Cookie Policy

1. About this Policy

This Cookie Policy is issued by GNR Media Pty Ltd, ABN 80 668 188 289, trading as GNR Media (GNR Media, we, us or our).

It explains how and why we store information on, or access information from, a browser, computer, phone, tablet or other connected device when a person uses a GNR Media website, platform, public Network, form, funnel or other online service that links to this Policy.

In this Policy, the word cookies includes cookies and similar technologies such as pixels, tags, scripts, software development kits, local storage, session storage, device identifiers and comparable storage or access technologies.

2. Relationship with the Terms and Privacy Policy

This Policy should be read with the Terms and Conditions, Privacy Policy, applicable plan or Order, and the Data Processing Addendum where it applies.

The Privacy Policy explains the broader collection, use, disclosure, storage, international transfer and privacy rights that apply when information collected through cookies is personal information or personal data. This Cookie Policy gives more detailed information about the technologies themselves and the choices available.

3. Scope

This Policy applies to:

• GNR Media websites and subdomains, including public pages and the GNR Media Network;
• GNR Media-controlled landing pages, forms, funnels, booking pages and checkout pages that link to this Policy;
• the GNR Media Platform and account areas, including login and security functions;
• GNR Media-controlled community, reporting, analytics and support interfaces; and
• similar technologies used in GNR Media emails or digital communications where this Policy is relevant.

This Policy does not automatically govern a separate Client website, application or campaign merely because GNR Media provides marketing, optimisation or platform services to that Client. The Client remains responsible for its own cookie notice and consent process unless an Order expressly says that GNR Media will implement and maintain those items for it.

A third-party website or service reached through a link is governed by that third party's own privacy and cookie terms.

4. What cookies and similar technologies are

Cookie

A small text file or data item stored on a browser or device and returned to a website or service on later requests.

First-party technology

A technology set or controlled through a GNR Media domain or service.

Third-party technology

A technology provided by another organisation, such as a hosting, security, analytics, video, payment, social-media or advertising provider.

Session technology

A technology that normally expires when the browser or application session ends.

Persistent technology

A technology that remains until its stated expiry, deletion by the user or replacement by a later value.

Pixel or tag

Code that can record a page view, interaction, conversion or technical event and transmit information to GNR Media or a provider.

Local or session storage

Browser storage that can remember settings, session state, authentication or application information without using a traditional cookie.

Consent-management technology

A tool that presents choices, blocks technologies where required, records the choice and allows later changes.

5. Information collected

Depending on the technology, page, service and user choice, information may include:

• IP address, approximate location, device type, browser type, operating system and language;
• pages viewed, referring page, links clicked, time, date, session duration and navigation path;
• form, booking, checkout or login status, but not the full payment-card number held by a payment provider;
• account, session, authentication and one-time login state;
• consent choice, privacy preference and the version of the notice shown;
• campaign source, advertisement, referral, conversion and attribution information;
• errors, performance, security events, fraud indicators and bot-detection information;
• video, chat, social-media or embedded-content interactions; and
• identifiers supplied by a provider or created to distinguish browsers, sessions, users or events.

Cookie information may be combined with account, enquiry, CRM, campaign or public-business information where permitted by the Privacy Policy, the Terms and applicable law. We do not intentionally place passwords, complete payment-card details or sensitive form content inside analytics or advertising cookies.

6. Categories of technologies

6.1 Strictly necessary

These technologies support functions that are necessary to provide a website or digital service requested by the user. They may support security, content delivery, session continuity, authentication, one-time login, fraud prevention, load balancing, forms, booking, checkout, account access and the recording of cookie preferences.

They are generally active without optional consent where an applicable law recognises a strictly necessary or equivalent exception. They are not used under that exception for unrelated analytics or advertising.

6.2 Preferences and functionality

These technologies remember choices such as language, display, saved settings, chat state, form progress, convenience features or media preferences. Some may be necessary for a feature specifically requested by the user. Others are optional and will be controlled through the preference tool where required.

6.3 Analytics and performance

These technologies help us understand visits, traffic sources, page use, engagement, errors, conversion paths, feature use and performance. They support reporting, service improvement, website optimisation and measurement of whether content or campaigns are working.

Where prior consent is required, analytics technologies remain disabled until the visitor selects the analytics category or accepts all non-essential technologies.

