data Breaches scheme under the Privacy Act. If we suspect a data breach, we act quickly to contain it and assess whether it is likely to result in serious harm. Where it is an eligible data breach, we will notify affected individuals and the OAIC as required. Where a breach involves Personnel Data supplied by a Client, we will also notify that Client promptly.
14. Accessing and correcting your information
You can ask to access the personal information we hold about you, or ask us to correct it, by contacting our Privacy Officer (see section 19). We will verify your identity before acting on a request and respond within 30 days. There is no fee to make a request, although we may charge a reasonable fee for the cost of providing access to a large volume of information, and will tell you before doing so.
If we refuse access or correction, we will explain why in writing and tell you how to complain. Where Personnel Data comes from a Client's system, we may also refer you to the Client to update the source record, because our systems may otherwise be overwritten by the Client's data feed.
Many travellers can view and update their own traveller profile directly. Keeping your profile current – especially your passport details, contact details and emergency contact – helps us look after you.
15. Anonymity and pseudonyms
You can make a general enquiry without identifying yourself. However, it is generally not practicable for us to make Bookings or arrange travel without your real identity, because airlines, operators and border authorities require it.
16. Unsolicited information
If we receive personal information we did not ask for and could not have collected under the APPs, we will destroy or de-identify it where lawful and reasonable to do so.
17. Children
We collect personal information about children only where needed for a Booking, and generally from their parent or guardian. A parent or guardian may exercise the rights in this Policy on a child's behalf.
18. Individuals in the European Union and United Kingdom
Where the EU General Data Protection Regulation (GDPR) or UK GDPR applies to our handling of your personal data, we process it on the basis that it is necessary to perform a contract with you or for your benefit, to comply with legal obligations, for our legitimate interests in providing and improving our services, or with your consent. You may have additional rights, including to request erasure, restrict or object to processing, and receive your data in a portable format. To exercise these rights, contact our Privacy Officer.
19. Complaints and contact
If you have a question or complaint about how we have handled your personal information, please contact our Privacy Officer in writing with details of your concern. We will acknowledge your complaint within five business days and aim to resolve it within 30 days, keeping you informed along the way.
If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner at www.oaic.gov.au or on 1300 363 992.
Privacy Officer
Mobilise Travel
PO Box 415, Fremantle, WA 6463
Phone: +61 8 6555 1800
Email: hello@mobilise.travel
20. Changes to this Policy
We may update this Policy from time to time to reflect changes in the law, our services or our practices. The current version will always be available on our website, and the effective date at the top of this Policy shows when it was last updated.