1 Purpose and overview

Charman Property Co Pty Ltd ACN 638 306 019 of 1/172 Robertson Street, Fortitude Valley QLD 4006 (we, us, our) is committed to protecting your personal information and handling it in line with the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how and why we collect, use, hold, store, disclose and protect personal information, including information used to verify your identity and, where applicable, sensitive and biometric information.

A current version of this Policy is available on our website at https://www.charmanproperty.com.au (website).

2 What is personal information?

Personal information is any information or an opinion about an identified individual or an individual who can be reasonably identified from the information or opinion. Information or an opinion may be personal information regardless of whether it is true.

3 What personal information do we collect and hold?

This Policy applies to personal information collected by us about:

1. clients and prospective clients;

2. vendors and their agents;

3. property owners, developers, and selling agents;

4. website users;

5. contractors and service providers;

6. referees and professional contacts; and

7. other individuals whose personal information is provided to us in the course of operating our business.

The information we collect from you may include your identity and contact details, your history and use of our products and services and details of enquiries or complaints you make, including:

1. full name;

2. residential, postal or business address;

3. telephone number and email address;

4. date and place of birth;

5. government-issued identification information, including copies or details of identity documents where reasonably required, such as driver licence, passport, Medicare card or other identification document numbers;

6. financial information, including budget, borrowing capacity, proof of funds or finance status;

7. property preferences and search criteria;

8. investment objectives and property acquisition requirements;

9. details relating to property transactions, offers, negotiations and acquisitions;

10. information about legal or beneficial ownership structures, including company or trust details;

11. tax-related or business information where relevant to a transaction;

12. communications with us, including emails, calls, messages, meeting notes and enquiries;

13. website usage information, IP address, browser type, device information and cookie data;

14. employment or contractor information where relevant;

15. biometric information, such as a facial image or short video used to verify your identity; and

16. any other personal information reasonably necessary for us to provide our services or operate our business, including any other information you choose to provide to us.

We only collect personal information that is reasonably necessary to carry out our business activities.

We will collect sensitive information from you if you consent to the collection, unless it is permitted under the Privacy Act, such as where the collection is required or authorised by law or Court Order. Biometric information collected for identity verification is treated as sensitive information under the Privacy Act.

4 Website information and cookies

We may collect information about how you access, use and interact with the website. This information may include:

1. the location from which you have come to the site and the pages you have visited; and

2. technical data, which may include IP address, the types of devices you are using to access the website, device attributes, browser type, language and operating system.

We use cookies on the website. A cookie is a small text file that the website may place on your device to store information. We may use persistent cookies (which remain on your computer even after you close your browser) to store information that may speed up your use of our website for any of your future visits to the website. We may also use session cookies (which no longer remain after you end your browsing session) to help manage the display and presentation of information on the website.

You may refuse to use cookies by selecting the appropriate settings on your browser. However, please note that if you do this, you may not be able to use the full functionality of the website.

5 Why do we collect, hold and use your personal information?

We collect, hold and use your personal information so that we can:

1. provide you with products or services or information relating to such products or services;

2. provide you with information that you request;

3. provide you with responses to queries that you may raise with us;

4. assist with our internal business activities, including:

   (i) providing buyers agency and related services;

   (ii) assessing whether we can act for a client;

   (iii) understanding a client’s property requirements, objectives and budget;

   (iv) identifying and evaluating properties;

   (v) assisting with negotiations and acquisitions; and

   (vi) liaising with other agents, developers, solicitors, brokers, valuers, building inspectors and other professional advisers.

5. meeting our legal and regulatory obligations, including applicable anti-money laundering and counter-terrorism financing (AML/CTF) requirements;

6. verifying your identity;

7. detecting and preventing fraud and identity theft and keeping our systems secure;

8. analysing the products and services that we offer and the manner in which we engage with you;

9. communicating new or existing products or services, including through promotional or other marketing activities; and

10. consulting and collaborating with our stakeholders to ensure our products, activities and performance meet their identified needs and expectations.

To the extent we collect Sensitive Information relating to you, we will only use it:

1. for the primary purpose for which it was collected; or

2. for a secondary purpose that is directly related to the primary purpose of its collection.

For completeness, we are also permitted to use or disclose personal information for a secondary purpose if we have your consent, or the use or disclosure is required or authorised by or under an Australian law or a court/tribunal order.

6 Identity verification, DVS and biometric information

To verify your identity, we may use electronic identity verification services, including the Australian Government’s Document Verification Service (DVS).

Where you have consented, your name, date of birth and identity document details may be securely sent to the relevant Commonwealth or State authority that issued your document. This may include passport offices, driver licence authorities, the Department of Home Affairs, Births, Deaths and Marriages, or other authorised record holders.