6.4 Advertising, social media and targeting

These technologies may measure advertisements, attribute conversions, limit repetition, create or exclude audiences, support social-media features and enable targeted or cross-context behavioural advertising. They may allow a provider to recognise a browser or device across different websites or services.

They are non-essential. They are activated only where actually configured and where the required consent or opt-out controls have been provided. Refusing them does not stop a person from accessing the core public website.

6.5 A technology used for more than one purpose

A provider or technology is not automatically “necessary” merely because one of its functions is necessary. Where the same technology has necessary and non-essential purposes, we will separate the purposes where technically possible and obtain the required choice for the non-essential purpose.

7. Provider and technology inventory

The table below identifies the principal provider families and purposes that may operate across GNR Media's online services. Not every provider operates on every page. A conditional provider is used only where the relevant feature or tag has actually been enabled.

Google Search Console and similar backend reporting connections may provide aggregated website information without placing a separate visitor cookie through the public page. They are governed by the Privacy Policy and Data Processing Addendum where relevant rather than being listed as a visitor cookie solely because an account is connected.

8. How consent and preferences work

8.1 First visit

Where a consent mechanism is required, a visitor should be shown clear controls before non-essential technologies are activated. The initial layer should provide equally accessible choices to Accept All, Reject All or Manage Preferences.

8.2 No preselected non-essential categories

Analytics, functional and advertising categories that require consent must not be preselected. Silence, inactivity, scrolling or continuing to browse is not treated as consent where a positive action is required.

8.3 Necessary technologies

Strictly necessary technologies cannot normally be disabled through the category selector because they support a service, security or preference function requested by the user. A user may still block them through browser settings, but parts of the website, login, form, checkout or Platform may then fail.

8.4 Withdrawal and later changes

A person can change or withdraw a previous non-essential choice at any time by using the Cookie Settings control in the website footer or banner. Withdrawal does not make earlier processing unlawful, but it stops future activation of the affected categories on that browser or device, subject to technical deletion and provider-processing limits.

8.5 Consent records

We may record the preference, date, time, browser or device identifier, region, notice version and categories selected. This record is used to prove and apply the choice and is treated as strictly necessary for the consent-management function.

8.6 Re-consent

We may ask a person to choose again when a previous record expires, when the purposes or providers materially change, when the legal requirements change, or when we cannot reliably connect the current browser or device with an earlier choice.

9. Jurisdiction-specific rules

9.1 European Union and European Economic Area

Where EU or EEA storage-and-access rules apply, non-essential technologies are activated only after the user has received clear information and given the required consent. Technologies used solely to transmit a communication or strictly necessary to provide a digital service explicitly requested by the user may operate under the applicable exception.

Any later processing of personal data must also have a lawful basis under the GDPR. Consent can be withdrawn, and a refusal must not prevent access to the core public website unless the requested feature genuinely cannot operate without the relevant technology.

9.2 United Kingdom

Where United Kingdom rules apply, we follow the applicable Privacy and Electronic Communications Regulations and UK GDPR requirements. Non-essential technologies require a clear positive choice, must not be loaded before that choice, and must be capable of being refused and later withdrawn.

9.3 Australia

Australian law does not impose one identical consent model for every cookie. Where tracking collects, uses or discloses personal information, we apply the Privacy Act and Australian Privacy Principles where applicable, including transparency, data minimisation, fair collection, overseas-disclosure and direct-marketing requirements. Targeted advertising controls provide a simple way to opt out where required.

9.4 United States

Where an applicable United States state law gives a person the right to opt out of a sale, sharing, targeted advertising or certain profiling, GNR Media will provide the required choice and process a recognised opt-out preference signal where legally required and technically received. Some disclosures to advertising or analytics providers may be regulated as a “sale” or “sharing” even where no money is paid.

A state-specific Your Privacy Choices control may be provided in addition to Cookie Settings where required. The Privacy Policy contains the broader United States state disclosures and request process.

10. Global Privacy Control and browser signals

Where applicable law requires it, GNR Media processes a technically received and recognised opt-out preference signal, including Global Privacy Control, as a request to stop the regulated sale or sharing of personal information or targeted advertising for the relevant browser, device and associated profile to the extent required.

