PRIVACY POLICY & COLLECTION NOTICE

Part A - Privacy Collection Notice

This collection notice explains how we collect personal information in connection with our real estate agency business. It should be provided before, or at the time, personal information is collected where practicable. If this is not practicable, it should be provided as soon as practicable after collection.

Who collects your information?

J Nguyen Property Pty Ltd (ABN 50 603 285 187, ACN 603 285 187, Corporation Licence No. 10077517), trading as J Nguyen Property Agents, collects your personal information. The Privacy Officer is Jade Vuong, General Manager and can be contacted at [email protected] or (02) 9779 0866.

Why do we collect your information?

·        To provide real estate sales, buyer-related services where offered, leasing, property management, appraisal, inspection, auction, marketing campaign and related services.

·        To identify and communicate with you about a property, enquiry, inspection, appraisal, auction, tenancy, agency agreement, marketing package, payment, refund or transaction.

·        To act for our clients under agency agreements and manage dealings with vendors, purchasers, landlords, tenants, applicants, bidders, representatives, solicitors, conveyancers, brokers, service providers and other transaction parties.

·        To comply with privacy, NSW real estate, auction bidder registration, trust money, record keeping, residential tenancy and other legal obligations.

·        On and from 1 July 2026, where we provide a real estate designated service, to comply with AML/CTF customer due diligence and related obligations, including identity verification, authority-to-act checks, beneficial ownership checks, sanctions and PEP screening, targeted financial sanctions screening, risk assessment, enhanced due diligence where required, ongoing due diligence and AML/CTF record keeping.

·        To process agreed fees, commission, campaign costs, third-party costs, disbursements and service charges under a written agency agreement or other written authority.

·        To send service and transaction communications needed to respond to or provide a requested service, and to send property alerts, market updates or other marketing communications where permitted by law and, where required, with your consent. You may opt out of marketing communications at any time.

Is collection required or authorised by law?

Some personal information is collected because it is required or authorised by Australian law. Depending on the service, relevant laws may include the Property and Stock Agents Act 2002 (NSW) and Property and Stock Agents Regulation 2022 (NSW), including auction bidder registration, trust money and agent record requirements; the Residential Tenancies Act 2010 (NSW) and Residential Tenancies Regulation 2019 (NSW) where leasing or property management applies; and the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (as amended) for designated services. Collection may also be required or authorised for sanctions compliance, AUSTRAC or other regulator requirements, and court or tribunal processes. Other information is collected because it is reasonably necessary for us to provide the service you request.

What information do we collect?

·        Name, contact details, residential address, postal address, email address, phone number, occupation and date of birth.

·        Property details, ownership details, property interests and information about the property you are selling, buying, leasing, managing, occupying, inspecting or enquiring about.

·        Identity document details and verification information, including document numbers, expiry dates, issuing authority and verification outcomes. We may need to sight or temporarily receive a copy or image of an identity document where reasonably necessary for verification. For AML/CTF record keeping, we generally retain the required identity details and verification record rather than a full copy of the identity document, unless another lawful purpose requires or authorises the copy to be retained.

·        Authority-to-act information, including powers of attorney, company officer details, trustee details, representative details, written authorities and other evidence of authority.

·        For companies, trusts and other non-individual customers: entity details, officeholders, trustees, beneficiaries, beneficial owners, control information and information about the nature and purpose of the relationship or transaction.

·        AML/CTF risk assessment information, which may include source of funds or source of wealth information where required by law or our risk assessment.

·        Bank account details, billing information, trust/account information, income, employment details, tenancy application information, household or occupant details, referees, references, guarantor details and emergency contact details where relevant.

·        Inspection, open home, auction and communication records, including attendance records, bidder registration records, emails, forms, notes, call records, messages and correspondence.

·        Website, device and technology information including IP address, browser type, device information, cookies, website usage data, analytics and online enquiry information.

·        Sensitive information only where required or authorised by law, or where you have given express consent and it is reasonably necessary for our functions or activities. We do not treat general income, financial capacity or creditworthiness as sensitive information under the Privacy Act unless it falls within a sensitive information category, but we handle it carefully.

How do we collect information?

