Privacy Policy

Policy version: 18 October 2026
Effective from: publication on puppyflow.com.au

1 Who we are

Puppy Flow is operated by SERAFIMA TOMASHEVSKAIA, ABN 84 622 609 915, trading as Puppy Flow. Our website is https://www.puppyflow.com.au. For privacy enquiries, contact team@puppyflow.com.au, addressed to the Puppy Flow Privacy Contact. Other enquiries can be sent through our Contact page.

This policy explains how we collect, hold, use and disclose personal information when you contact us, book or attend a puppy yoga session or private event, complete a waiver or interact with our website. Personal information is information about an identified or reasonably identifiable person, including identifiable photographs and videos.

We handle personal information in accordance with applicable Australian privacy law. This policy provides information about our practices; it does not itself give consent to optional photography, third-party publication or marketing.

2 Information we collect

The information collected depends on how you interact with us.

Contact enquiries. Our Contact form collects your name, email address, enquiry type and message, and your telephone number if you choose to provide it. We also receive information you choose to provide during follow-up conversations or other communications.

Bookings. If you book a session through Wix Bookings, we collect the purchaser's name, email address, telephone number, session date and time, number of places booked, booking reference and relevant booking communications. These details allow us to confirm your booking, contact you about changes and manage attendance. We do not require a customer account or website membership.

Waivers and attendance. When you complete a waiver online or through the link or QR code at check-in, we collect the signer's name, any contact details they provide, the relevant session or booking reference, their capacity to sign, their acceptance or signature, the date and time of submission and the document version accepted. We record whether the required waiver has been completed and whether the participant attended. We do not require an email address from every group attendee solely to complete a waiver.

Children. For participants under 18, we collect the child's name and age, the parent or legal guardian's name, relationship and contact details, their waiver acceptance and, where necessary, the name of the supervising adult. Children do not need their own email address, telephone number or online account. See section 5 for how parental permissions are handled.

Safety and health information. We request only information relevant to safe participation, such as an animal allergy, an injury or movement restriction, an accessibility need or another health concern you choose to disclose. Information may be provided through the waiver process or discussed privately with staff. We may also record relevant information about an incident, first aid or an emergency. Health information is sensitive information. We seek consent before collecting or recording it unless an applicable legal exception permits collection without consent. You do not need to provide a full medical history.

Images and permissions. We collect photographs or videos taken for the purposes described in section 6 and records of relevant permissions or refusals.

Website information. Wix and the services used to operate the website may collect technical information, including an IP address, browser and device information, pages visited and the time of a visit, through logs, cookies or similar technologies. See section 8.

3 How we collect information

We primarily collect information directly from you through the Contact form, booking and waiver forms, check-in, conversations and other communications. We also receive booking and payment confirmations from Wix and Stripe.

A purchaser may provide booking information about a group. They should share this policy and our Terms and Conditions with those participants. Each other adult provides their own waiver information. A parent or legal guardian supplies the information and permissions required for a child. A group purchaser's acceptance does not automatically constitute another adult's consent.

You may make a general enquiry without identifying yourself, or use a pseudonym where practicable. We need sufficient accurate information to administer a booking, identify a participant, record a valid waiver and manage safety. If necessary information is not provided, we may be unable to respond, complete the booking or permit participation. We will explain any relevant consequence. Refusing promotional photography does not prevent attendance.

4 Why we use information

We use relevant information to:

• answer enquiries and provide customer support;
• administer bookings, payments, cancellations, transfers and refunds;
• send booking confirmations, reminders and essential session updates;
• identify participants, check attendance and record waiver acceptance;
• arrange child supervision and respond to relevant safety or accessibility needs;
• manage incidents, first aid, emergencies, complaints and insurance matters;
• operate and secure the website and improve our services;
• maintain records required for accounting, legal obligations and disputes; and
• publish permitted photographs or videos on Puppy Flow's website and social media.

