1About this Policy

1.1ASPIRE Property Advisor Network Pty Ltd ABN 57 153 421 295, ACN 153 421 295, Queensland Corporate Real Estate Licence 3957354 (ASPIRE, we, us or our) is bound by the Privacy Act 1988 (Cth) (Privacy Act) and the Australian Privacy Principles (APPs). This Policy explains how we collect, hold, use and disclose personal information, how it is protected, and how you can access it, correct it or make a complaint.

1.2This Policy applies to personal information collected through our website at aspirenetwork.com.au, the ASPIRE client portal at portal.aspirenetwork.com.au and our other platforms, by email, SMS, telephone and video call, at events, and in the course of delivering property investment advisory and related services.

1.3This Policy applies to the following people:

• (a)website visitors, enquirers and newsletter subscribers;
• (b)clients and prospective clients of the advisors accredited by ASPIRE, together with co-purchasers, guarantors and the directors, trustees and beneficial owners of any entity through which a client purchases;
• (c)people who register for or attend our events;
• (d)referral partners and other professionals who work with us;
• (e)vendors, developers, builders and other suppliers, and their directors, officers, beneficial owners and staff;
• (f)accredited advisors and applicants for accreditation; and
• (g)applicants for employment and contractors.

1.4For advisory clients, this Policy is the full privacy policy referred to in the Privacy Disclosure Statement in Section 18 of the ASPIRE Property Services Guide (PSG). It should be read together with the PSG and, for portal users, the Portal Terms of Use.

1.5The handling of employee records by ASPIRE as an employer, where directly related to a current or former employment relationship, is exempt from the APPs under the Privacy Act. This Policy does not apply to those records.

2ASPIRE and the accredited advisor network

2.1ASPIRE provides the advisory framework, research, acquisition services and platform through which independent accredited Property Investment Advisors (Advisors) deliver services to their clients. Some Advisors operate their own businesses. Advisors access personal information through the ASPIRE platform subject to confidentiality and privacy obligations owed to ASPIRE. An Advisor who operates a separate business may also hold personal information in that business and, where required, will have a privacy policy of their own.

2.2ASPIRE is enrolled with the Australian Transaction Reports and Analysis Centre (AUSTRAC) as a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act). Each accredited Advisory is also enrolled with AUSTRAC as a reporting entity in its own right. ASPIRE has appointed an AML/CTF Compliance Officer, who is also ASPIRE's Privacy Officer (see Section 24).

3The kinds of personal information we collect

3.1The personal information we collect depends on how you deal with us. It may include:

• (a)identity and contact details, including your name, date of birth, residential and postal addresses, email address, telephone and mobile numbers;
• (b)identification information required by law, including copies of identity documents and their type, number, expiry and issuing authority, and information about the directors, trustees, beneficiaries and beneficial owners of entities;
• (c)financial information, including income, assets, liabilities, existing properties, borrowing details, investment objectives and the source of funds or wealth used for a purchase;
• (d)information about your circumstances, including employment, household, lifestyle goals and the information you give us in the Fact Finder Discovery Questionnaire and the Client KYC Onboarding and Identity Verification Form;
• (e)transaction and portfolio information, including properties considered, offers, contracts, settlement details and the information displayed in the My Portfolio tool;
• (f)records of our dealings with you, including correspondence, meeting notes, and recordings and transcripts of calls and video meetings where you have been told the meeting is recorded;
• (g)results of sanctions, politically exposed person and adverse media screening;
• (h)marketing and communication preferences, survey responses, feedback, and entries in competitions or promotions, together with records of the consents you have given and withdrawn;
• (i)event information, including registration details, attendance, dietary and accessibility requirements, and photographs or video taken at events;
• (j)technical information, including IP address, device and browser information, portal log-in and activity records, pages visited, and email and SMS delivery, open and click data;
• (k)payment and billing information, which is processed by our payment service providers; and
• (l)for accredited Advisors, applicants and contractors, qualifications, licences, insurance, references, work history and the results of checks required to assess whether a person is fit and proper.

3.2Where you provide personal information about another person, such as a co-purchaser or a beneficial owner, you must have that person's authority to do so and should tell them about this Policy.

4Sensitive information

4.1Sensitive information is a category of personal information given extra protection under the Privacy Act. It includes information about health, racial or ethnic origin, religious beliefs, political opinions or associations, and criminal record.

