Privacy Policy

Home
Privacy Policy

1. About this policy

1.1. This Privacy Policy explains how the Museum of Play and Art (MoPA) collects, holds, uses, discloses and protects personal information. It is our policy under Australian Privacy Principle (APP) 1.

1.2. MoPA operates each of its venues through a separate company. Those companies are listed in Schedule 1. They are related bodies corporate. In this policy, “MoPA”, “we” and “us” mean the company that operates the venue you are dealing with, and where relevant the MoPA group as a whole.

1.3. We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

1.4. This policy is available free of charge on our website. We review it at least annually and update it whenever our handling of personal information changes.

1.5. This policy should be read together with our Terms and Conditions.

2. The short version

We collect the information we need to sell you a ticket, run your booking, operate your membership, cater your party, keep our venues safe, and tell you what’s on. We take a photograph of each member (for the avoidance of doubt, we take photographs of membership holders only, and we do not take a photographs of casual guests) so that our team can check that the person using a membership is the member it belongs to — a person does that check by eye; we do not use facial recognition or any kind of automation in the matching process. We record CCTV for safety and security. We never put cameras in toilet areas, change room areas or parent/privacy room areas. We don’t sell your information. You can ask us for a copy of what we hold, ask us to correct it, and ask us to stop marketing to you at any time.

This above summary is a guide only. The rest of this policy is what applies.

3. What personal information we collect

3.1. The kinds of personal information we collect and hold include:

(a) Contact and account information — name, email address, postal address, telephone number, and the password or login details for your MoPA account.

(b) Booking and transaction information — the sessions, parties, excursions, programs and products you book or buy, the venue and date, the number of people in your group, payment records and transaction history. We do not store full payment card numbers; card payments are processed by our payment provider.

(c) Membership information — your membership number and tier, the term of your membership, your visit history, and your membership identification photograph (see section 5).

(d) Party and group booking information — the name and age of the child the party is for, the number of guests, catering selections, and any dietary or allergy information you give us (see section 4).

(e) CCTV footage — images recorded by our security cameras (see section 7).

(f) Photographs and video — images captured by our team during your visit (see section 8).

(g) Incident and safety information — records of accidents, injuries, first aid given, incidents at our venues and any resulting correspondence.

(h) Correspondence — your enquiries, feedback, complaints, and our responses, including recorded details of telephone calls to our guest services team.

(i) Website and online information — see section 13.

(j) Employment and volunteer information — where you apply to work or volunteer with us. Note that the Privacy Act contains an employee records exemption which applies to some information about current and former employees.

3.2. We collect only what we reasonably need for our functions and activities. If you choose not to give us information we ask for, we may not be able to complete your booking, issue or verify your membership, cater your party safely, or respond to your enquiry.

4. Sensitive information

4.1. Some of the information we collect is sensitive information under the Privacy Act, which attracts higher protection. For MoPA this means principally health information — in particular:

allergy, intolerance and dietary information you give us for a party, group booking or café order;

information about a medical condition, injury, pregnancy or disability that you tell us about so we can keep you or a child in your care safe;
information recorded when first aid or emergency medical assistance is given at one of our venues.

4.2. We collect sensitive information only with your consent, and only where it is reasonably necessary for our activities. Where we ask for allergy or dietary information, we ask for it separately and you can choose not to provide it. Providing a privacy notice is not the same as obtaining consent, and we do not treat it as such.

4.3. If you do not give us allergy or dietary information, we may not be able to safely cater your party or advise you on our food and beverage products.

4.4. We use sensitive information only for the purpose you gave it to us for, and for purposes directly related to that purpose. We never use sensitive information for direct marketing.

4.5. In an emergency, we may collect, use or disclose health information without consent where it is unreasonable or impracticable to obtain consent and we reasonably believe it is necessary to lessen or prevent a serious threat to a person’s life, health or safety — for example, giving paramedics the information they need to treat an injured child.

4.6. We do not collect information about your racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union or professional membership, sexual orientation, or criminal record, except where you volunteer it to us (for example, a religious dietary requirement) or where it is required for employment screening.

5. Membership identification photographs

5.1. What we collect. We take and store a photograph of each MoPA Member. The photograph is taken at the venue on the member’s first visit, with member consent.

