Privacy Policy

1. Introduction

Propter Pty Ltd (ABN 72 688 584 821) (“Propter”, “we”, “us”, “our”) operates an Australian property technology platform offering an integrated suite of services to buyers, sellers, property owners, and real estate professionals. These services may include property search (including AI-powered search), property valuation tools, AI agents and AI voice agents (including the Maya voice agent), AUSTRAC AML/CTF compliance tools, customer relationship management (CRM) functionality, and deposit payment facilitation.

This Privacy Policy details how we collect, store, use, and disclose your personal information under the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth). It applies to all users of the Propter platform, including our website, web application, and any associated services (together, the “Platform”).

This Privacy Policy is intended to be read in conjunction with our Master Platform Terms and Conditions and any applicable product-specific terms. Words defined in those documents apply for the purposes of this Privacy Policy.

We may amend this Privacy Policy from time to time in response to changes to our business, our services, or the law. By using our services, you accept the practices described in this Privacy Policy and our Master Platform Terms and Conditions.

2. Types of personal information we collect

The types of personal information we collect depend on how you interact with us, the type of service you request, and the nature of your relationship with us.

2.1 Buyers and property owners

If you register as a buyer or property owner on the Platform, we may collect:

• your full name, date of birth, and residential address;
• your email address and telephone number;
• identity verification information, such as your passport number, driver’s licence number, or other government-issued identification details;
• information about the property or properties you are buying, selling, or own, including address and land title details;
• bank account or payment details required to facilitate transactions through our payment partner (see section 6);
• information about your finances, source of funds, or source of wealth, where required for compliance purposes; and
• any other information you provide to us through the Platform or in communications with us.

2.2 Real estate agents and agencies

If you register as a real estate agent or agency on the Platform, we may collect:

• your full name, date of birth, and residential address (for individual agents);
• entity name, ABN, ACN, and registered business address (for agencies);
• Real Estate Agent licence number and issuing jurisdiction;
• AUSTRAC enrolment details, where applicable and available;
• details of directors, officers, and ultimate beneficial owners (UBOs), including their names, dates of birth, and identification documents;
• professional qualifications, memberships, and accreditations;
• bank account or payment details; and
• any other information you provide to us.

2.3 Website visitors and general users

When you visit our website or use the Platform, we may automatically collect information from your browser, including:

• your IP address;
• your browser type and language;
• access times;
• the content of any cookies that your browser previously accepted from us (see section 10);
• the referring website address;
• information submitted through contact forms, enquiry forms, or feedback submissions;
• technical information about your device and operating system; and
• information about how you use the Platform, including pages visited, features accessed, and time spent.

2.4 Personal information about other people

We may also collect and store personal information about other people that you provide to us. For example, if you are a real estate agent submitting information about a buyer or seller, or if you provide details of directors or beneficial owners as part of entity verification. If you provide us with personal information about another person, you must first ensure that person is aware of and consents to the collection, use, and disclosure of their personal information as described in this Privacy Policy.

2.5 Sensitive information, including biometric data

Sensitive information has the meaning given in the Privacy Act and includes biometric information used for the purpose of automated biometric verification or identification.

As part of the identity verification and AML/CTF screening services we deliver through our compliance partner Sumsub (see section 5.1), we (or Sumsub on our behalf) collect and process biometric information — specifically facial images and the biometric features extracted from those images — in order to verify that the person presenting an identity document is the person to whom that document belongs and to perform liveness checks. We collect this biometric information with your consent at the point you complete the verification flow, and we rely on the AML/CTF exemption in the APPs to the extent applicable.

Other than biometric information collected for the purposes described above, we do not generally collect sensitive information. If we need to collect any other sensitive information for a specific purpose, we will seek your consent or rely on an applicable exemption under the APPs.

3. How we collect personal information

We may collect personal information about you in the following ways:

• Directly from you — when you register an account, complete a form, make a payment, contact us, or otherwise provide information to us through the Platform or by email, telephone, or other means.
• Automatically from your browser — when you visit our website, we automatically collect information including your IP address, browser type and language, access times, cookie content, and referring website address.
• From your use of the Platform — when you or your representative use our services, we automatically collect information about the services accessed and transactions conducted.
• From third parties — including our payment processors Stripe Payments Australia Pty Ltd (“Stripe”) and Zai Payments Australia Pty Ltd t/a Zai Australia (“Zai”) (each a “Payment Provider”), and our identity verification and AML compliance partner Sum and Substance Ltd (trading as Sumsub) (“Sumsub”), as well as from government registers, identity verification services, and publicly available sources.
• From your representative — a real estate agent, legal representative, or other authorised person acting on your behalf may provide your personal information to us.

