Heli-Tour Whitsundays Pty Ltd (ABN 84 149 434 613), trading as HeliReef Whitsunday
Last updated: 29 July 2026
This website (helireef.com.au) is owned and operated by Heli-Tour Whitsundays Pty Ltd, trading as HeliReef Whitsunday (“we”, “our”, “us”). We are committed to protecting your privacy and handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
This policy explains what personal information we collect, why we collect it, how we hold it, who we share it with, and how you can access or correct it or make a complaint.
What we collect
When you book a tour, transfer or scenic flight with us — online, by phone, by email, or through a travel agent, resort or tour desk — we collect:
- Booking contact details — your name, email address and phone number, so we can confirm, manage and, where necessary, change your booking.
- Passenger details — the full name of each passenger travelling.
- Passenger weights — the weight of each passenger. We are required to collect this for aircraft loading and weight-and-balance calculations under civil aviation safety requirements. All passengers are weighed prior to boarding; weights are used solely for flight safety planning and to apply any applicable weight-related surcharges as set out in our Terms and Conditions.
- Travel details — tour or transfer selection, travel dates, and where relevant your accommodation or pick-up location.
- Other information you choose to give us — for example health, mobility or dietary information you volunteer so we can plan your flight or experience safely and appropriately.
- Website data — cookies, analytics data and standard server logs (such as IP address, browser type and pages visited) when you use our website, as described under “Cookies and analytics” below.
Where you book for other people (for example, family members or your travel group), you should only provide their details with their consent, and we rely on you to do so.
Payment information — how card details are handled
Payments are processed by BPOINT, the secure online payment service of the Commonwealth Bank of Australia.
Your credit card details are entered directly into, and processed by, BPOINT. Your full card number and security code (CVV) are never received, seen or stored by us. We receive and hold only:
- a secure payment token issued by BPOINT that references your card,
- a masked card number (the last four digits) and card expiry date, and
- transaction results and receipts.
We use the token to pre-authorise your card prior to departure and to process payment, refunds or applicable cancellation fees in accordance with our Terms and Conditions. BPOINT is operated by the Commonwealth Bank of Australia and complies with the Payment Card Industry Data Security Standard (PCI DSS). The Commonwealth Bank’s own privacy policy applies to its handling of your card data and is available at commbank.com.au.
Why we collect your information
We collect, hold and use your personal information to:
- process, confirm, manage and fulfil your booking;
- meet aviation safety and regulatory requirements, including aircraft weight-and-balance planning and passenger manifests;
- take payment, apply pre-authorisations, and process refunds or cancellation fees;
- contact you about your booking, including schedule or weather-related changes;
- respond to your enquiries;
- comply with our legal obligations, including those under civil aviation, taxation and other laws;
- maintain and improve our services and website; and
- with your consent or where you would reasonably expect it, tell you about our tours and offers (you can opt out at any time using the unsubscribe link in any marketing email or by contacting us).
If we cannot collect the information above, we may be unable to accept or fulfil your booking — in particular, passenger names and weights are mandatory for flight safety reasons.
Who we share it with
We do not sell or rent your personal information. We disclose it only:
- to the air operator — flights booked through this website are operated by Whitsunday Air Services Pty Ltd (trading as Hamilton Island Air) under its Air Operator’s Certificate. Passenger names, weights and booking details are shared with the operator as required to conduct your flight safely and lawfully;
- within our group — with our associated company Whitsunday Air Services Pty Ltd, with which we share reservation and operational systems;
- to tour and transfer partners — where your experience includes a component delivered by a third party (for example a reef cruise, pontoon visit or island resort transfer), we pass on the passenger details that operator needs to provide the service;
- to your travel agent, resort or tour desk — where your booking was made through one, in connection with that booking;
- to service providers — such as our payment processor (BPOINT / Commonwealth Bank of Australia), reservation system, IT and website providers, who are only permitted to use your information to provide services to us;
- to regulators, emergency services and authorities — including the Civil Aviation Safety Authority, search-and-rescue and law enforcement agencies, where required or authorised by law or necessary for safety; and
- to our insurers and professional advisers where reasonably necessary.
Overseas disclosure
Your booking and payment information is held in Australia. Some of our website and analytics providers (such as Google) may process limited website-usage data on servers located overseas, including in the United States. We take reasonable steps to ensure any overseas recipient handles personal information consistently with the Australian Privacy Principles.
Storage, security and retention
We take reasonable steps to protect your personal information from misuse, interference, loss, unauthorised access, modification or disclosure — including access controls, encrypted transmission (HTTPS) and use of a tokenised payment gateway so that card numbers never touch our systems. No internet transmission can be guaranteed as fully secure, but we act to protect your information once we receive it.
We keep booking, passenger and payment records for as long as needed for the purposes above and as required by aviation, taxation and other laws, after which they are deleted or de-identified.
Cookies and analytics
Our website uses cookies — small files stored by your browser — to make bookings work and to understand how the site is used. We use analytics services (such as Google Analytics) and conversion-tracking cookies to measure site performance and advertising effectiveness. These tools collect information such as pages visited, time on site and approximate location; they do not give us your name. You can block or delete cookies in your browser settings, and you can opt out of Google Analytics at tools.google.com/dlpage/gaoptout. Blocking cookies may affect the online booking process.
Our website may contain links to other websites. We are not responsible for the privacy practices of those sites and encourage you to review their policies.
Access, correction and complaints
You may ask us at any time for access to the personal information we hold about you, or ask us to correct it if it is inaccurate, out of date or incomplete. We will respond within a reasonable time and will not charge you for making a request.
If you have a concern about how we have handled your personal information, please contact us using the details below. We will acknowledge your complaint and respond within a reasonable time (usually 30 days). If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) — www.oaic.gov.au or 1300 363 992.
Contact us
HeliReef Whitsunday (Heli-Tour Whitsundays Pty Ltd)
Coral Sea Marina, Airlie Beach QLD 4802, Australia
Phone: +61 7 4946 9102
Email: res@helireef.com.au
Changes to this policy
We may update this policy from time to time. The current version will always be published on this page with its “last updated” date.