·        Directly from you through forms, website enquiries, emails, phone calls, messages, inspections, open homes, auctions, agency agreements, tenancy applications, property management documents, AML/CTF verification workflows and other communications.

·        From authorised representatives, including solicitors, conveyancers, settlement agents, brokers, accountants, attorneys, family members, company officers, trustees or other authorised people.

·        From identity verification providers, AML/CTF screening providers, property portals, inspection platforms, application platforms, CampaignAgent, REA Group, Domain, property management platforms and other service providers.

·        From public registers and public sources, including NSW Land Registry Services, ASIC registers, court or tribunal records, government databases and other lawful sources.

·        From vendors, purchasers, landlords, tenants, referees, employers, financiers, insurers, contractors, valuers, surveyors, strata managers and other parties connected with a real estate service or transaction.

Who may we share information with?

·        AUSTRAC, NSW Fair Trading, Revenue NSW, NSW Land Registry Services, courts, tribunals, law enforcement agencies, regulators, government agencies and dispute resolution bodies where required or authorised by law.

·        Identity verification providers, AML/CTF screening providers, cloud storage providers, IT providers, cyber security providers, website providers and other service providers that help us comply with legal obligations or provide services.

·        Vendors, purchasers, landlords, tenants, applicants, bidders, referees, employers, representatives, solicitors, conveyancers, settlement agents, brokers, accountants, financiers and authorised agents.

·        Auctioneers, valuers, surveyors, pest and building inspectors, insurers, claim assessors, photographers, stylists, contractors, trades, property managers and other property-related service providers.

·        REA Group, Domain, CampaignAgent, inspection and application platforms, property management platforms, marketing providers, mailing providers and communication providers.

·        Professional advisers, auditors, insurers, debt collection agencies, external complaints bodies and a purchaser or proposed purchaser of all or part of our business where relevant.

Overseas disclosure

We may use cloud, website, email, CRM, inspection, property management, marketing, analytics, storage and identity verification systems that are located in Australia or accessed from overseas. Based on information reasonably available to us, likely overseas locations include New Zealand and the United States of America. Other countries may become relevant if provider configurations or subprocessors change. Where APP 8 applies, we take the reasonable steps required by law before disclosing personal information overseas, unless a Privacy Act exception applies. We keep internal records of material providers and known overseas handling locations and review them when providers or configurations materially change.

What happens if you do not provide information?

If you do not provide requested information, we may be unable to verify identity, conduct required AML/CTF checks, comply with sanctions or targeted financial sanctions obligations, facilitate inspection access where information is reasonably required for access, safety, security or another lawful purpose, register you as a bidder, process a tenancy application, prepare or perform an agency agreement, order marketing, manage a property, process a payment or refund, proceed with a sale or purchase process, or provide the requested service.

Your privacy rights

You may request access to or correction of your personal information by contacting the Privacy Officer at [email protected] or (02) 9779 0866. The Privacy Policy below explains how to make a privacy complaint and how complaints are handled. It is available at https://www.jnguyenproperty.com.au/privacy-policy-and-collection-notice and at our office on request.

Part B - Privacy Policy

1. Purpose and application

This Privacy Policy explains how we manage personal information in connection with our real estate agency business, including sales, buyer-related services where offered, leasing, property management, appraisals, inspections, auctions, marketing campaigns, agency agreements, trust/account administration, customer due diligence and related business operations.

This policy applies to personal information collected through our website, office, inspections, open homes, auctions, forms, agreements, applications, phone calls, emails, messages, social media, property portals, service providers and other lawful channels.

This policy should be read together with any Website Privacy Policy and any point-of-collection notice provided at https://www.jnguyenproperty.com.au or during our service process. It describes our privacy handling practices; the Privacy Act 1988 (Cth) and Australian Privacy Principles apply to the extent required by law, including to personal information handled for or in connection with AML/CTF activities where applicable. Nothing in this policy expands or limits a right or obligation imposed by law. This policy and our collection notices are transparency documents, not contracts or blanket consent mechanisms. Where consent is legally required for a particular collection, use or disclosure, we seek that consent separately and for the relevant purpose.

2. Key privacy definitions

Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether recorded in a material form or not.