We do not currently send promotional email, SMS or WhatsApp campaigns. Enquiring, booking or completing a waiver does not subscribe you to marketing. If we introduce marketing, we will update our information and obtain any consent required before sending it.

5 Children and parental permissions

Bookings and waiver acceptance for children are managed by an adult. A parent or legal guardian must complete the required waiver identifying each child. We do not rely on a child's purchase or a group purchaser's general acceptance as parental permission.

We use children's information to identify them, check eligibility and supervision, manage safety and keep the necessary permission records. Staff receive only the information needed for their responsibilities. We do not market directly to children.

Permission for photography and publication is separate from the child's safety waiver, as explained below.

6 Photographs and videos

We notify adults about session photography and video through the booking Terms and Conditions and on-site arrangements. Adults may tell staff before each class if they do not want to be photographed or filmed and may change their preference during the session. We obtain consent directly from the participant where needed; one purchaser cannot automatically provide it for all adults in a group.

Before intentionally photographing or filming a participant under 18, staff must obtain explicit permission from their parent or legal guardian. Staff must also confirm permission to use the material on Puppy Flow's website and social media. Permission to take an image is not, by itself, permission to publish it. We also respect a child's objection to being photographed or filmed.

Incidental background capture may occur, but it does not override a refusal. We take reasonable steps to avoid publishing an identifiable image of a person who has declined, including cropping, blurring or excluding the material.

Our planned promotional use is limited to Puppy Flow's website and social media. We do not use participant images in paid advertising or printed promotional material, sell them, or give venues, breeders or private event hosts permission to publish them independently under this policy. Any proposed additional use requires a separate, appropriate permission process. At a private event, the host or venue's proposed media use must be addressed separately, identifying the recipient and intended use.

You may contact team@puppyflow.com.au to withdraw consent for future use or request removal of an image. We take reasonable steps to remove material from channels we control. We cannot guarantee removal of copies others have already downloaded or shared. Other guests may take personal photographs; staff will communicate privacy preferences, but we cannot control every guest's device or subsequent actions.

7 Payments through Stripe

Payments for bookings are processed through Stripe. Stripe collects the payment credentials and any billing or verification information required to process the transaction, prevent fraud and meet its legal obligations.

We receive the transaction and booking information needed to confirm payment, reconcile accounts and manage refunds, such as payment status, amount and a transaction reference. We do not ask you to send full card numbers or security codes through our Contact form or store them in our Google Drive records. Stripe and Wix may provide limited payment information through their administrative interfaces.

Stripe's processing is explained in its privacy policy: https://stripe.com/au/privacy.

8 Cookies and analytics

Our Wix website uses platform technologies to operate the site, support forms and bookings, maintain security and provide technical or usage information. Cookies are small files stored on your device; related technologies may also be used.

Google Analytics has not been connected. Before enabling it, we will update this policy to explain the information collected, its purposes and relevant choices, and implement any consent controls required for the configured technologies.

You can manage cookies through your browser settings. Blocking some cookies may affect site features, including forms or bookings. Browser settings do not necessarily prevent all server-side logging. Where cookie controls are made available on the site, you may also use those controls.

9 Storage access and disclosure

We use Wix, including Wix Bookings and the configured waiver tools, to administer website interactions and participant records. We use Google Drive for internal business documents. Customer enquiries, bookings and waivers are handled through Wix and the configured booking and waiver tools; we do not routinely export those records to Google Drive. Access is limited to authorised Puppy Flow personnel who need information for their responsibilities. Sensitive information is restricted to those who need it for safety, incident management or related obligations.

We do not sell personal information or routinely provide customer lists, participant contact details or health declarations to studios, breeders, photographers or private event hosts for their own purposes.

Information is nevertheless processed by the service providers necessary to operate our business, including Wix, Stripe and Google. Relevant information may also be disclosed to emergency services, insurers, legal or accounting advisers, regulators or other recipients when necessary and permitted or required by law. We limit disclosures to information relevant to the particular purpose.

