Privacy Policy

1. About this Policy and our two roles

Property Workspace is a software platform for Australian buyer's agents, real estate agents and property professionals. It is important to understand the two different roles we play with personal information:

• As an APP entity (our own data). When you register, subscribe, contact us, or browse our site, we collect and handle your personal information (your account and billing details, your communications with us, and technical data) as the entity responsible under the Privacy Act. This Policy governs that information.
• As a service provider (your clients' data). When you and your team enter information about your own clients, prospects and properties into the platform ("Customer Data"), you (the subscribing agency) decide what to collect and why, and you are the entity responsible to those individuals under the Privacy Act. We host and process that Customer Data on your instructions, only to provide the platform and as set out in our Terms of Service. We do not use Customer Data for our own purposes.

This Policy applies to personal information collected through our website, the platform, and our dealings with you. Where we link to third-party services, their own privacy policies apply.

2. What personal information we collect

Account & identity information

• Your name, work email address, mobile number and password (stored in hashed form)
• Your role and the agency/business you act for, including business name and ABN
• Profile details and preferences you choose to provide

Customer Data you enter

• Records about your clients and prospects — names, contact details, locations, financial position, strategy, pipeline stage and notes
• Property records, presentations, and property investment analysis (PIA) inputs and outputs
• AML/CTF and "know your customer" material where you use the compliance module (see section 3)

Billing information

• Subscription plan, billing contact and transaction history. Card and bank details are collected and stored by our payment processor, not by us — we receive only limited tokens and receipts.

Technical & usage information

• Log and device data such as IP address, browser type, device identifiers, pages and features used, and timestamps
• Authentication events and security signals used to keep accounts safe
• Cookies and similar technologies (see section 9)

Communications

• Emails, support requests, feedback and any other correspondence you send us

3. Sensitive information

Some information is "sensitive information" under the Privacy Act and attracts higher protection — for example identity documents, source-of-funds evidence and information that may reveal someone's financial circumstances, collected through the AML/CTF compliance features.

We collect and host sensitive information only at your direction, so that you can meet your own customer due-diligence and record-keeping obligations. By entering such information you confirm you have a lawful basis and the necessary consents to do so. We do not collect sensitive information about you unless you choose to provide it or the law requires it.

4. How we collect it

• Directly from you — when you sign up, set up your workspace, enter records, subscribe, or contact us.
• Automatically — through cookies, logs and analytics as you use the platform.
• From third parties — for example public business records such as the Australian Business Register (for ABN verification), and our service providers acting on our behalf. Where the law requires consent for collection from a third party, you are responsible for obtaining it for Customer Data.

Where it is reasonable and practicable, we collect personal information directly from the individual it concerns.

5. Why we collect and how we use it

We collect, hold and use personal information for the following purposes:

• To create and administer your account and workspace, and authenticate users
• To provide, maintain, secure and improve the platform and its features
• To process subscriptions, billing and payments
• To send service communications — verification, security alerts, billing receipts, and important notices about the platform
• To provide customer support and respond to your enquiries
• To monitor, detect and prevent fraud, abuse and security incidents
• To comply with our legal obligations, including record-keeping under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) where applicable, and to respond to lawful requests
• With your consent, to send product updates and marketing (you can opt out at any time — see section 8)

We will only use or disclose personal information for a purpose other than the one it was collected for where that secondary purpose is related and within reasonable expectations, where you have consented, or where the law permits or requires it.

6. Who we disclose it to

We do not sell personal information and we do not disclose it for others' marketing. We disclose personal information only:

• To service providers ("subprocessors") who help us run the platform under contract and confidentiality obligations, including:

Provider	Purpose	Location
Supabase / AWS	Database, authentication & file storage (primary store of your data)	Sydney, Australia (ap-southeast-2)
Vercel	Application hosting & delivery	USA / global edge
Google (Gmail / Workspace)	Sending transactional & account email	USA / global
Payment processor	Subscription billing & card processing	USA / global

• To your own team within your agency workspace, according to the roles and permissions you set. Database row-level security prevents other agencies (tenants) from accessing your data.
• To our professional advisers (lawyers, accountants, auditors) where reasonably necessary, under confidentiality.
• To government, regulators, courts or law-enforcement — including AUSTRAC, the courts and the OAIC — where we are required or authorised by law, or to protect our rights, your safety or the safety of others.
• In a business transfer — if we restructure, merge, or sell the business, personal information may be disclosed to a successor, subject to this Policy or an equivalent one.
• With your consent, or as otherwise permitted by the Privacy Act.