These authorities check whether the details you have provided match the records they hold. We do not receive a copy of your government records. The authority returns a match result only, confirming whether your details match (yes or no).

This process may be carried out through accredited identity verification providers, including APLYiD (APLYiD Pty Ltd, ABN 36 632 866 794) and its authorised sub-providers.

More information about the DVS is available at idmatch.gov.au.

As part of identity verification, we may collect biometric information, such as a facial image or a short video of you holding your ID. Biometric information may be used to:

• confirm that you are a real person and physically present;

• match your image to the photograph on your identification document; and

• reduce the risk of fraud and identity theft.

Biometric information is treated as sensitive information under the Privacy Act. We only use it for identity verification and related compliance purposes, and only with your consent.

7 How do we collect your personal information?

We will generally collect your personal information directly from you whenever you interact with us, but may also collect it from your authorised representative or other third parties.

In the course of operating our business, we may collect Personal Information about you from third parties, including:

• a spouse, partner or family member;

• a company director, trustee, attorney or authorised representative;

• mortgage brokers, lenders and financial advisers;

• accountants and solicitors;

• real estate agents, developers and property managers;

• referrers and business partners; and

• publicly available sources and property databases.

If personal information is collected from a third party, we will handle that information in accordance with this Privacy Policy.

If you do not provide us with your personal information, we may not be able to provide you with our services, communicate with you or respond to your enquiries.

8 Consent to collection and identity verification

By providing your personal information and, where applicable, completing the identity verification process, you consent to:

• the collection, use and disclosure of your personal information for identity verification, AML/CTF and related compliance purposes;

• the collection and use of biometric information, such as a facial image or video, for identity verification;

• your information being checked against records held by Commonwealth and State authorities through the DVS; and

• your information being shared with our authorised identity verification providers, including APLYiD and its authorised sub-providers.

Your consent to the collection and use of biometric information and to identity verification is voluntary. You can withdraw your consent at any time by contacting us using the details in section 16.

If you do not consent, or do not provide the information we need, we may not be able to verify your identity electronically. In that case, we may need to verify your identity in another way, or we may not be able to provide our services to you.

9 How do we store and hold personal information?

We store most information about you in computer systems and databases operated by either us or our external service providers. Some information about you is recorded in paper files that we store securely.

We implement and maintain processes and security measures to protect personal information which we hold from misuse, interference or loss, and from unauthorised access, modification or disclosure. These processes and systems include:

• the use of identity and access management technologies to control access to systems on which information is processed and stored;

• requiring all employees to comply with internal information security policies and keep information secure;

• requiring all employees to complete training about information security;

• monitoring and regularly reviewing our practices against our own policies and against industry best practice; and

• secure systems, access controls, and encryption in transit and at rest where appropriate.

We will also take reasonable steps to destroy or de-identify personal information once we no longer require it for the purposes for which it was collected or for any secondary purpose permitted under the APPs. We retain personal information only for as long as we need it for the purposes set out in this Policy, or as required by law.

Sometimes individuals provide personal information even when it is neither requested nor required by us. If we receive personal information about you that is not requested or required, then we will review it and determine if it is required. If it is required, it will be deemed as requested or solicited information. Conversely, if we determine that it is not required, then we will destroy or de-identify the information as soon as practicable.

10 Who do we disclose your personal information to and why?

We may disclose your personal information to:

• employees, contractors, consultants and authorised representatives within our business, on a need-to-know basis;

• related entities;

• IT service providers, software providers, cloud storage providers and website hosts;

• marketing service providers and communications platforms;

• payment processors and accounting service providers;

• identity verification and compliance service providers, including APLYiD and its authorised sub-providers;

• Commonwealth and State authorities and official record holders through the DVS;

• insurers and business advisers;

• professional advisers, such as lawyers, solicitors, conveyancers, accountants, auditors and other advisers;

• regulatory bodies, government agencies, courts or tribunals;

• law enforcement or other third parties where required or authorised by law; and

• other third parties where disclosure is reasonably necessary for our business activities, including real estate agents, developers, vendors and their representatives, mortgage brokers, lenders, valuers, building and pest inspectors, strata consultants and other professional advisers.

We take reasonable steps to ensure that third-party service providers handling personal information on our behalf are subject to appropriate privacy and confidentiality obligations.

We may also disclose your personal information to others where:

• we are required or authorised by law to do so;

• you may have expressly consented to the disclosure or the consent may be reasonably inferred from the circumstances; or

• we are otherwise permitted to disclose the information under the Privacy Act.

If the ownership or control of all or part of our business changes, we may transfer your personal information to the new owner or operator.

We do not sell your personal information.

11 Do we disclose personal information to overseas recipients?

Generally, the information we collect is held and processed in Australia. However, some third-party service providers we use may store or process personal information outside Australia, including through cloud-based systems. Accordingly, personal information may be disclosed to recipients located overseas as part of these processes, including in the United States, the European Union, and Philippines.