Sensitive information includes categories such as health information, racial or ethnic origin, political opinions, religious beliefs, membership of certain associations, sexual orientation, biometric information and criminal record information, as defined by the Privacy Act.

Sensitive information is handled only where required or authorised by law, or where express consent has been obtained and the information is reasonably necessary for our functions or activities.

3. Collection principles

We collect personal information only where reasonably necessary for our functions or activities, required or authorised by law, or otherwise permitted by the Privacy Act.

·        We collect sensitive information only with express consent or where required or authorised by law or another Privacy Act exception applies.

·        If biometric information is proposed for automated identity verification or identification (for example, a selfie, facial match or liveness check), we collect or use it only where it is necessary and proportionate, and with the individual's consent unless a lawful exception applies. We provide a specific collection notice before that biometric collection where required.

·        For AML/CTF personnel due diligence, we collect, record and use only information reasonably necessary for that purpose. Sensitive or other personal information encountered incidentally is not recorded or used for AML/CTF personnel due diligence unless reasonably necessary and lawfully permitted, subject to applicable law and any employee-record exemption.

·        Where reasonable and practicable, we collect personal information directly from the individual.

·        If we receive unsolicited personal information that we could not lawfully collect, we take reasonable steps to destroy or de-identify it where required by the Privacy Act.

·        We take reasonable steps to keep personal information accurate, up to date, complete, relevant and not misleading before using or disclosing it.

4. Kinds of personal information we hold

Contact, identity and communication details.

·        Property, ownership, tenancy, inspection, auction and transaction information.

·        Agency agreement, marketing campaign, billing, trust/account and payment information.

·        Identity document details, verification results, authority-to-act information, beneficial ownership information and AML/CTF risk assessment information. Full copies or images of identity documents are retained only where reasonably necessary and permitted, required or authorised by law, and are not automatically treated as seven-year AML/CTF records.

·        Rental application, employment, income, referee, guarantor, household, emergency contact and tenancy-related information where relevant.

·        Records of communications, file notes, forms, complaints, disputes, audit records and compliance checks.

·        Website, device, technical, cookie and analytics information.

·        Sensitive information only where permitted, required or expressly consented to.

5. How personal information is collected and held

Personal information may be collected directly from you, from authorised representatives, from service providers, from public registers and from other lawful sources connected with the service or transaction.

Information may be held in physical files, secure electronic files, cloud systems, CRM systems, email systems, property management systems, inspection platforms, identity verification systems, marketing systems and archive systems.

We may combine information from different sources where reasonably necessary to verify identity, confirm authority to act, manage a transaction, provide a service, maintain records, comply with law or protect safety and security.

6. Use and disclosure

We use and disclose personal information to provide real estate services, manage our business, comply with laws, communicate with you, protect safety and security, resolve disputes, manage risk, perform customer due diligence, maintain records and carry out related functions you would reasonably expect.

We only disclose personal information where it is reasonably necessary for our functions or activities, where you have consented, where required or authorised by law, or where another Privacy Act exception applies.

7. Sales, buying and auction services

To identify and verify vendors, purchasers, bidders, authorised representatives and relevant transaction parties.

·        To conduct appraisals, prepare agency agreements, market properties, arrange inspections, manage enquiries, conduct auctions and support sale administration.

·        To liaise with vendors, purchasers, solicitors, conveyancers, brokers, settlement agents, strata managers, building and pest inspectors, valuers, surveyors, contractors and other relevant parties.

·        To manage deposit, trust, accounting, statement, contract, auction and settlement-related administration within the scope of our role as real estate agent.

·        To comply with NSW property laws, agency agreement requirements, auction requirements, bidder record requirements, trust money requirements, record keeping and AML/CTF obligations.

8. Property management and leasing services

To identify and verify landlords, tenants, applicants, guarantors, authorised representatives and property-related parties.

·        To process tenancy applications, contact referees, verify information, conduct inspections, manage leases, collect rent, arrange repairs, manage bonds and prepare statements or records.

·        To communicate with landlords, tenants, applicants, employers, previous agents, contractors, insurers, tribunals and other relevant parties.