4. Why we collect and use personal information

We may use your personal information for the following purposes:

• to provide, operate, administer, and improve the Platform and our services, including verifying your identity, contacting you about your enquiries, and managing your interaction with other users;
• to create and manage your account;
• to verify your identity in accordance with our obligations under applicable laws, including anti-money laundering and counter-terrorism financing (AML/CTF) legislation;
• to conduct customer due diligence, including Know Your Customer (KYC) and Know Your Business (KYB) checks;
• to screen against sanctions lists, politically exposed persons (PEP) lists, and adverse media databases;
• to process payments and facilitate transactions through our Payment Providers (Stripe and/or Zai);
• to monitor transactions for unusual or suspicious activity;
• to comply with our legal, regulatory, and contractual obligations, and to support the reporting obligations of our Payment Providers and reporting entities using the Platform, including in connection with AUSTRAC and other regulators;
• for customer support, including resolving and providing assistance or responding to enquiries or requests;
• to distribute our communications, either ourselves or with the assistance of third-party service providers;
• to conduct marketing activities for our products and services, or products and services of third parties, and to conduct market and other research. Every direct marketing email we send includes an unsubscribe link. You can opt out at any time by clicking that link, by changing your account communication preferences, or by contacting us using the details in section 14;
• to maintain records and comply with our legal and contractual obligations;
• to protect the security and integrity of the Platform;
• to investigate and resolve disputes, complaints, and potential breaches;
• to train our staff and test our systems; and
• to conduct research, analytics, and product development using de-identified or aggregated data.

If we are unable to collect the personal information described above, we may not be able to provide you with access to all or some of our services.

5. Who we disclose personal information to

We may disclose your personal information to others in connection with the services we provide.

5.1 Service providers

We engage third-party service providers to assist us in operating the Platform and delivering our services. These include:

• Stripe Payments Australia Pty Ltd (Stripe) — one of our payment processing partners. Stripe processes payments, tokenises and stores payment credentials, and facilitates fund transfers on the Platform. When you provide bank account or payment card details, this information is processed and stored directly by Stripe in accordance with PCI DSS standards. Propter does not store your payment card or bank account details. Stripe is part of an international group and may process and transfer your personal information outside Australia in accordance with appropriate cross-border transfer safeguards (see section 5.5).
• Zai Payments Australia Pty Ltd t/a Zai Australia (Zai) — one of our payment processing partners. Zai processes payments, holds payment credentials in tokenised form, and facilitates fund transfers on the Platform. When you provide bank account or payment card details, this information is processed and stored directly by Zai in accordance with PCI DSS standards. Propter does not store your payment card or bank account details.
• Sumsub (Sum and Substance Ltd) — our identity verification and AML compliance technology partner. Sumsub assists us, and assists real estate businesses using the Platform’s AUSTRAC compliance tools, with identity verification (KYC and KYB), sanctions, politically exposed person (PEP), and adverse media screening, document verification, biometric and liveness checks, and ongoing compliance monitoring.
• Cloud hosting and infrastructure providers — we use Amazon Web Services (AWS) in the Sydney region to host the Platform and store Platform data. We do not replicate Platform data outside Australia.
• Other IT, analytics, email, communications, and data service providers engaged to support the Platform.

Sumsub processes your personal information primarily as our processor, acting on our instructions for the purposes described in this Privacy Policy. As permitted under our agreement with Sumsub and consistent with Sumsub’s own privacy notice, Sumsub may also act as a controller of de-identified verification data for limited purposes, including the development and improvement of its verification technology and cross-client fraud detection. Sumsub may transfer personal information to entities in its corporate group and to its sub-processors and data providers located outside Australia. Where personal information is transferred internationally, Sumsub relies on appropriate transfer mechanisms, including Standard Contractual Clauses or equivalent safeguards consistent with APP 8.

As part of using the Propter Platform, you agree to use the services of, and share information with, our Payment Providers (Stripe and/or Zai, as applicable) and Sumsub. Services on the Platform are also supplied by third-party data providers.

We will never share your information with a third party or allow a third party to send you direct communications about its products without your consent, except as described in this Privacy Policy and our Master Platform Terms and Conditions.

5.2 Related entities

We may disclose your personal information to any related bodies corporate or related entities of Propter.

5.3 Other parties

We may also disclose your personal information to:

• other participants in a property transaction facilitated through the Platform, to the extent necessary to complete the transaction;
• government and regulatory authorities, including AUSTRAC, where required or authorised by law;
• law enforcement agencies, courts, and tribunals in response to lawful requests or to protect our rights;
• professional advisors, including lawyers and accountants, in connection with legal or regulatory matters; and
• any other party with your consent.

