Privacy Policy

1. Personal Information We Collect

We collect personal information necessary to provide our services, including:

• Identity Data: Name, job title, or company name.
• Contact Data: Email address, phone number, and postal/business address where provided.
• Professional Data (agents only): Agency name, agency postcode, and real estate licence number.
• Inquiry Data: Information you provide when you contact us, register interest, or submit a form (including the message content and the topic of your inquiry).
• Technical Data: IP address, browser type, device information, referring page, and similar information collected automatically by our servers and via cookies/local storage.

Sensitive information: We do not knowingly collect sensitive information (such as health, racial, political or religious information) as defined in section 6 of the Privacy Act, and we ask that you do not include such information in form submissions.

2. How We Collect Your Information

We collect information through two primary methods:

• Direct Interaction: When you fill out a form on our website, join a waitlist, register as an agent, or correspond with us by email or phone.
• Automated Technologies: Technical data collected as you interact with our website via cookies, local storage, and server logs (including for security, spam prevention, and rate limiting).

Children: Our website and services are not directed at people under the age of 18 and we do not knowingly collect personal information from minors.

3. Purpose of Collection

We collect, hold and use your personal information for the following purposes:

• To respond to your inquiries and provide the information or services you have requested.
• To manage waitlists and notify you when our platform or specific features launch.
• To verify agent registrations and conduct related due diligence.
• To operate, maintain, secure and improve our website (including spam prevention, abuse detection and rate limiting).
• To send transactional communications (such as confirmation emails and account-related notices).
• To send marketing communications where you have consented, and to comply with the Spam Act 2003 (Cth).
• To comply with our legal and regulatory obligations.

If you choose not to provide information: Some fields on our forms are mandatory. If you do not provide them, we may be unable to add you to a waitlist, verify your agent registration, or respond to your inquiry.

4. Disclosure of Your Information

We do not sell your personal information. We may disclose your information to:

• Service providers who help us operate the website and our services, including cloud hosting and database providers, transactional email providers, and spam protection providers (see Section 5).
• Professional advisers such as lawyers, accountants and auditors, where reasonably necessary.
• Government, regulatory or law-enforcement authorities where we are required or authorised by law to do so.
• A purchaser or successor in the event of a sale, merger or restructure of our business, subject to appropriate confidentiality obligations.

5. Overseas Disclosure (APP 8)

Our infrastructure is hosted in Australia (AWS Asia Pacific — Sydney region). However, some of the providers we use are headquartered or operated overseas, and personal information may be accessed from, or processed in, countries outside Australia in the course of providing their services.

The recipients (and their likely countries) include:

• Amazon Web Services, Inc. — cloud hosting, database and email delivery (Amazon SES). Data is stored in the Sydney region; support and corporate access may occur from the United States.
• Google LLC — reCAPTCHA spam protection on our forms. Data may be processed in the United States and other countries where Google operates.

Where we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles. By using our website and forms you acknowledge these overseas disclosures.

6. Data Security

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These measures include encryption in transit (HTTPS/TLS), encryption of database connections, server-side rate limiting, spam protection, restricted administrative access, and secure credential management.

No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your information, we cannot guarantee its absolute security.

7. Data Retention

We retain personal information for as long as it is needed for the purposes described in this policy, and in particular:

• Waitlist and contact form submissions are retained until you ask us to delete them, or until we determine the information is no longer needed.
• Audit, security and submission logs (including IP addresses) are retained for a reasonable period to detect and investigate fraud, abuse and security incidents.
• Records required by law (for example, financial or tax records) are retained for the period required by the applicable law.

When personal information is no longer needed and we are not legally required to retain it, we will take reasonable steps to destroy or de‑identify it (APP 11.2).

8. Notifiable Data Breaches

We comply with the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act. If we become aware of an eligible data breach that is likely to result in serious harm to any individual whose personal information is involved, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable.

9. Your Rights — Access and Correction (APP 12 & 13)

You have the right to:

• Access the personal information we hold about you.
• Request correction of any information that is inaccurate, out-of-date, incomplete, irrelevant or misleading.
• Request deletion of your information where we are not required to retain it.
• Withdraw consent to marketing communications at any time.

To make a request, email privacy@rightcommercial.com.au with the subject line "Privacy Request" and enough information to allow us to verify your identity and locate your records. We will respond within 30 days. There is no fee to make a request, although we may charge a reasonable fee for complex access requests (we will notify you before incurring any cost).

If we refuse a request, we will provide written reasons and information about how you may complain.

10. Complaints

If you believe we have breached the Australian Privacy Principles or otherwise mishandled your personal information, please contact our Privacy Officer at privacy@rightcommercial.com.au with the subject line "Privacy Complaint". Please include enough detail for us to investigate.

Our process:

• We will acknowledge your complaint within 5 business days.
• We will investigate and aim to provide a substantive response within 30 days.
• If the matter is complex, we will keep you informed of progress and expected timeframes.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC):
Website: www.oaic.gov.au
Phone: 1300 363 992
Post: GPO Box 5288, Sydney NSW 2001

11. Cookies and Online Tracking

We use cookies and similar browser storage technologies (such as localStorage) to operate our website, remember your preferences, and protect against abuse.

• Essential storage: Used for site security, spam protection, and remembering your cookie preferences. These cannot be disabled.
• Analytics & marketing storage: Only used if you give consent via our cookie banner. You can change your preference at any time by clearing your browser storage for this site, or by contacting us.

You can also configure your browser to refuse cookies, but some site functionality (such as form submission) may not work correctly.

12. Spam Protection (Google reCAPTCHA)

We use Google reCAPTCHA on our forms to protect against spam and automated abuse. reCAPTCHA collects hardware and software information (such as device and application data) and sends it to Google for analysis. reCAPTCHA is treated as essential to the operation and security of our forms.

Your use of reCAPTCHA is subject to Google's Privacy Policy and Terms of Service.

13. Direct Marketing and Your Right to Opt-Out

We may send you commercial property updates, market reports or platform announcements where you have provided consent (including by joining a waitlist).

Unqualified Right to Opt-Out: You have an absolute right to stop marketing communications at any time.

How to opt out: Use the "unsubscribe" link in our marketing emails, or email privacy@rightcommercial.com.au with "Unsubscribe" in the subject line.

Requests are processed within 5 business days as required by the Spam Act 2003 (Cth). Transactional emails (such as confirmation of a form submission) are not marketing and will continue to be sent where necessary.

14. Changes to this Policy

We may update this Privacy Policy from time to time. The "Last Updated" date at the top of this page will reflect the most recent revision. Material changes will be communicated via a prominent notice on our website or by email where appropriate. Your continued use of our website after a change indicates your acceptance of the updated policy.

15. Contact Us

For any questions regarding this policy, your personal data, or to make a privacy request: