Privacy Policy

• 1. Why we collect your personal information

We collect and use your personal information for the purpose of carrying out our business of providing real estate agency services. This also includes sending you information about our goods and services, newsletters and updates, offers and communicating changes to our goods, services or terms and conditions.

• 2. The personal information we collect about you

In the process of conducting our business, we collect a range of personal information about our current and prospective clients, suppliers, agents, service providers and other business associates. The type of personal information that we may collect about you includes:

1. identity and contact information: first name, last name, date of birth, address, telephone numbers, e-mail address, occupation;
2. property ownership details: properties owned and properties sold;
3. profile information: telephone number, any desired property preferences, feedback and survey responses;
4. rental tenant information: employment details (i.e. employment status, employer, salary, length of employment), sources of income and referees.
5. device information: computer software, mobile operating system;
6. usage information: use of the Website including, but not limited to, traffic data and other communication data;
7. marketing and communications information: preferences to receive marketing from us and third parties and communication preferences; 
8. location information: current location disclosed by GPS or similar technology
9. government identifiers: details from government-issued identification documents such as your driver’s licence, passport or Medicare card; and
10. biometric information: facial images or short video recordings used specifically for the purpose of electronically verifying your identity.

• 3.  How we will use your personal information

We will only use your personal information as permitted by the Act and APPs. Most commonly we will use your personal information to:

• 3.1 Automated decision making

We may use your personal information to make automated decisions using computer programs. The types of personal information we may use includes: 

• your name and contact details;
• your residential or postal address;
• property preferences and search criteria;
• property ownership information;
• rental history;
• employment information;
• income and financial information;
• identification and verification information;
• information provided in rental applications;
• information about your interactions with our website, portals and services; and
• communication records and enquiry history.

Decisions that may be made with the assistance of a computer program include: 

• assessing rental applications and tenant suitability;
• verifying identity and conducting fraud prevention checks;
• assessing affordability or suitability for rental properties; and
• generating property recommendations.

Decisions that may be made solely by a computer program include:

• sending automated property recommendations based on your preferences;
• matching users with available properties;
• generating automated property alerts and notifications;
• filtering spam, fraudulent or suspicious enquiries; and
• assigning enquiries to the appropriate team or office based on location or service requirements.

1. 3.2 Deidentified information

We may also use the information we collect about you by making it anonymous (deidentified) and then creating statistical or demographic data. For example,  we may use deidentified usage data to calculate the percentage of users accessing a specific page of the Website.

• 4. Circumstances where we collect your personal information and you may not be aware

• Cookies: We use cookies, pixel-tags and other tracking technologies. Cookies are small files that are transferred to your computer or device and enable us to recognise your browser, remember certain information including your preferences and make your experience with the Website more convenient and effortless. If you don’t want information collected through cookies you can configure your computer or device so that it disables or rejects them.
• Google Analytics: We also use Google Analytics to track your use of the Website. Google Analytics is an analytics service provided by Google that places cookies on your computer or device. The information generated by the cookies about your use of the Website is transmitted to Google. This information is then used for the purpose of compiling statistical reports enabling us to analyse when you use the Website, the average time spent on the Website and the features of the Website used. You should be able to configure your computer or device to disable Google Analytics.

• 5. Collection of your personal information from third party sources 

Our preference is to collect your personal information directly from you as this is the best way to ensure its accuracy. We may also collect your personal information from third parties and public sources such as Google, social media providers (LinkedIn, Instagram, Facebook and X), Land registry offices, Residential Tenancies Bond Authority and other property and rental databases, advertisers and referrals. 

We do not warrant that these third party sources have the same level of privacy protection as us, and you should review their privacy policies to ensure compliance with the Act.

• 6. Sensitive Information

Generally, we will not collect sensitive information about you. However, to comply with our legal obligations (including client due diligence requirements), we may collect biometric information (such as a facial image or video), which is classified as sensitive information under the Act.

We will only collect biometric data and other sensitive information with your express consent, and we will strictly use it for the purpose of identity verification, fraud and identity theft prevention and related compliance purposes. We will not use or disclose your sensitive information for any other purpose unless you have consented or we are required or authorised by law to do so.

• 7. Identity Verification and Government Data Matching

To verify your identity electronically, we utilise the Australian Government’s Document Verification Service (DVS) and accredited third-party providers such as APLYiD.

Where you consent to electronic verification, your identity document details will be securely transmitted to the relevant Commonwealth or State authority that issued the document to confirm whether the details match their records. We may also collect and use biometric information to confirm that you are physically present and match the photograph on your identification document.

