Sauna X — McLuu Pty Ltd (ABN 14 672 474 832)

10 Taylor Street, Darlinghurst NSW 2010

Last updated: 27th September 2026   Next review: 27th September 2027

Who we are

Sauna X is operated by McLuu Pty Ltd. This policy explains what personal information we collect about guests, why we collect it, how we hold it, and what you can do if you want access to it, want it corrected, or want to make a complaint.

We understand that discretion matters to our guests. This policy is written to be specific rather than reassuring, so you can see exactly what we do.

What we collect

Entry footage and facial images. CCTV operates at the entrance and in common areas of the venue. Cameras are not installed in private areas.

Biometric information. A single camera at the entrance uses facial recognition technology. When you enter, the system captures an image of your face and converts it into a numerical template, which it compares against our internal list of people banned from the venue. The system raises an alert only when a face reaches 80% similarity or higher to a banned-list profile. Signage at the entrance tells you that facial recognition is in use before you reach the camera.

Incident records. If you are involved in an incident at the venue, we record what happened, including any relevant footage.

What we do not collect. We do not scan, record or store identity documents. Staff may ask to sight proof of age where required under our liquor licence, but no copy or scan is taken and no details are recorded.

Why we use facial recognition

The entrance system exists for one purpose: to identify people who have previously been banned from the venue following incidents involving violence, threats, abuse, theft or the supply of illegal drugs.

It is not used for marketing, guest profiling, attendance tracking, or any commercial purpose. We do not use it to build a record of who visits or how often.

A person is added only after an incident of the kind described above, and only by a manager.

A match from the system is never treated as a decision on its own. It prompts the manager on duty to make a visual check before any action is taken. Staff are required to handle any check discreetly and to explain to the guest that a brief security check is taking place.

How we hold your information

All facial recognition processing happens on equipment located at the venue. Facial images and templates are not uploaded to any cloud service and are not sent to Dahua, the equipment manufacturer, or to any other company.

Our security contractor holds administrative access to the recording equipment for maintenance and servicing purposes. They do not receive copies of footage or biometric information, and they are not permitted to use, copy or export any information they can access.

How long we keep it

• Entry and common area footage - 4 weeks, then automatically overwritten

• Facial images of guests who do not match the banned list - Not retained beyond the footage retention period above

• Banned list profiles and associated images - For the duration of the ban, reviewed at least annually

When we share information

We do not sell, rent or trade personal information, and we do not share guest details, booking information or visit history for marketing purposes.

We disclose information only in these circumstances:

Legal requirements. Where required by law, subpoena, court order or other legal process, or in response to a lawful request from police.

Serious incidents. If a guest is involved in illegal activity or threatens the safety of guests or staff, we may report the matter to police and provide relevant information, including footage.

Emergencies. In a medical or safety emergency, we may give limited necessary information to emergency responders.

We do not disclose personal information to recipients outside Australia.

Accessing, correcting or deleting your information

You can ask us what personal information we hold about you, ask for it to be corrected, or ask us to delete it. Write to info@saunax.com.au and mark your message "Privacy request".

We will respond within 30 days. If we cannot give you what you have asked for, we will explain why in writing.

If you believe you have been incorrectly matched by the facial recognition system, tell us and we will investigate, correct our records, and confirm to you in writing what we have done.

Complaints

If you are unhappy with how we have handled your personal information, contact us at info@saunax.com.au and we will respond within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

Changes to this policy

We review this policy at least annually and whenever we make a material change to how we collect or use personal information. The date at the top shows when it was last updated.