When you elect to engage with a particular business or professional through the Platform, you authorise us to provide your email address and other relevant information to that business or professional.

5.4 Corporate transactions

We may also disclose your personal information in connection with a substantial corporate transaction, such as the sale of our business, a divestiture, merger, consolidation, or asset sale, or in the unlikely event of insolvency or administration.

5.5 Overseas disclosure

Personal information held on the Platform is stored in Australia (in AWS’s Sydney region) and is not replicated outside Australia. However, in delivering some of our services we disclose personal information to service providers located overseas, as follows:

• Sumsub may process and transfer personal information outside Australia to entities within Sumsub’s corporate group and to Sumsub’s sub-processors and data providers, in each case under Standard Contractual Clauses or equivalent safeguards consistent with APP 8 (see section 5.1);
• Stripe (where used as a Payment Provider) processes personal information through its global infrastructure and may transfer it to its parent and affiliated entities and sub-processors, in each case under Standard Contractual Clauses or equivalent safeguards (see section 5.1);
• third-party AI service providers that power our AI Tools may process personal information outside Australia under appropriate cross-border transfer safeguards (see section 7); and
• other service providers may process limited information overseas where strictly necessary for the service they deliver — details of any such providers, the personal information they process, and the safeguards in place are available from us on request.

Where we disclose personal information overseas, we take reasonable steps to ensure that the overseas recipient handles your personal information in accordance with the Australian Privacy Principles.

6. Payment information

Payments on the Platform are processed by one of our payment partners — Stripe Payments Australia Pty Ltd (“Stripe”) or Zai Payments Australia Pty Ltd t/a Zai Australia (“Zai”) (each a “Payment Provider”). When you enter payment details (such as bank account or credit card information), this information is processed directly by the relevant Payment Provider, where it is tokenised and stored in a PCI DSS compliant environment. Propter does not store your payment card details or bank account numbers in our systems. We only receive a tokenised reference from the relevant Payment Provider to facilitate transactions.

By using the Platform, you agree to the collection, use, and disclosure of your payment information by the relevant Payment Provider in accordance with that Payment Provider’s privacy policy and terms of service, and as described in this Privacy Policy and our Master Platform Terms and Conditions.

7. AI tools, AI agents, and voice recordings

The Platform includes AI-powered features, including AI search, AI-assisted valuation, AI agents, and AI voice agents (including the Maya voice agent) (collectively, “AI Tools”). To deliver these features we may collect, generate, use, and disclose:

• text inputs you submit to AI Tools, including search queries, prompts, instructions, and uploaded content;
• audio recordings of calls made or received by AI voice agents you operate or interact with through the Platform;
• transcripts and other text representations of those calls;
• outputs generated by AI Tools (such as draft messages, summaries, recommendations, and valuation estimates); and
• metadata associated with AI Tool usage, such as session timing, model version, and outcome.

We use this information to operate, secure, debug, and improve the AI Tools, to deliver the outputs you request, to maintain audit trails, to monitor for misuse and abuse, and to meet our legal obligations.

Third-party AI service providers

We disclose information to third-party AI service providers that power our AI Tools, including providers of large language models, speech-to-text and text-to-speech services, and telephony infrastructure. The current list of providers is published on our website and may be updated from time to time. Some of these providers process personal information outside Australia. Where this is the case, we take reasonable steps to ensure they handle your personal information consistently with the Australian Privacy Principles, including under Standard Contractual Clauses or equivalent safeguards.

No third-party model training on your data

We do not authorise our third-party AI service providers to use your personal information or your business’s confidential information to train their underlying foundation models. Where a provider supports it, we configure the service to disable training on customer inputs and outputs. We may use de-identified or aggregated data to evaluate, monitor, and improve our own AI Tools.

Voice recording and consent

Where AI voice agents make or receive calls on behalf of a real estate professional, those calls may be recorded and transcribed. The real estate professional operating the AI voice agent is responsible for ensuring that all parties to those calls are notified, and have provided any consent required, under applicable Australian state and territory laws. Propter may include automated disclosures at the start of calls to support compliance.

AUSTRAC compliance data flow

Where a real estate business uses the Platform’s AUSTRAC compliance tools to conduct customer due diligence on a buyer, seller, or other counterparty, that business is the AUSTRAC reporting entity and the primary controller of the customer’s personal information for the purposes of the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). Propter (with the assistance of Sumsub) collects, verifies, and processes that personal information on instruction from the real estate business and makes the verification results available to that business through the Platform. Propter retains records of the verification activity to meet its own obligations and to support the real estate business’s compliance and audit requirements.

8. Records retention

We retain personal information for as long as it is reasonably needed for the purpose for which it was collected, or as required by law.