Your consent to this electronic identity verification process is voluntary. If you choose not to consent, you may withdraw at any time, however, we may be unable to verify your identity electronically. In such circumstances, we will require you to verify your identity via an alternative manual method, or we may be unable to provide our services to you.

• 8. Direct Marketing

We use your personal information to send you marketing materials and information about our goods, services and offers. If you change your mind in the future, you may withdraw your consent to receive direct marketing by using the opt-out option provided in the marketing communication or by emailing us at boxhill@chn.group.

• 9. Consequences of you not providing your personal information

Wherever it is lawful and practical, you have the option of using a pseudonym or not identifying yourself when dealing with us. However, by not providing your personal information to us you acknowledge that it may affect our ability to provide our full range of goods and services to you.

• 10. Who we are likely to disclose your personal information to

We may disclose your personal information to other service providers to assist us to provide our goods and services to you. These service providers may include:

1. internal entities such as other companies within our group;
2. Land registry offices and Residential Tenancies Bond Authority;
3. property and rental database providers;
4. website analytics providers; 
5. email and text message distribution providers;
6. third party delivery services (e.g. Australia Post, courier companies, outsourced delivery drivers); 
7. advertising agencies;
8. signwriters and copyrighters;
9. building and garden maintenance providers;
10. IT and system administration services and support providers;
11. payment processing providers;
12. credit reporting agencies;
13. market research providers; 
14. website hosting providers; 
15. vendor and client interface providers; 
16. CRM software providers; 
17. cyber security system providers; 
18. accredited electronic identity verification providers (such as APLYiD Pty Ltd) and their authorised sub-providers;
19. Commonwealth and State authorities and official record holders via the DVS;
20. regulatory bodies, law enforcement agencies and government authorities (such as AUSTRAC), where required or authorised by law; and
21. any other agents we engage to provide services to you.

• 11. Disclosure to overseas entities

We will always endeavour to store your information on an Australian server. However, in circumstances where this is not possible, we may disclose your personal information to an overseas entity. Where we disclose your personal information outside of Australia, we will take reasonable steps to ensure that your personal information is treated securely in accordance with our privacy policy and laws equivalent or similar to the Act.

• 12. Security

We will take reasonable steps to ensure that personal information held by us is stored in a manner that reasonably protects it from misuse, interference, loss, unauthorised access, modification or disclosure. When your personal information is no longer needed, we will take reasonable steps to destroy or permanently de-identify it.

• 12.1 Technical and organisational measures

As part of our commitment to protecting your personal information under the Act and APPs, we implement appropriate technical and organisational measures to ensure the security of personal information we hold.

Our technical measures taken by us to protect your personal information include, but are not limited to:

• encryption of personal information in transit and at rest;
• network security controls including firewalls and intrusion detection systems;
• access controls and authentication systems;
• anti-virus and anti-malware software;
• regular security updates and patch management;
• backup and recovery systems with secure storage; and
• data loss prevention controls.

Our organisational measures taken by us to protect your personal information include, but are not limited to:

• privacy and security policies, procedures and standards;
• staff training on privacy and security obligations;
• regular privacy impact assessments and security risk assessments;
• incident response and data breach management procedures;
• privacy governance framework with designated privacy officers;
• vendor management and due diligence processes;
• regular review and testing of security controls; and
• privacy by design and privacy by default approaches.

We regularly review and update our technical and organisational measures to ensure they remain appropriate to the risks and threats to your personal information, taking into account:

• the nature and sensitivity of the personal information we hold;
• the current state of technology;
• the cost of implementation; and
• the possible adverse consequences for individuals if a security incident occurs.

Our technical and organisational measures are designed to ensure the ongoing confidentiality, integrity, availability, and resilience of our information systems and services.

• 13. Accessing and updating your personal information

You may request to access or update the personal information we hold about you by contacting us at boxhill@chn.group. We will endeavour to respond to your request within 30 days of receipt. Your request will need to include enough information for us to identify you (e.g. full name, address, telephone numbers, email address). We will provide you with a copy of your personal information that we hold unless:

1. we reasonably believe that giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety; 
2. giving access would have an unreasonable impact on the privacy of another individual;
3. your request for access is frivolous or vexatious; 
4. the information relates to legal proceedings, may prejudice negotiations, investigations or other enforcement related activities; or 
5. giving access is unlawful.

• 14. Making a complaint about our handling of your personal information

If you have a concern or complaint relating to our handling of your personal information or any breaches of the APPs, please notify us at boxhill@chn.group by outlining the nature of the complaint. We will endeavour to respond to your complaint within 30 days of receipt. If the complaint is unresolved, you are not satisfied with the outcome of the complaint or the way in which we have handled your complaint, you may contact the Office of the Australian Information Commissioner.

This privacy policy was last updated June 2026.