Where a photographer works on our behalf, they receive the instructions and permissions needed to handle session images. That does not grant an independent right to publish or market to participants.

10 Overseas processing

Our providers operate internationally. Information may be stored, accessed or processed outside Australia, and may be disclosed to overseas recipients as part of providing the services.

Wix identifies Israel as an initial processing location and lists hosting locations including the United States, Ireland, South Korea, Taiwan and Israel. Its published service-delivery and sub-processor locations also include Brazil, Mexico, Luxembourg, Lithuania, India, Germany, the United Kingdom and Ukraine. Applicable locations depend on the services and processing involved. The current provider list is available at https://support.wix.com/en/article/list-of-wixs-sub-processors.

Stripe identifies international transfers including the United States and India. Google operates servers around the world, and Google Drive information may be processed outside Australia. Details are available at https://stripe.com/au/privacy and https://policies.google.com/privacy.

We take reasonable steps required by applicable law in selecting and using overseas providers and handling overseas disclosures. Listing providers does not transfer our own privacy responsibilities to them or constitute a blanket waiver of those responsibilities.

11 Security and retention

We take reasonable steps to protect information against misuse, interference, loss and unauthorised access, modification or disclosure. Our approach includes appropriate account and document access restrictions and limiting staff access according to their duties. No online system can guarantee absolute security. Please do not send unnecessary medical records or payment credentials through general enquiry channels.

We keep information only for as long as reasonably necessary for its permitted purpose or as required by law. Enquiry records are retained while resolving the enquiry and any related issue. Booking and transaction records are retained for administration, accounting and applicable legal obligations. Waiver, parental permission, health and incident records may need to be kept longer to meet applicable retention requirements and address insurance matters or legal claims, particularly for minors.

When information is no longer needed and no legal retention requirement applies, we take reasonable steps to securely delete it or de-identify it. We consider copies in Wix and any other relevant records; deleting one copy does not necessarily delete all copies. Provider backups or records kept under a provider's independent legal obligations may follow separate retention rules.

We do not rely on a single automatic Wix deletion period for all business records. Contact team@puppyflow.com.au if you would like information about retention of your particular record or wish to request deletion. We will assess the request against the purpose of retention and applicable obligations.

12 Access correction requests and complaints

You may contact team@puppyflow.com.au to request access to the personal information we hold about you, ask for inaccurate information to be corrected, raise a privacy concern or request deletion where appropriate. We may verify your identity and, for a child's records, your authority, using information reasonably necessary for that purpose.

We aim to respond within 30 days or any other timeframe required by applicable law. If more time is needed, we will explain why and provide an expected response date. If we cannot provide access, make a correction or delete a record, we will explain the reason, subject to any legal restriction. Deletion requests may be limited by legal, accounting, insurance or claim-related retention requirements.

To complain, tell us what happened, the relevant booking or record if known, and the outcome you are seeking. We will investigate, consider relevant records and respond to you. We aim to respond to privacy complaints within 30 days.

If you are dissatisfied, you may contact the Office of the Australian Information Commissioner where the matter falls within its jurisdiction: https://www.oaic.gov.au/privacy/privacy-complaints. For a health privacy matter within the NSW regulator's jurisdiction, you may contact the Information and Privacy Commission NSW: https://www.ipc.nsw.gov.au. These complaint avenues depend on the law and jurisdiction that apply to the matter.

13 Changes and third party platforms

We will update this policy when our information handling changes, including before introducing Google Analytics, marketing campaigns or new media uses. We will publish the revised policy and update its date, and provide further notice or seek consent where required. An update does not retrospectively create consent for a new purpose.

Links to independent websites and social media platforms are governed by their own privacy practices. This does not reduce Puppy Flow's responsibilities for its own use of those platforms or disclosures to them.