In particular:

• AML/CTF records — in accordance with the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), we retain customer identification records, transaction records, and records relating to our AML/CTF program for a minimum of 7 years after the relevant relationship or service ends, or after the transaction is completed, whichever is later.
• Account and transaction records — we retain records of your account activity and transactions for a minimum of 7 years after the closure of your account or the completion of the relevant transaction.
• General enquiries and communications — we retain records of communications for a reasonable period to manage our relationship with you and to comply with our legal obligations.
• Marketing preferences — we retain your opt-out preferences for as long as necessary to honour them.

When personal information is no longer required for any purpose described in this Privacy Policy and we are not required by law to retain it, we will take reasonable steps to destroy it, de-identify it, or render it inaccessible.

9. Data security

We hold your personal information in a combination of electronic files and, where applicable, hard copy records. We may use third-party information system providers who may store or have access to your personal information. We may combine personal information we receive about you with other information we hold about you, including information received from third parties.

We take appropriate security measures (including physical, electronic, and procedural measures) to help safeguard your personal information from unauthorised access and disclosure. Our security measures include:

• encryption of data in transit and at rest;
• access controls and authentication mechanisms;
• regular security reviews and updates;
• staff training on privacy and information security obligations; and
• contractual obligations on our service providers to maintain appropriate security standards.

Payment information is handled by our Payment Providers (Stripe and/or Zai) in a PCI DSS compliant environment. Propter does not store payment card or bank account details.

We want you to feel confident using our services. However, no system can be completely secure. Therefore, although we take steps to secure your information, we do not promise, and you should not expect, that your personal information, searches, or other communications will always remain secure.

9.1 Data breach notification

We comply with our obligations under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act. If we become aware of a data breach involving your personal information, we will assess the breach in accordance with the scheme. Where the breach is likely to result in serious harm to any individual whose personal information is involved, and we are unable to prevent that harm through remedial action, we will notify the affected individuals and the Office of the Australian Information Commissioner as required by law.

10. Cookies, web beacons, and analytics

Cookies are small pieces of data stored on the web browser on your computer. The Platform and associated websites may store cookies on your web browser. The main reasons we store cookies are to:

• improve your website browsing experience (for example, to remember your preferences and search criteria);
• gather statistics on site usage (for example, page views, traffic sources, and drop-off points) so we can monitor usage and make improvements; and
• enable us to present customised and appropriate messages and content.

We may use:

• Essential cookies — required for the Platform to function properly (for example, session management, authentication).
• Analytics cookies — used to understand how visitors interact with the Platform. We use Google Analytics 4 (GA4) for this purpose.
• Functional cookies — used to remember your preferences and improve your experience.

We may also use standard internet technology, such as web beacons and other similar technologies, to track your use of the Platform. We may include web beacons in promotional or other email messages or newsletters to determine whether messages have been opened and acted upon. The information we obtain in this manner enables us to customise the services we offer, deliver targeted communications, and measure the overall effectiveness of our online content and services.

Most web browsers can be configured so you are notified when a cookie is received, allowing you to accept or reject it. You can also check and remove cookies stored by your browser. If you disable cookies, you may not be able to access all the content and features of the Platform.

11. Accessing and correcting your personal information

You have the right to request access to the personal information we hold about you, and to request that we correct any information that is inaccurate, out of date, incomplete, irrelevant, or misleading.

To make a request, please contact our Privacy Officer using the details in section 14. We will respond to your request within a reasonable time. We may need to verify your identity before processing your request.

We may provide you with access unless there is an exception that applies under the Australian Privacy Principles. We may recover from you our reasonable costs of supplying you with access to that personal information. However, we will not charge you for the making of the request or to correct or update your personal information.

If we refuse to provide access to or correct your personal information, we will notify you of our reasons to the extent required, and what steps you may then take.

12. Complaints

If you have a query regarding how your personal information is collected, stored, or used, or if you believe that we have breached the APPs or otherwise mishandled your personal information, please contact our Privacy Officer in writing using the contact details in section 14.

We will acknowledge receipt of your complaint within 5 business days and aim to investigate and respond within 30 business days. We will keep you informed of the progress of our investigation.

If you are not satisfied with our response, you are entitled to lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Email: enquiries@oaic.gov.au

13. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time in response to changes to our administrative or business requirements, or changes to the law. The most current version will always be available on our website. Where a change is significant, we will take reasonable steps to notify you (for example, by email or by a notice on the Platform).

We encourage you to review this Privacy Policy regularly.

14. Contact details

If you have any questions about this Privacy Policy, wish to make a request regarding your personal information, or wish to lodge a complaint, please contact our Privacy Officer: