Buy Right Advocates (Nicolas Zoumis, ABN 38 370 052 891) is committed to protecting your personal information and handling it responsibly. This Privacy Policy explains what personal information we collect, why we collect it, how we use and store it, and when we may be required to disclose it.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). In addition, as a registered reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act), we have specific legal obligations regarding the collection, verification and retention of certain personal information. This policy explains both sets of obligations.

By engaging our services or using our website, you consent to the collection and use of your personal information as described in this policy.

Buy Right Advocates is a licensed buyers advocacy business operating in Victoria and Queensland. Our services include property search, evaluation and negotiation on behalf of buyers. We are licensed under the applicable real estate legislation in Victoria and Queensland and are enrolled as a reporting entity with AUSTRAC (the Australian Transaction Reports and Analysis Centre).

• Business: Buy Right Advocates

• Principal: Nicolas Zoumis

• ABN: 38 370 052 891

• Phone: 0450 234 700

• Email: hello@buyrightadvocates.homes

• Website: buyrightadvocates.homes

We collect different types of personal information depending on how you interact with us.

3.1 Website visitors

When you visit our website, we may automatically collect non-identifying information including your general geographic location, the pages you visit, and how you use the site. This information is used to improve our website and may be used to display relevant advertising. See Section 10 (Cookies) for more detail.

If you contact us through the website or by email, we collect your name, email address, phone number and the details of your enquiry.

3.2 Buyers advocacy clients

To provide our buyers advocacy service and to comply with our legal obligations, we collect the following personal information from clients:

• Full legal name, date of birth, residential address and contact details

• Country of citizenship and occupation

• Government-issued photo identification (type, number and expiry date)

• For companies: company name, ACN, registered address, director details and details of persons who own or control 25% or more of the company

• For trusts and SMSFs: trust name, type, trustee and appointor details, number of members

• Whether you are acting on behalf of another person or entity

• Politically exposed person (PEP) status — whether you currently hold or have previously held a prominent public position, or are a close associate or family member of such a person

• Purpose of property purchase

• Source of funds for the purchase (how the purchase money is being funded)

• Source of wealth (how you accumulated your overall assets)

• Whether any part of the purchase price involves cash or overseas funds

• Property brief and purchasing criteria

• Fee and engagement details

Why we collect this information: The collection of identity documents and financial information is required by the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). As a reporting entity, we are legally required to verify your identity and understand the nature and purpose of our business relationship before we provide any service. This is a legal obligation, not optional.

We collect personal information:

• Directly from you when you complete our Buyer Engagement and AML/CTF Form at the commencement of our engagement

• From identity documents you provide to us (driver's licence, passport or other government-issued photo ID)

• Through correspondence by email, telephone or in person

• From our website when you submit an enquiry or book a consultation

• From publicly available sources where necessary to verify information you have provided

We will only collect personal information that is necessary for the purposes described in this policy. Where possible, we collect personal information directly from you.

We collect and use personal information for two primary purposes.

5.1 To provide our buyers advocacy services

• To understand your property requirements and purchasing criteria

• To identify and evaluate suitable properties on your behalf

• To negotiate and assist with the purchase of property on your behalf

• To manage the engagement and process fees

• To communicate with you throughout the property search and purchase process

• To refer you to relevant third-party professionals including conveyancers, solicitors, mortgage brokers and inspectors

5.2 To comply with our legal obligations

• To verify your identity before providing any designated service, as required by the AML/CTF Act

• To assess the nature and purpose of our business relationship

• To monitor transactions and detect suspicious activity

• To report certain matters to AUSTRAC as required by law (see Section 7)

• To retain records as required by the AML/CTF Act and other applicable laws

If you contact us or engage our services, we may send you information about our services, educational content, or relevant property market information. You may opt out of receiving marketing communications at any time by contacting us at hello@buyrightadvocates.homes or by following the unsubscribe link in any email we send you.

We do not sell, rent or trade your personal information to third parties for marketing purposes.