Where technically feasible and required, the website or preference tool should indicate that the signal has been honoured. A later absence of the signal is not automatically treated as permission to reverse a previously recorded opt-out.

We do not respond to every browser “Do Not Track” signal because there is no single universally binding standard. This does not affect a recognised signal that applicable law requires us to honour.

11. Third-party and embedded services

Some pages may contain third-party maps, videos, booking tools, chat, social-media functions, payment tools, forms or other embedded services. A third party may receive technical and interaction information when the service is loaded or used.

Where required, non-essential embedded content should use a privacy-enhanced, delayed-load or click-to-activate method so the third party is not contacted before the user makes the required choice. A feature may remain unavailable until its category is enabled where the third party cannot provide it without the relevant technology.

Third-party providers may independently determine some purposes and retention periods. Their own privacy and cookie notices apply to those independent activities. GNR Media selects and configures providers reasonably, but does not control every later use occurring within a third party's separate account or service.

12. International transfers

Cookie and online-technology information may be processed in Australia, the United States and other countries where GNR Media or an authorised provider operates. Those countries may have different privacy laws from the user's location.

Where EU, EEA, UK, Swiss or other restricted-transfer rules apply, GNR Media uses an available lawful transfer mechanism and supplementary protections where required. Further information is available in the Privacy Policy and Data Processing Addendum.

13. Retention and expiry

A session technology normally expires when the relevant session ends. A persistent technology remains until its stated expiry, deletion by the user, withdrawal of the relevant choice, replacement by a later value or deletion under the provider's controls.

The exact active duration should be shown in Cookie Settings. We configure retention to be proportionate to the purpose and review persistent technologies periodically. Consent and refusal records may be retained for the period reasonably required to apply the preference, demonstrate compliance, resolve a dispute and meet legal record-keeping requirements.

Deleting cookies may remove the stored preference. The banner may then appear again because the website can no longer recognise the earlier choice.

14. Browser and device controls

Most browsers allow a user to inspect, block or delete cookies and control local storage. Mobile operating systems and applications may provide separate advertising, tracking or identifier controls. A user can also use privacy-focused extensions or browser settings.

Browser deletion does not necessarily erase information already transmitted to a provider. A separate privacy request or provider control may be needed. Blocking all technologies may interfere with login, forms, booking, checkout, embedded media, saved choices or other requested functions.

The preferred method for GNR Media category choices is the website's Cookie Settings control because it is designed to apply the available categories consistently.

15. Client websites and Client-directed tools

A Client may ask GNR Media to connect analytics, search, advertising, CRM, social-media, payment, chat, video or other technologies to the Client's own website or campaign. The Client is responsible for ensuring that the intended use is lawful, accurately disclosed and supported by an appropriate consent or opt-out mechanism.

Where GNR Media implements a consent tool for a Client under an Order, the Client must provide accurate information about its providers, purposes and regions, and must not add or alter tracking code without updating the consent configuration and policy. GNR Media may suspend a tag that creates a material legal, security or privacy risk.

Client-controlled personal data processed through those services is also governed by the Data Processing Addendum where GNR Media acts as a processor, service provider or contractor.

16. Children and sensitive information

GNR Media's public websites and Services are directed to businesses and adults acting in a business or professional capacity. We do not intentionally use advertising technologies to profile children or knowingly sell or share children's personal information.

Tracking technologies should not be configured to collect form fields or page information that reveals health, biometric, financial-account, government-identifier or other sensitive information unless a documented lawful process and any required express consent are in place. Sensitive pages should generally exclude third-party advertising pixels.

A person who believes a child or sensitive information has been collected through a tracking technology should contact us promptly using the details below.

17. Changes, complaints and contact

17.1 Changes to this Policy

We may update this Policy when our websites, Platform, providers, technology, purposes or legal obligations change. The current version will show its effective date and version number. A material change may also trigger a fresh cookie choice or additional notice.

GNR Media should retain previous versions and periodically scan the production sites so the published provider inventory and live Cookie Settings remain accurate.

17.2 Questions and complaints

A question about this Policy, a tracking technology or a privacy preference may be sent to [email protected]. Please identify the website or page, approximate date and time, browser or device, technology or provider concerned and the outcome requested.

Privacy rights, complaints and regulator information are explained in the Privacy Policy.