Our staff ("platform admins") may access data on a least-privilege basis only where reasonably necessary for support, billing, security or incident response, and are bound by confidentiality.

7. Overseas disclosure

Your data is stored primarily in Australia (Sydney). However, some of our subprocessors listed above operate or process limited data overseas, principally in the United States — for example application delivery, email sending and payment processing. Before disclosing personal information to an overseas recipient we take reasonable steps to ensure it is handled consistently with the APPs, including through contractual protections. By using the platform you consent to these overseas disclosures for the purposes described.

8. Direct marketing

We may send you product news and offers about Property Workspace where you have consented or it is within your reasonable expectations as a customer. Every marketing message includes an unsubscribe option, and you can opt out at any time by using that link or emailing us. Opting out of marketing does not stop essential service and account messages, which we must send to operate your account. We do not use Customer Data to market to your clients.

9. Cookies & analytics

We use first-party cookies and similar technologies to keep you signed in, remember preferences, and keep the platform secure. We may use privacy-respecting analytics to understand aggregate usage and improve the product. We do not run third-party advertising trackers inside the platform and we do not sell tracking data. You can control cookies through your browser, though disabling them may affect sign-in and functionality.

10. How we keep it secure

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure, including:

• Encryption of data in transit (TLS) and at rest with our infrastructure providers
• Tenant isolation through database row-level security, so each agency only sees its own data
• Authenticated access, hashed passwords, and role-based permissions
• Least-privilege internal access and logging

No system can be guaranteed perfectly secure. You are responsible for keeping your login credentials confidential and for the security of devices used to access the platform.

11. How long we keep it

We keep personal information for as long as your account is active and for as long afterwards as is needed to fulfil the purposes in this Policy, resolve disputes, and meet our legal, accounting and record-keeping obligations.

• AML/CTF records: where applicable, the AML/CTF Act 2006 requires certain customer and transaction records to be kept for 7 years. Deleting your account does not override that obligation for records covered by it.
• Backups: residual copies may persist in encrypted backups for a limited period before being overwritten.

When information is no longer needed and we are not required to keep it, we take reasonable steps to destroy or de-identify it.

12. Access & correction

Under APP 12 and APP 13 you may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. You can:

• View and export much of your data directly from Settings within the platform
• Edit your account and your records at any time
• Email us to make a formal access or correction request

We will respond within a reasonable period (generally within 30 days). We may need to verify your identity first. There is normally no charge to make a request, though we may charge a reasonable cost for retrieval in some cases. If we refuse access or correction, we will tell you why and how to complain.

13. Your clients' personal information

If you enter personal information about your clients or other individuals into the platform, you are responsible, as the relevant APP entity, for handling it lawfully — including having a lawful basis to collect it, giving any required privacy notices, obtaining any required consents (including for sensitive information), and responding to those individuals' access, correction and other requests. We process that information only to provide the platform to you. If an individual contacts us directly about data you control, we will generally refer them to you.

14. Data breaches

We maintain a data breach response plan and comply with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act. If an eligible data breach occurs that is likely to result in serious harm, we will notify affected individuals and the OAIC as required by law, and we will support you in meeting your own notification obligations where the breach involves your Customer Data.

15. Anonymity, children & changes

Anonymity and pseudonymity. Where lawful and practicable you may deal with us anonymously or under a pseudonym — though we generally cannot provide an account or the platform without identifying information.

Children. The platform is a business tool intended for users aged 18 and over and is not directed at children. We do not knowingly collect personal information from children.

Changes to this Policy. We may update this Policy from time to time. The current version is always available here and is effective when posted. If we make a material change we will take reasonable steps to notify you, such as by email or an in-platform notice. Continued use after the effective date means you accept the updated Policy.

16. Complaints & contact

If you have a privacy question, want to exercise your rights, or wish to make a complaint, please contact our Privacy Officer first:

Privacy Officer — Property Workspace
Brix Super Group Pty Ltd (ABN 25 692 753 674) trading as Property Workspace
Email: hello@propertyworkspace.com.au

We will acknowledge your complaint promptly and aim to resolve it within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au · 1300 363 992.

Effective 16 June 2026 · Brix Super Group Pty Ltd (ABN 25 692 753 674) trading as Property Workspace. This Policy should be read together with our Terms of Service.