Privacy Policy

Druk Connect

Effective date: 19 July 2026 Last updated: 19 July 2026

1. Who we are

Druk Connect ("Druk Connect", "we", "us", "our") is a community events and business directory platform for the Bhutanese community in Australia and Bhutan. This Privacy Policy explains how we collect, use, hold, disclose and protect your personal information.

• Entity: Lam Penjor, trading as Druk Connect (ABN 15 184 654 507), a sole trader
• Contact: [email protected]
• Postal address: WA 6018, Australia

We are committed to handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

Where we operate. Druk Connect is operated from Western Australia, Australia, and serves users in both Australia and Bhutan. Wherever you are located, we handle your personal information in accordance with this Policy and with Australian privacy law. If you use the Platform from Bhutan or elsewhere outside Australia, your personal information will be collected, stored and processed in Australia and in the other countries listed in section 6.

2. What personal information we collect

We only collect information we need to run the platform. Depending on how you use Druk Connect, this may include:

Account & profile

• Name, email address, and (optionally) phone number
• Profile photo, bio
• Sign-in identifiers when you use Apple or Google sign-in. If you use Sign in with Apple and choose "Hide My Email", we receive an Apple private relay address rather than your real email.
• Password (stored only as a secure one-way hash — we can never see it)

Personalisation

• Your home country and home region/state
• Interest categories you select during onboarding

We use these to order your feed and to show events near you. We do not track your precise GPS location in the background.

Events, tickets & participation

• RSVPs, ticket purchases, and check-in records
• Events you save, create, or manage as an organiser
• Tournament and competition registrations
• Volunteer sign-ups

Payments

• We use Stripe to process card payments. Your full card number is entered directly with Stripe and is never stored on our servers. We retain a record of the transaction (amount, date, status, and a payment reference).
• For Bhutan-based payments made by bank transfer, we retain the transfer receipt/reference you submit.

Business directory & sponsorship

• Business listing details you provide (name, description, contact details, logo, images, location)
• Sponsorship and subscription records

Content you upload

• Photos, documents, event updates, prayer/announcement messages, and other content you submit. This content may be visible to other users depending on where you post it.

Location (approximate)

• When you type an address (for example, when creating an event or business listing), we use Mapbox address autocomplete to help you fill in the city, state and country.

Device & technical

• A Firebase Cloud Messaging (FCM) device token so we can deliver the push notifications you have opted into
• App version, device type/operating system, and basic diagnostic/usage data

3. Tracking and advertising

Druk Connect does not track you across other apps or websites, and does not use advertising identifiers (such as the Apple IDFA). We do not sell your personal information, and we do not share it with advertising networks or data brokers.

We use basic in-app analytics only to understand how the app is used and to fix problems. This is first-party — it happens on our own systems, using your activity within Druk Connect. We count things like how many people used the app this month and which parts of it get used, so we can improve it and describe our community to partners in aggregate. This never follows you outside Druk Connect.

If you tap a link to a sponsor or partner, it passes through our own server so we can count the tap before sending you on. We record that a tap happened, roughly where from, and whether it was a repeat — not who you are. See Partners in section 6.

4. How we use your information

We use your personal information to:

• Create and manage your account
• Show you relevant events, and personalise your feed based on your home region and interests
• Process RSVPs, ticket sales, check-ins, and tournament registrations
• Process payments through Stripe (and verify bank-transfer payments where applicable)
• Send you notifications and communications you have chosen to receive
• Operate the business directory and sponsorship features
• Moderate content and keep the community safe
• Respond to your enquiries and provide support
• Meet our legal, tax and regulatory obligations

We only use your information for the purposes it was collected for, a directly related purpose you would reasonably expect, or where you have consented.

5. Direct marketing and notifications

We will only send you marketing or promotional messages where you have consented (for example, by enabling a notification category or opting in to announcements), consistent with the Spam Act 2003 (Cth).

You can change your notification preferences at any time in Profile → Notifications, and every marketing email includes an unsubscribe option. Some messages are transactional (for example, a ticket confirmation or a security alert) and are not marketing — you will continue to receive these while you hold an account.

6. Who we disclose your information to, and overseas disclosure

We disclose personal information to trusted service providers who help us run the platform. Some of these providers store or process data outside Australia, including in the United States. By using Druk Connect you acknowledge this overseas disclosure. Our key providers are:

We take reasonable steps to ensure these providers handle your information consistently with the APPs. We may also disclose information where required or authorised by law (for example, to a court, regulator, or law enforcement).

Event organisers and business owners you interact with may see limited information necessary to provide their service to you — for example, an organiser can see the attendee list and check-in status for their own event.

Partners

We may show you offers or services from community partners (for example, money-transfer, insurance or tax services). Where we do, and where we receive a fee for a referral, we tell you so on the offer itself.

We only ever share aggregate, de-identified information with partners — for example, "312 people opened this offer this month, 47% of them in Perth". We do not tell a partner who you are, and we do not give them your identifiers.

The one exception is when you choose to submit an enquiry to a partner. In that case we share the details you enter on the enquiry form (such as your name and phone number) with that partner, so they can contact you. We show you exactly what will be shared and with whom before you submit, we record your consent, and you can withdraw an enquiry at any time in the app. Withdrawing tells us and the partner to stop contacting you; it does not delete the record of the consent you gave, which we keep so both you and we can show what was agreed.

Tapping a partner link opens that partner's own website. What happens there is governed by their privacy policy, not ours.

7. Deleting your account and your data

You can permanently delete your account at any time from Profile → Delete Account.

When you delete your account, we permanently delete or irreversibly anonymise your personal information — including your name, email address, phone number, profile photo and bio — so that it can no longer be linked to you. Your profile photo is deleted from our image storage, not merely unlinked.

This also covers contact details you published elsewhere on the Platform:

• Any business listing you own is removed from the public Directory, and its phone, email and WhatsApp details are deleted.
• Any event you organised remains published (attendees may hold tickets and the event may still go ahead), but your organiser contact phone and email are removed from it.

We may retain a limited amount of information where the law requires it or where we have a legitimate need, specifically:

• Transaction and payment records are retained for up to 7 years to meet Australian tax and financial-records obligations. These are anonymised where possible.
• Content you posted publicly (for example, a community announcement) may be retained in an anonymised form, or removed on request.

Deletion is immediate and cannot be undone.

8. Accessing and correcting your information

You can view and update most of your information directly in the app (Profile → Edit Profile, region and interest settings, and notification preferences).

To request access to, or correction of, other personal information we hold about you, contact us at [email protected]. We will respond within a reasonable period, consistent with APP 12 and APP 13. There is no charge for making a request, though we may charge a reasonable cost for access in limited circumstances.

9. How we protect your information

We take reasonable steps to protect your information from misuse, loss, and unauthorised access, including:

• Encrypting data in transit (HTTPS/TLS)
• Storing your authentication token in the device's secure keychain
• Storing passwords only as salted one-way hashes
• Restricting staff and administrator access

No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

10. Children

Druk Connect is intended for users aged 16 and over. We do not knowingly collect personal information from children below this age without parental involvement. Where a parent or guardian registers a minor for an event or tournament, they are responsible for that information. If you believe we hold information about a child in error, contact us and we will delete it.

11. Complaints

If you have a concern about how we have handled your personal information, please contact us first at [email protected] so we can try to resolve it.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you in the app. The current version is always available at https://drukconnect.app/privacy.

Contact us: [email protected]