4.2We collect sensitive information only where you consent and the information is reasonably necessary for our functions, or where the collection is required or authorised by law. Examples include dietary or accessibility requirements for an event, which may reveal health or religious information, and criminal history checks for Advisors and personnel. Sanctions and adverse media screening required under the AML/CTF Act may reveal sensitive information, and that collection is authorised by law. If electronic verification compares a live image of your face with your identity document, we will ask for your consent first.

4.3We use and disclose sensitive information only for the purpose for which it was collected, unless you consent or the law requires or authorises otherwise.

5How we collect personal information

5.1We collect personal information directly from you wherever practicable, including through our website, the portal, online forms, email, SMS, telephone, video calls, meetings and events.

5.2We may also collect personal information from:

• (a)your Advisor, co-purchaser or authorised representative;
• (b)professionals acting for you, such as your finance broker, accountant, solicitor or conveyancer, with your authority;
• (c)vendors, developers, builders and selling agents in connection with a transaction;
• (d)public registers and sources, including the Australian Securities and Investments Commission, the Australian Business Register, land titles registries, the Australian Financial Security Authority, licensing registers and court records;
• (e)identity verification, sanctions, politically exposed person and adverse media screening services, including the Department of Foreign Affairs and Trade Consolidated List; and
• (f)cookies and similar technologies, as described in Section 14.

5.3We may record and transcribe calls and video meetings, including through artificial intelligence note-taking tools, so that an accurate record is kept of the information and advice exchanged. Where a meeting is recorded or transcribed, we tell you at the start of the meeting that it is being recorded, and the recording tool (Fathom) displays a recording notification to every participant. If you do not wish the meeting to be recorded, you may tell us at any time and the recording will be stopped, in which case written notes will be taken instead.

5.4Where we receive personal information we did not ask for, we will decide within a reasonable period whether we could have collected it lawfully. If not, we will destroy or de-identify it where lawful and reasonable to do so.

6Anonymity and pseudonymity

6.1You may deal with us anonymously or by using a pseudonym when making a general enquiry or browsing our website. This is not practicable for advisory services, portal access or event registration, and is not permitted where the AML/CTF Act requires us to identify you.

7Identity verification and anti-money laundering obligations

7.1Before designated services can be provided, the AML/CTF Act requires us and your Advisor to establish your identity and, where you act for or through an entity, the identity of its beneficial owners. We may also be required to collect information about the nature and purpose of the transaction and the source of funds or wealth, and to screen against Australian sanctions lists and for politically exposed persons.

7.2Identity may be verified by sighting identity documents in person or by video call, by electronic verification against reliable and independent data sources, by checking public registers, or by a combination of these methods. If we propose to verify your identity using information held by a credit reporting body, we will ask for your consent first and offer you an alternative method. That check is not an application for credit. If the information does not match, we will tell you and offer another method of verification.

7.3We record the details of the identity documents sighted and the outcome of verification. Where a copy of an identity document is kept on file, it is marked with a watermark stating that it was provided to ASPIRE for identity verification only, so that it cannot be reused for another purpose if it is ever misused. Copies are held in restricted access storage, are available only to the staff who need them for verification and compliance, and are kept no longer than the law requires.

7.4AML/CTF records must be kept for at least seven years. The law may require us to report certain matters to AUSTRAC and prohibits us from telling you or any other person that a suspicious matter report has been made. For that reason, we may not be able to give you access to some information, or explain why a service has been delayed or declined.

7.5If you do not provide the information required by the AML/CTF Act, ASPIRE and your Advisory are prohibited by law from providing the designated service to you.

8Why we collect, use and disclose personal information

8.1We collect, hold, use and disclose personal information for the following purposes:

• (a)providing property investment advisory, research, acquisition, transaction support and portfolio services, and operating the portal;
• (b)establishing and verifying identity and meeting our obligations under the AML/CTF Act and Australian sanctions laws;
• (c)preparing and progressing property transactions with vendors, developers, builders, selling agents and the professionals acting for you;
• (d)communicating with you, including service notifications by email and SMS;
• (e)sending you marketing communications and event invitations, and running surveys, competitions and promotions, as described in Section 9;
• (f)running events;
• (g)accrediting, supervising and supporting Advisors, and engaging suppliers, referral partners and contractors;
• (h)billing, payments and record keeping;
• (i)handling enquiries, complaints and disputes;
• (j)meeting our obligations under the Privacy Act, real estate licensing legislation, consumer law, tax law and the Property Investment Professionals of Australia (PIPA) Code of Conduct;
• (k)improving our services, platform and website, including through analytics and aggregated or de-identified reporting;
• (l)protecting the security of our systems and preventing fraud and scams; and
• (m)any other purpose disclosed to you at the time of collection, any related purpose you would reasonably expect, or any purpose to which you consent.

