Privacy

Apparatus Operations Pty Ltd runs electronic music events and this website. For privacy questions or requests, email hello@apparatus.fm.

Signups and enquiries — the name, email, phone number and optional postal address you provide, your preferences, consent records and messages to us. We use these to manage subscriptions, answer enquiries and send information you have requested.

Tickets and orders — purchaser and door-list names, email, order items, ticket references, payment status, refunds and check-in records. Shipping details are collected where an order needs delivery. Stripe processes card details; we do not receive your full card number or security code. Authorised event staff can access the information needed to validate entry.

Drawings — submitted images, optional signatures, messages and any ticket reference supplied with an event drawing. Drawings and signatures may appear on the site, at events or in Apparatus material. Avoid including personal information you do not want displayed. Contact us to request removal. This policy describes data handling; it does not itself assign copyright.

Technical information — IP address, browser and device details, requested pages, errors and security signals through hosting, analytics and anti-abuse services. Cloudflare Turnstile checks browser and device signals on signup forms to help distinguish people from bots.

We do not sell or rent our contact list. Service providers process information as described below; their own policies explain any additional uses. We do not ask you to submit sensitive personal information through public forms.

To deliver tickets and orders, run entry and customer support, send subscribed marketing, understand which campaigns lead to visits and purchases, improve the website, prevent fraud and meet our legal obligations. Required form fields are needed to provide the relevant service; optional fields can be left blank.

Google Analytics and Microsoft Clarity are loaded through Google Tag Manager. Analytics measures visits, device/browser information, campaign sources and interactions. Clarity records page interactions such as clicks, scrolling and navigation to produce heatmaps and session replays, using cookies and other identifiers.

Our own tagged links use UTM parameters. We store campaign source, referrer and landing-page information in a first-party cookie and browser local storage for up to 30 days. These values can be sent with a signup to Brevo or attached to a Stripe checkout so we can attribute subscriptions and sales. A random checkout identifier can also connect an order to its Clarity session. This means activity is not necessarily anonymous, even though we do not intentionally send names, email addresses or card details as analytics event fields.

Other browser storage remembers site choices and drawing submissions. You can clear or block cookies and local storage through your browser, although this may affect site functions. Clearing stored data does not delete information already received by us or our providers. Google offers an Analytics opt-out browser add-on; Microsoft describes its privacy controls in the statement linked below.

Artist pages may load embedded players from SoundCloud, YouTube or other media services. Loading a player can send your IP address and browser information to that provider and may use its cookies. Links to Instagram, Resident Advisor and other external platforms take you to services governed by their own privacy policies.

We use the following services:

Stripe — payments, fraud prevention and purchase records. Privacy policy.
Brevo — subscriber and ticket-holder contacts, marketing and transactional email, delivery and engagement reporting. Privacy policy.
ClickSend — SMS delivery, replies, delivery reports and opt-out records. Eligible SMS subscriber details may be transferred from Brevo to ClickSend. Privacy policy.
Vercel — website hosting, delivery and logs. Privacy policy.
Upstash — application records, ticket operations and rate limiting. Privacy policy.
Cloudflare — domain/network services, media delivery where used and Turnstile bot protection. Privacy policy.
Google Tag Manager and Google Analytics — tag management and website measurement. Privacy policy.
Microsoft Clarity — heatmaps, session replay and interaction measurement. Microsoft may also use collected information for its advertising and service-improvement purposes under its terms. Privacy statement and choices.

These providers and their subprocessors may process information outside Australia, including in the United States and European countries. Locations vary by provider and service; their policies explain international processing. Information may also be shared with authorised event staff, professional advisers or authorities where necessary to provide our services or meet legal obligations.

We keep contact information while needed for your subscription or our relationship with you. Unsubscribing stops marketing; it does not automatically erase purchase records. We may keep a minimal suppression record to respect your opt-out.

Financial records are retained for applicable Australian tax and company recordkeeping periods, or longer when required for a dispute or legal obligation. Other operational records, drawings and correspondence are kept while needed for the purposes described here. Contact us about deletion; we will explain any records we need to retain.

Our campaign-attribution cookie and local-storage entry expire after 30 days unless refreshed by a new tagged visit. Rate-limit counters expire after their configured window. Hosting logs, analytics and messaging records follow the relevant service settings and backup cycles; we do not promise a single deletion period for all providers.

Email hello@apparatus.fm to request access, correction, deletion, a copy of your information, or removal of a drawing. We may need to verify your identity. We aim to respond within 30 days and will explain any lawful reason we cannot fulfil a request.

Where EU or UK data-protection law applies, you may also have rights to restrict or object to processing, data portability and withdrawal of consent. The applicable basis depends on the activity: fulfilling an order, consent for marketing or tracking where required, legitimate interests where permitted, or legal obligations. You can contact us or complain to your local supervisory authority.

Marketing email and SMS are separate from essential ticket confirmations, refunds and event-service messages. Buying a ticket is not, by itself, permission for unrelated marketing.

Use the unsubscribe link in marketing emails. For SMS, reply STOP when the message offers that option, or follow its opt-out instructions. You can also email us. We action marketing opt-outs within five working days. Tell us if you want to stop both email and SMS.

Email and messaging services may record delivery, bounces, opens, link clicks and replies to help us manage campaigns. Email opens can be affected by image blocking and mail-app privacy features.

We use access controls, encrypted connections and specialist payment and hosting providers to protect information. No online system is completely secure. If a breach occurs, we assess it and notify affected people and regulators where required by law.

We do not knowingly collect information from anyone under 16. Our events are 18+.

We update this page when our practices change and show the revision date above. Where required, we provide a separate notice or seek consent for a new use of your information.

Email hello@apparatus.fm. We investigate and respond within 30 days. If unsatisfied, lodge a complaint with the OAIC at oaic.gov.au.