5.2. Why. Memberships must be linked to, and used by, individual members only. They are not transferable and cannot be shared. Verification at the point of entry is necessary to protect the integrity of the membership product and its value. Holding a photograph on the membership record is the least intrusive practical means available to us of verifying, at the point of entry, that the person presenting a membership is the member to whom it was issued. No alternative method offers equivalent assurance without collecting significantly more intrusive personal information.

5.3. How the photograph is used. A MoPA team member views the photograph on screen and compares it, by eye, with the person presenting the membership. The comparison is made by a person, not by a machine.

5.4. We do not use facial recognition. We do not use automated facial recognition, automated face-matching, or any other automated biometric verification or identification system. We do not create, hold or use biometric templates. We will not introduce any automated biometric matching without first conducting a privacy impact assessment, updating this policy, and obtaining fresh consent from affected members.

5.5. Consent. We will ask for your express consent to the photograph when you visit for the first time using your membership. That consent is sought separately from other consents and you can decline it. If you decline, we cannot continue the membership, because we cannot verify it at entry — but you remain free to purchase ordinary session tickets, for which no photograph is required.

5.6. We tell you at the time you purchase a membership that a photograph will be taken on your first visit, so that you know before you use that membership. If you decline consent on your first visit and the membership cannot be used, we will refund the membership fee, or credit it against casual session tickets, as you prefer.

5.7. Limits on use. The photograph is used solely for membership verification and fraud prevention. It is not used for marketing. It is not disclosed to any third party except where required by law.

5.8. Who can see it. The photograph is visible only to MoPA team members performing entry verification, and to authorised administrative staff managing membership records.

5.9. Retention. The photograph is retained for the term of the membership, and for thirty (30) days after the membership expires or is cancelled to allow for administrative processing. It is then deleted.

5.10. Children. Where the member is a child, we seek the consent of a parent or guardian in accordance with section 6.

5.11. Your rights. You may ask to see the photograph we hold, ask us to replace it with a more current one, or ask us to correct the record it is attached to, at any time. See section 18.

6. Children’s personal information

6.1. MoPA is a children’s museum. Most of the people who visit us are children, and we take particular care with their personal information.

6.2. What we collect about children — a child’s name, birth month if provided on purchase; the fact that they attended a session; membership details including the identification photograph where the child is a member; allergy or dietary information provided for a party or booking; CCTV footage; incident and first aid records; and photographs or video where section 8 applies.

6.3. Consent and capacity. The Privacy Act does not set an age at which a person can make their own privacy decisions. We assess capacity according to the individual’s understanding and maturity. Where that is not practicable, we apply the following:

A child under 15 is presumed not to have capacity to consent. We seek the consent of a parent or guardian.
A young person aged 15 or over is presumed to have capacity to consent for themselves, unless something indicates otherwise.

6.4. How we obtain parental consent. Where a parent or guardian consents on a child’s behalf — for example, to a membership photograph or to providing allergy information — we ask them to do so expressly, at the point of collection, and we tell them what the information will be used for and how long we will keep it. Where the child is old enough to understand, we also explain it to the child.

6.5. Access and correction on a child’s behalf. A parent or guardian may exercise a child’s access and correction rights where the child does not have capacity. Because these requests may involve a child’s photograph or visit history, we verify that the person making the request is entitled to make it before we release anything. The steps we take are proportionate to the sensitivity of the information. Where a young person aged 15 or over has capacity, we deal with them directly, and we will not release their record to a parent over their objection except where the law requires it.

6.6. Marketing. We do not send direct marketing to children. Marketing is directed to the adult account holder.

6.7. Minimisation. We collect only what we need about a child, and no more. Where a child’s information is no longer needed, we destroy or de-identify it in accordance with section 17.

6.8. Our website is for adults. The MoPA website is designed and intended for use by adults. Bookings, memberships and accounts must be made and managed by an adult. We do not direct our website at children, and we do not knowingly collect personal information directly from a child through our website. Information we hold about a child is given to us by a parent, guardian or other supervising adult, or by the school or organisation making a group booking.