·        To comply with residential tenancy, rental bond, safety, trust/accounting, record keeping and legal obligations.

·        Where we use a residential tenancy database to assess a tenancy application, we disclose that use where appropriate and comply with Part 11 of the Residential Tenancies Act 2010 (NSW), including any required notice if an applicant is found to be listed.

9. AML/CTF customer due diligence

On and from 1 July 2026, where we provide designated real estate services with a geographical link to Australia, we must comply with AML/CTF obligations.

·        Before providing a designated service, except where delayed initial customer due diligence is lawfully available, we collect and verify the information required to know our customer, confirm authority to act, identify beneficial owners, assess ML/TF/PF risk and meet ongoing due diligence, record-keeping and reporting obligations.

·        CDD may apply to individual and non-individual customers, vendors, purchasers, authorised representatives, beneficial owners and other relevant parties depending on the service and transaction. For a seller's agent, the seller generally becomes the customer when the agreement to broker the sale or transfer is signed. The buyer generally becomes a customer when it is reasonably expected that the transaction will proceed, typically when the offer has been accepted and the contract is signed. At auction, this will ordinarily be the successful buyer. We rely on delayed initial CDD only where permitted by the AML/CTF Act and Rules and, before starting the designated service, we determine on reasonable grounds that both delaying CDD is essential to avoid interrupting the ordinary course of business and there is a low additional ML/TF/PF risk from the delay. Delayed CDD must then be completed as soon as reasonably practicable and within the applicable AML/CTF Rules timeframes. Our AML/CTF procedures, rather than this privacy policy, govern the detailed operational deadlines and controls.

·        CDD may include identity verification, authority-to-act checks, beneficial ownership checks, PEP and sanctions screening, targeted financial sanctions checks, risk assessment, enhanced due diligence where required, ongoing due diligence and record keeping.

·        We may collect information about the nature and purpose of the business relationship or transaction, and source of funds or source of wealth information where required by law or our risk assessment.

·        We may disclose information to AUSTRAC and other authorised bodies where required or authorised by law. We may be legally restricted from disclosing some reporting, investigation or enforcement-related information.

·        If a customer or counterparty does not cooperate with required CDD, we may record the steps taken, restrict or decline the service, and take other compliance action required or authorised by AML/CTF law. We may be legally restricted from explaining certain reporting, investigation or enforcement-related actions.

·        We keep AML/CTF records for the period required by law, generally at least seven years where the applicable record-keeping requirement applies. The AML/CTF Act does not itself require us to retain scanned copies or photocopies of identity documents for record-keeping purposes. We generally retain the identity details, document type, verification process and outcome, and other records required to demonstrate compliance, rather than retaining a full identity document copy solely for AML/CTF record keeping.

10. Government identifiers and identity documents

We may collect and verify government-related identifiers and identity documents, such as a driver licence, photo card, passport or other government-issued identity document or identifier, where reasonably necessary for identity verification, bidder registration, trust/account administration, tenancy, legal or AML/CTF compliance purposes. Where practical, we sight or verify the document and retain only the minimum details and verification evidence needed for the relevant purpose.

·        We do not adopt a government-related identifier as our own identifier unless an APP 9 exception or another applicable law permits it. We use or disclose a government-related identifier only where APP 9 or another applicable law permits, including where reasonably necessary to verify identity for a lawful function or activity. Consent alone does not authorise an otherwise prohibited adoption, use or disclosure.

·        Identity documents are handled carefully and access is limited to people and providers who need them for lawful verification, service delivery or compliance. If a full copy or image is collected, we take reasonable steps to securely destroy or de-identify it once it is no longer needed for a purpose for which we may lawfully hold it, unless an Australian law or a court or tribunal order requires or authorises continued retention. We also take reasonable steps to ensure service-provider retention settings do not retain full ID copies longer than needed.

·        If an identity verification process uses biometric information, including a selfie, facial matching, liveness detection or a biometric template, that information is treated as sensitive information. We provide the information required by APP 5 and obtain consent where required unless a lawful exception applies.

11. Website, cookies and third-party links

Our website may collect technical information such as IP address, browser type, device details, pages visited, referring site, date and time of access, cookies, pixels, tags and analytics data.