We do not disclose your personal information to third parties except in the following circumstances.

7.1 Service providers

We may share relevant information with third-party professionals involved in your property purchase — including conveyancers, solicitors, mortgage brokers, building and pest inspectors, and valuers — to the extent necessary to provide our service. These parties are independent of Buy Right Advocates and are subject to their own privacy obligations.

7.2 Legal and regulatory obligations

We may be required to disclose personal information to comply with our legal obligations, including:

• AUSTRAC: As a reporting entity under the AML/CTF Act, we are required to submit Suspicious Matter Reports (SMRs) and other reports to AUSTRAC where required by law. We may be legally prohibited from telling you that a report has been made — this is known as the tipping-off prohibition and is a requirement of the AML/CTF Act, not a discretionary decision.

• Other regulatory bodies: We may be required to disclose information to Consumer Affairs Victoria, the Real Estate Institute, or other regulatory bodies in connection with our licensing obligations.

• Law enforcement: We may be required to disclose information in response to a lawful request from a law enforcement agency or court order.

Please note: If we are required to submit a report to AUSTRAC, we are prohibited by law from informing you that the report has been made or that a suspicion exists. This is a legal obligation under the AML/CTF Act and is not within our discretion.

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification or disclosure.

Personal information is stored electronically in Proton Drive, which applies end-to-end encryption by default. This means your information is encrypted on our device before it is transmitted and only accessible with our account credentials and two-factor authentication. Even the storage provider cannot access the content of our files.

Physical documents including identity documents provided in hard copy are stored securely and are accessible only to authorised personnel of Buy Right Advocates.

When personal information is no longer needed for the purpose for which it was collected and any required retention period has expired, it is destroyed or de-identified securely.

We retain personal information for as long as necessary to provide our services and comply with our legal obligations. The retention periods are:

• AML/CTF records (identity documents, engagement forms, transaction monitoring notes, SMR records): minimum seven years from the date of the transaction or the end of the business relationship, as required by the AML/CTF Act

• Client engagement records and correspondence: seven years from the end of the engagement

• Website enquiry information: retained only as long as necessary to respond to your enquiry, unless you become a client

After the applicable retention period, records are permanently deleted or destroyed.

Our website uses cookies to record information about how visitors use the site. Cookies are small text files placed on your device. They do not identify you personally but record activity and preferences to help us improve the site.

We use Google Analytics to understand how visitors use our website. This may include your general geographic location and the pages you visit. We may also use Google's advertising features including remarketing, which allows us to show relevant advertising to visitors as they browse other websites in the Google Display Network.

You can opt out of Google Analytics tracking using the Google Analytics Opt-Out Browser Add-On. You can manage your Google advertising preferences through Ads Preferences Manager. You can also control cookies through your browser settings, though disabling cookies may affect the functionality of the website.

You have the right to request access to the personal information we hold about you and to request that inaccurate information be corrected. To make such a request, please contact us using the details in Section 13 below.

We will respond to access and correction requests within a reasonable time. In some cases, we may be unable to provide access to certain information — for example, where doing so would reveal information about another person, where the information is subject to legal professional privilege, or where we are prohibited from disclosing it under the AML/CTF Act.

We do not charge a fee for access requests but may charge a reasonable fee for the cost of providing access where the request requires significant effort.

If you believe we have mishandled your personal information or breached the Australian Privacy Principles, please contact us in the first instance using the details in Section 13. We will acknowledge your complaint within five business days and endeavour to resolve it within 30 days.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au

• Phone: 1300 363 992

• Post: GPO Box 5218, Sydney NSW 2001

For any questions or concerns about this Privacy Policy or how we handle your personal information, please contact:

• Nicolas Zoumis

• Buy Right Advocates

• Phone: 0450 234 700

• Email: hello@buyrightadvocates.homes

• Website: buyrightadvocates.homes

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. The current version will always be available at buyrightadvocates.homes/privacy-policy. We encourage you to review this policy periodically. Material changes will be noted with an updated date at the top of the policy.