7. CCTV

7.1. What we record. CCTV cameras operate in our venues and record continuously.

7.2. Images only. Our cameras record images only. They do not record sound.

7.3. Where we do not record. We do not install or operate cameras in toilets, change rooms, parents’ rooms or feeding rooms, or in the areas immediately adjacent to them. This applies without exception, and consent cannot be given to change it.

7.4. Why we record. For the safety and security of guests and team members, to prevent and investigate theft and damage, to investigate incidents and accidents, and to meet our duty of care.

7.5. Who can access footage. Footage is accessed only by authorised MoPA personnel for security, safety and incident-investigation purposes.

7.6. Disclosure. Footage is otherwise disclosed only where required or authorised by law — for example, to police, or in response to a court order or subpoena — or where necessary to lessen or prevent a serious threat to a person’s life, health or safety. We are also subject to legal restrictions on communicating or publishing surveillance footage, and we do not publish it.

7.7. Retention. See section 17.

8. Photography and filming for marketing

8.1. By other guests. MoPA is a shared space. Guests may photograph and film their own family and the children in their care, and may incidentally capture other guests in the background. Guests may publish those images, including on social media. We do not control and are not responsible for images captured or published by other guests, as is the case in any public space.

8.2. By MoPA. Where a MoPA team member captures a photograph, film or recording during your visit, we will seek your permission before using it for marketing purposes, and we will not use it for marketing without that permission.

8.3. Children. Where the image is of a child, we seek the permission of a parent or guardian. Where the child is old enough to understand, we also ask the child.

8.4. Opting out. If you do not wish to be photographed or filmed, or do not wish images of a child in your care to be used, tell a MoPA team member at the venue or contact us using the details in section 22. We will take all reasonable steps to honour that request in relation to content captured by MoPA. That request cannot extend to content captured by other guests.

8.5. Withdrawing permission. If you have previously given permission and change your mind, contact us. We will stop using the image in any new material and will remove it from material we control, including our own social media accounts, where it is reasonably practicable to do so.

9. How we collect personal information

9.1. We collect personal information:

directly from you — in person at our venues, through our website, by telephone on 1800 00 MoPA (1800 00 66 72), by email, and through our booking system;
from a parent, guardian or supervising adult, where the information is about a child in their care;
from the person making a group, school or party booking, about the people attending it;
automatically, through CCTV and through our website (see section 13).

9.2. We collect personal information only by lawful and fair means. We do not collect information covertly.

9.3. Wherever it is reasonable and practicable, we collect personal information directly from the individual concerned. Where that is not practicable — for example, where a school books an excursion for a class, or a parent books a party for a group of children — we collect it from the person making the booking.

9.4. You can deal with us anonymously or under a pseudonym for general enquiries. We cannot process a booking, membership or party under a pseudonym, because we need to be able to identify the booking-holder at entry.

10. Why we collect it, and how we use it

10.1. We collect, hold and use personal information for the following purposes:

to process and manage your bookings, tickets, parties, excursions and purchases;
to issue, verify, administer and renew memberships;
to verify at entry that a membership is being used by the member it belongs to;
to cater safely for allergies and dietary requirements;
to operate our cafés and retail;
to keep our venues, guests and team safe, and to prevent and investigate theft, damage and misconduct;
to respond to incidents and accidents and to arrange emergency assistance;
to communicate with you about your booking or membership;
to send you marketing communications where you have not opted out (see section 14);
to respond to your enquiries, feedback and complaints;
to improve our venues, programs and services, including through aggregated and de-identified analysis;
to meet our legal, tax, insurance and regulatory obligations.

10.2. We use personal information for the purpose we collected it for. We use it for another purpose only where you have consented, where you would reasonably expect us to and the second purpose is related to the first (or, for sensitive information, directly related to the first), or where the law requires or authorises it.

11. Who we share personal information with

11.1. Within the MoPA group. MoPA operates as a group of related companies, listed in Schedule 1. They include the companies that operate each venue, the group’s holding company, and the company that provides shared management, administrative, marketing, finance and IT services to the group.

11.2. Memberships, gift cards and credits work across all MoPA venues, and the group’s systems — bookings, memberships, payments, marketing and support — are operated centrally. We share personal information across the MoPA group for all of the purposes set out in section 10, including operating your booking or membership at any venue, group administration, finance, marketing, customer support, safety and security, and reporting.