Cookies and similar technologies may help us operate the website, remember form information where applicable, measure website activity, maintain security and support business reporting. Where tracking information is personal information, we handle it in accordance with this policy and applicable law.

You can usually disable cookies through your browser settings, although some website or platform functions may not work correctly if cookies are disabled.

Our website may link to third-party websites or platforms. Those websites and platforms are not controlled by us and are governed by their own privacy policies and terms.

12. Direct marketing

Service communications reasonably necessary to respond to an enquiry, arrange an inspection, administer an appraisal, manage a transaction or provide a requested service are distinct from optional marketing. We use personal information for property alerts, market updates and promotional material only where permitted by APP 7, the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth) and other applicable law, and where the required express or lawful inferred consent exists.

·        A general enquiry, appraisal request, inspection registration or completed property transaction does not by itself amount to consent to unrelated ongoing electronic marketing. Where marketing is requested, such as Buyer Alerts, or consent is otherwise obtained or lawfully inferred, we limit marketing to the scope reasonably covered by that consent. Where practicable, we use a separate marketing opt-in and keep records showing when, how and for what purpose consent was obtained.

·        You can opt out of marketing at any time. Commercial electronic messages will identify the sender and include a functional unsubscribe method that does not charge a fee, does not require an account login, and does not require additional personal information beyond what is reasonably necessary to process the opt-out. We action Spam Act unsubscribe requests within 5 working days and keep the unsubscribe facility functional for the legally required period. For direct marketing to which APP 7 applies, requests to stop direct marketing or to stop using or disclosing information to facilitate another organisation's direct marketing are given effect within a reasonable period and free of charge. If you ask for the source of personal information used or disclosed for direct marketing, we notify you within a reasonable period and free of charge unless it is impracticable or unreasonable to do so.

13. Anonymity and pseudonymity

Where APP 2 applies, you may deal with us anonymously or using a pseudonym unless we are required or authorised by law to deal with an identified individual, or it is impracticable for the particular dealing to proceed without identification. This generally allows anonymous or pseudonymous general enquiries and website browsing.

Identification is commonly required for bidder registration, agency agreements, tenancy or transaction services, identity verification and AML/CTF-regulated services. For inspections and open homes, the information reasonably required depends on the circumstances; we collect only what is reasonably necessary for access, safety, security, service delivery or another lawful purpose, and we do not require identification where APP 2 requires an anonymous or pseudonymous option.

14. Automated decision making

We may use website, CRM, form, inspection, identity verification, AML/CTF screening or other systems to automate administrative steps, compare information, produce verification results or generate risk flags. We assess these arrangements against the privacy-law requirements applying to automated decisions and do not rely on this policy to imply that every automated output receives human review.

From 10 December 2026, APP 1 contains additional privacy-policy transparency obligations where an APP entity has arranged for a computer program to make, or do something substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual's rights or interests and personal information is used in that process. Before that date, and whenever relevant systems materially change, we will assess our arrangements and, where those provisions apply, update this policy to describe the kinds of personal information used and the kinds of decisions involved.

15. Information security

We take reasonable steps in the circumstances, including appropriate technical and organisational measures, to protect personal information from misuse, interference, loss, unauthorised access, modification and disclosure.

Technical and organisational measures may include secure storage, access controls, strong authentication and multi-factor authentication where appropriate, confidentiality obligations, staff training, privacy and security procedures, provider due diligence, secure document handling, cyber security controls, backup and recovery procedures, and secure destruction or de-identification.

No internet transmission or electronic storage method can be guaranteed to be completely secure.

16. Data breaches

If we suspect a data breach, we will take reasonable steps to contain, assess and respond to the incident. Where required under the Notifiable Data Breaches scheme, we will take reasonable steps to complete an assessment expeditiously and within 30 days.

Where a breach is an eligible data breach under the Notifiable Data Breaches scheme, we prepare the statement required by law and provide it to the OAIC as soon as practicable. We then notify the individuals required by law, or, if direct notification options are not practicable, publish the statement on our website and take reasonable steps to publicise its contents. Notifications include the information and recommended response steps required by law.

We may also notify regulators, insurers, service providers or professional advisers where appropriate and lawful to manage the incident and reduce harm.