8.2We do not sell, rent or trade personal information.

9Direct marketing, email and SMS

9.1We comply with the Spam Act 2003 (Cth) in relation to every commercial electronic message we send, including email and SMS, and with the Do Not Call Register Act 2006 (Cth) and the Telecommunications (Telemarketing and Research Calls) Industry Standard 2017 in relation to telemarketing calls.

9.2We send two kinds of message:

• (a)service messages, which give factual information about a service you are receiving or an event you have registered for, such as portal log-in details, identity verification requests, document notifications, appointment reminders, transaction and settlement milestones, and event confirmations and reminders; and
• (b)marketing messages, which promote our services, insights, property opportunities, events or offers.

9.3We send marketing messages only with your consent. Consent may be express, given by ticking an unticked box, completing a signup form or telling us directly, or inferred where the law permits from an existing relationship and the message relates to that relationship. Consent to receive marketing by email is not consent to receive marketing by SMS. We record the channel to which each consent relates and when and how it was given.

9.4Every message we send identifies ASPIRE as the sender and includes our contact details. Every marketing message includes a free means of unsubscribing, which for SMS is replying STOP. Unsubscribe requests are given effect within five business days. Unsubscribing from marketing does not stop service messages that are necessary to deliver a service you have engaged us for. You can ask to receive service messages by email only. SMS and marketing preferences can also be changed by emailing [email protected].

9.5Our SMS messages are sent through the Mailchimp platform operated by The Rocket Science Group LLC, an Intuit company, in the United States. Your mobile number, name, consent record, message content and delivery and reply information are processed by Mailchimp to send messages and record opt-outs. Where we send SMS under a branded sender name, that name is registered on the SMS Sender ID Register maintained by the Australian Communications and Media Authority. Our marketing emails are also sent through Mailchimp, which records whether an email is delivered and opened and which links are clicked.

9.6It is our policy not to use SMS or email to ask for your password, to request payment card details, or to notify a change to bank account details. If you receive a message of that kind that appears to come from ASPIRE, do not act on it, and contact us on 1300 710 933.

9.7You may ask us at any time to stop sending you marketing communications, and we will give effect to that request free of charge within a reasonable period. You may also ask us for the source of the personal information we used, and we will tell you unless it is impracticable or unreasonable to do so.

9.8We use your contact details, your stated preferences and the services and events you have shown interest in to decide which communications are likely to be relevant to you. We do not sell, rent or share mobile numbers, email addresses or consent records with any third party for that party's own marketing. We will ask for your consent before sharing your personal information with a third party for its direct marketing purposes.

10Events

10.1When you register for an event, we collect your registration details and any dietary, accessibility or other requirements you choose to give us. We use this information to run the event and to send event information by email or SMS.

10.2We share event information with venues, caterers, registration and ticketing providers and co-hosts only to the extent necessary to run the event. We share your details with an event sponsor or exhibitor only with your consent.

10.3Photographs and video may be taken at our events and used in our communications, website and social media. We will tell you at the event when photography or filming is taking place. You may ask our event staff not to photograph you, or ask us afterwards to remove an image of you from our channels.

10.4Where an event is co-hosted with another organisation, such as PIPA, that organisation handles the personal information it collects in accordance with its own privacy policy.