11.3. Two limits apply, and we apply them:

(a) Sensitive information. We do not share sensitive information — including allergy, dietary and other health information — across the group except where you have consented, or where the law permits it without consent (for example, in an emergency, under section 4.5).

(b) Purpose. Where another company in the group receives your personal information, it may use it only for the purpose for which it was originally collected, or a purpose you would reasonably expect and which is related to it.

11.4. Service providers. We disclose personal information to organisations that provide services to us, and only so they can provide those services to us. They include:

our booking, ticketing and membership platform;
our payment processor;
our email and SMS marketing provider;
our website host;
our website analytics and advertising measurement providers;
our CCTV recording and backup provider;
our professional advisers — auditors, lawyers and insurers.

These providers are named in Schedule 2.

11.5. Others. We may also disclose personal information:

to emergency services and medical personnel, where necessary to respond to an injury or a serious threat to life, health or safety;
to police or another enforcement body, where required or authorised by law;
to a court or tribunal, in response to a subpoena, court order or legal process;
to a purchaser or prospective purchaser, in connection with a sale or restructure of our business, subject to confidentiality;
where you have consented.

11.6. We do not sell personal information, and we do not disclose it to third parties for their own marketing purposes.

12. Overseas disclosure

12.1. We use Australian-based infrastructure wherever our providers offer it. However, some of the service providers listed in section 11.4 store, back up, process or provide support for personal information outside Australia. That is a feature of the software we use, not a decision to send your information offshore.

12.2. The services we use, and the countries in which personal information may be stored, processed or accessed, are set out in Schedule 2.

12.3. Our booking, ticketing and membership platform. MoPA licenses its booking, ticketing and membership platform from ROLLER, and personal information you give us when you book or join is held in that platform. ROLLER hosts on Amazon Web Services and states that it holds SOC 2 certification and is compliant with PCI DSS. ROLLER is a global business with operations in Australia, North America, Europe and Costa Rica, and its support and engineering teams in those locations may access information in order to provide the service. ROLLER publishes its own data processing terms and its current list of sub-processors at roller.software.

12.4. Before disclosing personal information to an overseas recipient, we take steps that are reasonable in the circumstances to ensure the recipient does not breach the Australian Privacy Principles in relation to that information. Those steps include entering into contractual arrangements requiring the recipient to handle personal information consistently with the Australian Privacy Principles, to restrict its handling to the purposes we specify, and to impose equivalent obligations on any subcontractor.

12.5. Where we use an overseas cloud provider only to store information on our behalf, under a binding contract that limits its handling to storage and leaves us in effective control of the information, we treat that as a use of the information rather than a disclosure.

12.6. If we ask you to consent to an overseas disclosure without taking the steps in 12.4, we will tell you clearly, before you consent, that doing so means those protections will not apply.

13. Cookies, analytics and our website

13.1. Our website uses cookies and similar technologies to make the site work, remember your preferences and basket, keep your session secure, and understand how the site is used.

13.2. We collect information about your use of our website, including your IP address, device and browser type, the pages you visit, the time and duration of your visit, and the site you came from.

13.3. We use Google Analytics and the Meta Pixel. These providers set their own cookies, process information about your visit outside Australia, and may combine it with information they already hold about you. See Schedule 2.

13.4. You can set your browser to refuse cookies or to alert you when cookies are being sent. Some parts of our website, including booking, may not work properly if you do.

13.5. Our website may contain links to other sites, and may embed content hosted elsewhere. We are not responsible for the privacy practices of those sites.

14. Direct marketing

14.1. We may use your personal information to send you marketing about MoPA — what’s on, new exhibits, membership offers, school holiday programs and events — by email, SMS, post or through our website and social media.

14.2. We do not use sensitive information for direct marketing, and we do not send direct marketing to children.

14.3. Opting out. You can opt out at any time, and it is free. You can:

click the unsubscribe link in any marketing email;
reply STOP to any marketing SMS;
contact us using the details in section 22 and ask us to stop.

Every marketing communication we send includes a clear statement that you may opt out and how to do it. We will action your request within a reasonable period, and in any event within 30 days.