17. Retention and disposal

We retain personal information only for as long as it is needed for a purpose for which we may lawfully hold it, such as providing the requested service, meeting legal or regulatory obligations, resolving disputes, or maintaining records where there is a lawful basis to do so.

AML/CTF records are retained for the period required by law, generally at least seven years where the relevant record-keeping rule applies. A full scanned or photocopied identity document is not automatically part of that seven-year retention requirement merely because it was used for AML/CTF verification.

When personal information is no longer required for any purpose for which we may lawfully hold it, we take reasonable steps to destroy or de-identify it unless an Australian law, court or tribunal order requires or authorises continued retention. This includes taking reasonable steps to destroy or de-identify full copies or images of identity documents once they are no longer needed.

18. Overseas disclosure

We may store or process personal information using cloud, email, website, CRM, inspection, property management, marketing, analytics and identity verification systems that are located or accessed outside Australia.

Based on information reasonably available to us, likely overseas locations include New Zealand and the United States of America. Other countries may become relevant if systems, provider configurations or subprocessors change. We keep internal records of material providers and known overseas handling locations and review them when material arrangements change.

Where APP 8 applies, we take the reasonable steps required by law before disclosing personal information to an overseas recipient, unless a Privacy Act exception applies. If informed consent is relied upon for a particular disclosure, that consent is sought for that disclosure rather than assumed from use of our services.

19. Access and correction

You may request access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading.

Requests should be made in writing to the Privacy Officer. We may need to verify your identity and may refuse access or correction where permitted by law.

If we refuse access or correction, we will provide reasons where required. We aim to respond within a reasonable time and generally within 30 days where practicable.

20. Privacy complaints

If you have a privacy complaint, please contact the Privacy Officer first. We will acknowledge, assess and respond to the complaint within a reasonable time, generally within 30 days where practicable.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC). OAIC phone enquiries: 1300 363 992. OAIC privacy complaints and online forms: https://www.oaic.gov.au/privacy/privacy-complaints. OAIC post: GPO Box 5288, Sydney NSW 2001.

21. Changes to this policy

We may update, revise or replace this policy and collection notice from time to time. Changes take effect when published on our website or otherwise notified.

You should check the website periodically for the latest version. We will complete a specific automated-decision review by 10 December 2026 and otherwise review this document at least annually, and earlier if laws, services, technology providers, overseas storage, marketing practices or AML/CTF procedures materially change.

22. Contact details

The Office of the Information Commissioner can be contacted as

follows:

23. Acceptance of this Privacy Policy and Collection Notice

By using this website, accessing any of our products, services or features, the user acknowledges that it has read, understands and accepts this Privacy Policy and the permissions to collect, use and disclose personal information, and the user authorises us to collect, use and disclose, in accordance with the Act, their personal information for the purposes specified in this Privacy Policy. This Privacy Policy and collection notice last updated on 24^th August 2026.

Legislative and regulatory references

·        Privacy Act 1988 (Cth), including the Australian Privacy Principles, the Notifiable Data Breaches scheme, and the automated-decision privacy policy provisions commencing on 10 December 2026 as introduced by the Privacy and Other Legislation Amendment Act 2024 (Cth).

·        Office of the Australian Information Commissioner APP Guidelines, including APP 1 through APP 13, and OAIC privacy guidance for reporting entities under the AML/CTF Act, updated 7 August 2026.

·        Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (as amended), and current AUSTRAC guidance for real estate designated services applying on and from 1 July 2026.

·        Property and Stock Agents Act 2002 (NSW).

·        Property and Stock Agents Regulation 2022 (NSW), including agency agreement, auction, bidder record, trust money, records and conduct requirements.

·        Residential Tenancies Act 2010 (NSW) and Residential Tenancies Regulation 2019 (NSW), where property management or leasing services are provided.

·        Spam Act 2003 (Cth) and Do Not Call Register Act 2006 (Cth).

·        Competition and Consumer Act 2010 (Cth), Schedule 2 - Australian Consumer Law, where applicable.

·        NSW Fair Trading guidance for real estate agents, auction bidder registration, agency agreements and property professionals.