11Who we disclose personal information to

11.1We may disclose personal information, to the extent reasonably necessary for the purposes in Section 8, to:

• (a)your Advisor and their authorised staff and contractors;
• (b)ASPIRE's staff, contractors and related entities, including offshore support staff as described in Section 12;
• (c)professionals engaged in connection with your purchase, including finance brokers, lenders, conveyancers, solicitors, accountants, tax depreciation providers, building inspectors, property managers and insurers;
• (d)vendors, developers, builders and selling agents, to the extent necessary to prepare contracts and complete a transaction;
• (e)AUSTRAC, the Australian Taxation Office, state and territory real estate regulators, law enforcement agencies, courts and tribunals, and other government bodies where required or authorised by law;
• (f)PIPA and the OAIC in connection with a complaint;
• (g)our technology and service providers, including data analytics, research and marketing providers, portal hosting and support, cloud storage, customer relationship management, email and SMS delivery, electronic signature, video conferencing, meeting recording and transcription, artificial intelligence, accounting and payment providers;
• (h)our professional advisers, auditors and insurers;
• (i)a prospective purchaser, investor or financier in connection with a sale, merger, financing or restructure of all or part of our business, under a confidentiality agreement; and
• (j)any other person with your consent.

11.2We take reasonable steps, including through contract terms where available, to require our service providers to handle personal information only for the purpose for which it was provided, to keep it confidential and secure, and to comply with obligations consistent with the APPs.

12Disclosure outside Australia

12.1Some of the people and providers we disclose personal information to are located outside Australia. The countries in which overseas recipients are likely to be located are:

• (a)the Philippines, where administrative support staff engaged by ASPIRE access the ASPIRE platform to assist with records, documents and client administration; and
• (b)the United States, where providers of email and SMS delivery (Mailchimp), cloud software, video conferencing, meeting transcription and artificial intelligence tools store or process information.

12.2Some cloud service providers we use may store or back up information in other countries in which they operate data centres.

12.3Before disclosing personal information overseas, we take reasonable steps to ensure the recipient does not breach the APPs. These steps include due diligence on the provider, binding contractual obligations covering confidentiality, security and permitted use, role-based access controls, encrypted transmission, and limiting access to the minimum information necessary for the task. ASPIRE remains accountable under the Privacy Act for the handling of personal information by those overseas recipients.

13Artificial intelligence and automated decisions

13.1We use artificial intelligence and automated tools to assist with document preparation, research and analysis, meeting transcription, compliance processes and administration. Outputs that may affect your interests are reviewed by a qualified person before they are relied on or given to you. Where the provider allows, we configure the tools we use so that personal information is not used to train third party artificial intelligence models, and we will not otherwise permit that use without your express written consent.

13.2From the 10th of December 2026, the Privacy Act requires this Policy to describe the use of computer programs to make, or to do things substantially and directly related to making, decisions that could reasonably be expected to significantly affect your rights or interests. At the date of this Policy:

• (a)the kinds of personal information used in automated tools are contact details, identification information, financial information, investment objectives and engagement records;
• (b)ASPIRE makes no decision of that kind solely by the operation of a computer program; and
• (c)automated tools are used to verify identity electronically, to match names against sanctions and politically exposed person lists and to flag records for review. Any failed verification or potential match is reviewed by a person, and no service is declined without human review.

13.3We will update this Section before introducing any automated decision-making of a different kind.

14Cookies, analytics and advertising

14.1Our website uses cookies, pixels and similar technologies to operate the site, remember your preferences, analyse use of the site, and measure and deliver advertising. These include Google Analytics, Google Ads and the Meta pixel, which may show you ASPIRE advertising on other websites and platforms based on your visits to our site.

14.2Information collected through these technologies may be linked to you if you are signed in to a Google or Meta account, or if you have given us your details through a form. You can control cookies through your browser settings and manage advertising preferences through your Google and Meta account settings. Disabling cookies may affect how the site works.

14.3The portal uses cookies that are necessary for log-in, security and session management.

15How we hold and protect personal information

15.1We hold personal information electronically in the ASPIRE platform and portal, our customer relationship management, email and cloud storage systems, and occasionally in paper files kept securely at our office.

15.2We take reasonable steps, including technical and organisational measures, to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Depending on the system, these measures include encryption in transit and at rest, multi-factor authentication, role-based access, audit logging, staff confidentiality obligations and training, security reviews of our providers, and contractual security obligations.

15.3We do not ask for or store full payment card details. Payments are processed by our payment service providers.

15.4No method of transmitting or storing information electronically is completely secure, and we cannot guarantee the security of information you send us over the internet. You can help by keeping your portal log-in details confidential and contacting us immediately if you suspect unauthorised access.

16Retention and destruction

16.1We keep client records, including advice documents and AML/CTF records, for at least seven years after your last engagement, or longer where the law requires. Other personal information, such as enquiry and marketing records, is kept only for as long as it is needed for the purpose for which it was collected or as the law requires.

16.2In deciding how long to keep personal information, we consider its amount, nature and sensitivity, the risk of harm from unauthorised use or disclosure, the purpose for which we hold it, and any legal retention period. We may also keep information where it is reasonably needed to bring or defend a legal claim. Details of the retention periods that apply to particular records are available on request.

16.3When personal information is no longer needed for any purpose permitted under the APPs and we are not required by law to keep it, we take reasonable steps to destroy it or de-identify it.

17Data breaches

17.1If we suspect a data breach, we will act promptly to contain it and will take all reasonable steps to complete an assessment within 30 days of whether it is an eligible data breach under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. If it is, we will notify you and the OAIC as soon as practicable, describing the breach, the kinds of information involved and the steps we recommend you take.

18Access and correction

18.1You may ask for access to the personal information we hold about you, and ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. Clients can also view and update many of their details in the portal.

18.2We will verify your identity before giving access. There is no charge for making a request. We may charge a reasonable fee to cover the cost of giving access, and will tell you the amount before proceeding. There is no charge for correction.

18.3We aim to respond within 30 days. If we refuse access or correction, we will give you written reasons, unless it would be unreasonable or unlawful to do so, and tell you how to complain. Access may be refused in the circumstances permitted by the APPs, including where giving access would be unlawful, such as where it would disclose a report made to AUSTRAC. If we refuse to correct information, you may ask us to attach a statement to the record noting that you consider it inaccurate.

18.4You may withdraw a consent you have given at any time, for example to marketing, meeting recording or the handling of sensitive information. Withdrawal does not affect anything done before it. You may also ask us to delete personal information we hold about you. We will do so where the information is no longer needed and we are not required by law to keep it, as is the case for AML/CTF records, or to keep it to bring or defend a legal claim. On request, we will provide a copy of the personal information you have given us in a commonly used electronic format where this is reasonably practicable.

19Government identifiers

19.1We do not adopt a government related identifier, such as a driver licence, passport or Medicare number, as our own identifier for you. We do not ask for your tax file number. We use or disclose a government related identifier only where reasonably necessary to verify your identity or where required or authorised by law. Please do not send us your tax file number.

20Children

20.1Our services are not directed to people under 18 years of age, and we do not knowingly collect their personal information other than as a beneficiary or family member named by a client where reasonably necessary. If you believe we hold personal information about a child without proper authority, please contact us.

21Third party websites and published content

21.1Our website and communications may link to websites operated by others. We are not responsible for their privacy practices and encourage you to read their privacy policies.

21.2Information you choose to publish, such as a review, testimonial or comment, may be read by others and may remain in archives or copies after it is removed. Testimonials are published only with the consent of the person concerned.

22Changes to this Policy

22.1We review this Policy regularly and may update it to reflect changes in the law, our services or our practices. The current version is published on our website with its version and effective date. Where a change is material, we will take reasonable steps to tell clients and portal users, for example by email or a notice in the portal.

23Complaints

23.1Advisory clients may first raise the matter with their Advisor, as described in Section 17 of the PSG. If you have a concern about how we have handled your personal information, please contact our Privacy Officer, Jane Menz, using the details in Section 24. We will acknowledge your complaint within three business days and aim to resolve it within 30 days. If the matter is complex, we will tell you how long it is expected to take.

23.2If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at www.oaic.gov.au, by telephone on 1300 363 992 or by post to GPO Box 5288, Sydney NSW 2001. The OAIC will generally expect you to have raised the complaint with us first. Advisory clients may also refer a complaint to PIPA, as described in Section 17 of the PSG.

24Contact us

24.1ASPIRE's Privacy Officer and AML/CTF Compliance Officer is Jane Menz. Privacy questions, requests for access or correction, and complaints should be addressed to:

• (a)email: [email protected] or [email protected], or [email protected] for SMS and marketing preferences;
• (b)telephone: 1300 710 933; or
• (c)post: Privacy Officer, ASPIRE Property Advisor Network Pty Ltd, Ground Floor, 80 Dorcas Street, Southbank VIC 3006.