14.4. Where we got your details. If you ask us to tell you the source of the personal information we used to market to you, we will tell you within a reasonable period, unless it is impracticable or unreasonable to do so.

14.5. Opting out of marketing does not stop us sending you communications about a booking or membership you hold — booking confirmations, session reminders, changes to your booking, membership renewal notices and safety notices.

15. Automated decision-making

15.1. We use computer systems in our booking, membership and payment processes.

15.2. Where a partial payment has been made against a booking, our booking system may automatically attempt to debit the outstanding balance using the same payment method, in accordance with our Terms and Conditions. The personal information used is your booking record and the stored payment method. This is the automatic execution of a payment arrangement you have agreed to, and a person can review it at your request.

15.3. We do not use automated systems to decide whether to grant or refuse a membership, to set individual prices, to refuse entry, or to ban a person from our venues. Those decisions are made by people.

15.4. We do not use facial recognition or any other automated biometric system. See section 5.4.

15.5. We keep this section under review, and will update it before 10 December 2026 to meet the automated decision-making transparency requirements commencing on that date.

16. How we protect personal information

16.1. We take steps that are reasonable in the circumstances to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Those steps include both technical and organisational measures.

16.2. Technical measures include access controls and role-based permissions so that team members can see only what their role requires; encryption of data in transit and at rest where appropriate; secured networks and devices; secure disposal of hardware; and physical security at our venues and offices.

16.3. Organisational measures include privacy and data-handling training for our team, confidentiality obligations in employment and contractor agreements, contractual privacy and security obligations on our service providers, restricted access to CCTV footage and membership photographs, and internal review of our practices.

16.4. No system is completely secure. If you believe your MoPA account has been compromised, contact us immediately.

17. How long we keep personal information

17.1. We keep personal information only for as long as we need it for a purpose for which it may be used or disclosed under the Privacy Act, unless we are required by law to keep it longer. When we no longer need it, we take reasonable steps to destroy it or to de-identify it.

17.2. Our retention periods are:

Membership identification photograph — The term of the membership, plus 30 days

Membership record (number, tier, term, visit history) — The term of the membership, plus 2 years

Booking and ticketing records — 2 years from the date of the booking

Financial and transaction records — 7 years, as required by taxation and corporations legislation

Allergy, dietary and other health information given for a booking — Until the booking is complete, plus 30 days

CCTV footage — 30 days, unless retained for an incident investigation, insurance claim or legal proceeding

Incident, accident and first aid records — As required by our insurance and legal obligations, and where the person involved is a child, until they turn 25

Marketing list details — Until you opt out, plus the period needed to keep you suppressed from future mailings

Enquiries, feedback and complaints — 2 years from resolution

Photographs and video used for marketing — For as long as the material is in use, unless permission is withdrawn

17.3. Where information is held in a backup and cannot immediately be destroyed, we put it beyond use — we restrict access to it and destroy it when the backup cycles.

18. Accessing and correcting your personal information

18.1. Access. You can ask us for a copy of the personal information we hold about you. Contact us using the details in section 22. We will need to verify your identity first.

18.2. We will respond within a reasonable period, and in any event within 30 days of your request.

18.3. We give access in the form you ask for where it is reasonable and practicable to do so. We may charge a reasonable amount for giving access, covering our actual costs. We will tell you the charge before we incur it. There is no charge for making a request.

18.4. We may refuse access in limited circumstances set out in the Privacy Act — for example, where giving access would pose a serious threat to a person’s life, health or safety, would unreasonably affect another person’s privacy, or where the request is frivolous or vexatious. If we refuse, we will tell you in writing, give our reasons where practicable, and tell you how to complain.

18.5. Correction. If the information we hold is inaccurate, out of date, incomplete, irrelevant or misleading, ask us and we will correct it. We will respond within a reasonable period, and in any event within 30 days. We never charge for correction.

18.6. If we have disclosed the information to someone else and you ask us to, we will take reasonable steps to tell them about the correction, unless it is impracticable or unlawful to do so.

18.7. If we refuse to correct information, we will tell you why in writing and tell you how to complain. You can also ask us to attach a statement to the record saying that you believe the information is inaccurate, out of date, incomplete, irrelevant or misleading, and we will take reasonable steps to make that statement apparent to anyone who uses the information.