Where personal information is stored or processed outside Australia, we take reasonable steps to ensure that your personal information is handled in line with the Australian Privacy Principles, including through contractual protections with our providers.

12 Do we use your personal information for marketing?

We will use your personal information to offer you products and services we believe may interest you, but we will not do so if you tell us not to.

From time to time, we may use your contact details to send you information about our services that we think may be of interest to you.

Where you receive electronic marketing communications from us, you may opt out of receiving further marketing communications by following the opt-out instructions provided in the communication or by contacting us using the details in section 16.

13 Access to and correction of your personal information

You have the right to ask for access to the personal information we hold about you, and to ask us to correct it if it is inaccurate, incomplete or out of date.

You may access or request correction of the personal information that we hold about you by contacting us. There are some circumstances in which we are not required to give you access to your personal information.

There is no charge for requesting access to your personal information, but, if necessary, we may require you to meet our reasonable costs in providing you with access, such as photocopying costs or costs for time spent on collating large amounts of material.

We will respond to your requests to access or correct personal information within a reasonable time and will take all reasonable steps to ensure that the personal information we hold about you remains accurate, up to date, complete, relevant and not misleading.

14 Data breach

Our staff are responsible for protecting the information and data we collect and are required to refer any data breaches, or suspected data breaches, to management as soon as possible, including any “Eligible Data Breach” as described under the Privacy Act.

14.1 What is an Eligible Data Breach?

An Eligible Data Breach, defined in section 26WE(2) of the Privacy Act, is when:

• both of the following conditions are satisfied:

  • there is unauthorised access to, or unauthorised disclosure of, the information; and

  • a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates; or

or

• the information is lost in circumstances where:

  • unauthorised access to, or unauthorised disclosure of, the information is likely to occur; and

  • assuming that unauthorised access to, or unauthorised disclosure of, the information were to occur, a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates.

14.2 If there is a suspicion of a breach

If we suspect that there has been an Eligible Data Breach, a reasonable and expeditious assessment will be conducted within 30 days.

If we believe, or have reasonable grounds to believe, there has been a breach, then a statement will be prepared setting out:

• our details;

• a description of the breach;

• the kind or kinds of information concerned; and

• recommendations about the steps that we will take in response to it.

If practicable, we will advise the contents of the statement to each of the affected persons who may be at risk from the breach. If this is not practicable, we will publish the statement on our website and take other reasonable steps to publicise its contents. Communications with individuals will be via their preferred communication method.

The statement will be submitted to the Australian Information Commissioner.

14.3 Exception to reporting

Mandatory notification requirements are waived if remedial action can be taken that results in a reasonable person concluding that the access or disclosure is not likely to result in serious harm to any of those individuals.

15 Complaints

If you have a complaint about the way in which we have handled any privacy issue, including your request for access or correction of your personal information, you should contact us using the details set out below.

We will acknowledge your complaint, consider it, investigate it where required, and respond to you within a reasonable time. We will notify you of the outcome of the investigation and any subsequent internal investigation.

If you remain unsatisfied with the way in which we have handled a privacy issue, you may approach an independent adviser or contact the Office of the Australian Information Commissioner (OAIC) at https://www.oaic.gov.au for guidance on alternative courses of action that may be available.

16 Contact details

If you have any questions, comments, requests or concerns about this Policy, or want to exercise any of your privacy rights, please contact us:

• Business name: Charman Property Co Pty Ltd

• Privacy contact: Jamie / Privacy contact

• Email: jamie@charmanproperty.com.au

• Phone: [Insert phone]

• Address: 1/172 Robertson Street, Fortitude Valley QLD 4006

17 Changes to this Policy

From time to time, we may change our policy on how we handle personal information or the types of personal information that we hold. Any changes to our policy will be published on our website.

A current version of this Policy will be available on our website or may be obtained by contacting us at the contact details above. Where changes are significant, we will let you know.

Charman Property Co Pty Ltd ACN 638 306 019 respects your privacy and complies with the Privacy Act 1988 (Cth) and Australian Privacy Principles.

We collect personal information:

• directly from you

• via your interactions with our website

• from authorised representatives or third parties

We collect information to:

• provide products and services

• respond to enquiries

• carry out business operations

• meet legal obligations

If information is incomplete, we may not be able to provide services.

We may disclose information to:

• employees and contractors

• related entities

• IT and software providers

• other relevant third parties

Some data may be processed overseas, including in the United States, European Union and Philippines.

For full details, refer to our Privacy Policy.

To contact us:
Email: jamie@charmanproperty.com.au
Post: 1/172 Robertson Street, Fortitude Valley QLD 4006