19. Complaints

19.1. If you think we have breached the Australian Privacy Principles, or you are unhappy with how we have handled your personal information, please tell us. Contact us using the details in section 22, marking your message for the attention of the Privacy Officer.

19.2. We will acknowledge your complaint promptly, investigate it, and respond to you in writing, normally within 30 days. If we need longer, we will tell you why and how long we expect to take.

19.3. If you are not satisfied with our response, or we have not responded within 30 days, you can complain to the Office of the Australian Information Commissioner:

Online: oaic.gov.au
Phone: 1300 363 992
Post: GPO Box 5218, Sydney NSW 2001

20. Data breaches

20.1. We maintain a data breach response plan.

20.2. If we suspect a data breach has occurred, we assess it expeditiously and take all reasonable steps to complete our assessment within 30 days.

20.3. If we form the view that a breach is likely to result in serious harm, we will notify the Office of the Australian Information Commissioner and the individuals affected, in accordance with the Notifiable Data Breaches scheme.

21. Changes to this policy

21.1. We may update this policy from time to time. The current version is always available on our website.

21.2. We review this policy at least annually.

22. Contact us

Privacy Officer, Museum of Play and Art

Email: bookings@museumofplayandart.com.au — please mark your message for the attention of the Privacy Officer
Phone: 1800 00 MoPA (1800 00 66 72)
Post: Privacy Officer, Museum of Play and Art, 353 Clarendon Street, South Melbourne VIC 3205

The Privacy Officer role is held by a Company Director of the MoPA group.

SCHEDULE 1 — THE MoPA GROUP

The companies below are related bodies corporate and together form the MoPA group.

Group companies

Art Play Productions Pty Ltd, ABN 55 650 478 256 — holding company

MoPA HQ Pty Ltd, ABN 85 677 677 851 — management, administrative and shared services

Venue operating companies

Each of the companies below trades as “Museum of Play and Art”.

MoPA Geelong — Production Ventures Pty Ltd, ABN 89 633 353 367. 51 McKillop Street, Geelong VIC 3220

MoPA Sandringham — Museum of Play and Art Melbourne Pty Ltd, ABN 29 650 800 892. 247 Bay Road, Sandringham VIC 3191

MoPA Thomastown — MoPA Melbourne Pty Ltd, ABN 29 665 871 849. 11/391 Settlement Road, Thomastown VIC 3074

MoPA Nunawading — MoPA East Melbourne Pty Ltd, ABN 80 676 144 844. 372 Whitehorse Road, Nunawading VIC 3131

MoPA Adelaide — MoPA SA Pty Ltd, ABN 84 676 144 862. Butler Boulevard, Adelaide Airport SA 5950

Correspondence for the group, including privacy enquiries, access and correction requests and complaints: 353 Clarendon Street, South Melbourne VIC 3205.

SCHEDULE 2 — SERVICE PROVIDERS AND DATA LOCATIONS

Bookings, ticketing and memberships — ROLLER

Australia, the United States, or other countries in which ROLLER or its sub-processors maintain facilities. ROLLER’s support and engineering teams in Australia, North America, Europe and Costa Rica may access information to provide the service. See clause 12.3.

Payment processing — Adyen, through ROLLER Payments

European Union (Netherlands)

Email and SMS marketing — Campaign Monitor (Marigold)

United States, and other countries in which Marigold operates

Website hosting — WP Engine

United States, including backups. WP Engine’s support teams in the United States and Ireland may access website data.

Website analytics — Google Analytics

United States, and other countries in which Google operates

Advertising measurement — Meta Pixel

United States, Ireland, Denmark, Sweden and Singapore

Email, documents and correspondence — Google Workspace

United States or European Union

CCTV recording and backup — Guardian Vision

Australia. Footage is recorded to an on-site hard drive at each venue and backed up to the cloud.

We keep this Schedule under review and update it when our providers or their arrangements change.

Privacy Policy

SCHEDULE 1 — THE MoPA GROUP

SCHEDULE 2 — SERVICE PROVIDERS AND DATA LOCATIONS

GET OUR NEWSLETTER

Socials