The privacy policy utilised by Beyond Twenty One Real Estate is designed to reduce the high risk of identity theft and data breaches.
Agents must explicitly state how personal information is collected, used, disclosed and destroyed.
Agents must reflect in-person data collection (e.g. at open for inspections) and this data must be made easily accessible should a client request it. Be careful with paper registers as they can be a breach of APP11 because other people can take photographs of the register. If you do use paper registers, ensure that reasonable steps are taken so they are kept secure, and others cannot access the details. If someone does not consent to provide information you can bar access to the open for inspection. If they provide information, then you have obtained their voluntary consent.
Agents must only collect necessary information, reducing the collection of excessive details such as tattoos, relationship status, full social media history, or unnecessary financial details, such as excessive request for bank statements is prohibited.
Personal information must be destroyed or de-identified when no longer needed. To destroy information implies rendering it irretrievable, rather than merely archiving it. To de-identify information means to make it so that the identity of that individual can no longer be ascertained from that information. New standards require the destruction of unsuccessful tenant information. This data can no longer be kept "just in case" and stricter rules also apply for third-party CRM platforms.
New laws mandate a standard rental application form to clarify what information can and cannot be collected, aimed at preventing intrusive and non-essential requests.
AI-generated images in rental listings must be disclosed to prevent misleading advertisements.
Agents must comply with the 13 Australian Privacy Principles (APPs) if their turnover exceeds $3 million, including strict data breach notification requirements. This is irrespective of your business structure.
Personal information must not be used or disclosed for any purpose other than what was originally authorised, including for marketing activities. Any "direct marketing" type of communication should have an easy to use "unsubscribe" functionality to comply with APP7 and the SPAM Act.
You cannot charge a person for making a request to access their personal information, but you can charge them a fee for providing them access to the information. This fee cannot be excessive, and could include staff related costs of locating, sorting through and assembling the personal information as well as reproducing and sending it, and the costs associated with any material or postage required.
When used in this Privacy Policy, the term "Personal Information" has the meaning given to it in the Act. In general terms, it is any information that can be used to personally identify you. This may include your name, address, telephone number, email address and profession or occupation. If the information we collect personally identifies you, or you are reasonably identifiable from it, the information will be considered Personal Information.
Beyond Twenty One Real Estate may collect any of the following information about you if you are a current or prospective vendor, purchaser or landlord of real estate or if you visit our website or make an enquiry with us via another method:
If you are a current or prospective tenant for a rental property, Beyond Twenty One Real Estate may collect the following additional information from you:
Sometimes Beyond Twenty One Real Estate may also need to ask you for other forms of Personal Information to enable us to provide services to you.
Beyond Twenty One Real Estate collects your Personal Information directly from you unless it is unreasonable or impracticable to do so. When collecting Personal Information from you, Beyond Twenty One Real Estate may collect in various ways, including emails, letters, telephone calls.
Beyond Twenty One Real Estate may collect information about you from the following third party sources:
As part of the process of entering into lease or rental agreements with you, Beyond Twenty One Real Estate may disclose your information to authorised credit or tenant checking agencies.
Automated decision-making refers to when an organisation uses technology (like algorithms or AI systems) to make decisions about individuals with no human involvement or minimal human review. For example:
Currently, the Privacy Act 1988 does not contain a specific right for individuals to know when decisions about them are made solely by automated means. However, the Australian Privacy Principles (APPs) still apply. So, organisations must:
Beyond Twenty One Real Estate does NOT use any automated decision-making AI tools. If the agency does commence to utilise such services, this Privacy Policy will be amended accordingly.
There is currently no express legal right under the Privacy Act to have a human review of automated decisions - but the general APPs do apply to any system that handles personal data.
If you do not provide Beyond Twenty One Real Estate with the Personal Information described above, some or all of the following may happen:
Beyond Twenty One Real Estate collects information for a range of purposes including:
Your Personal Information will not be shared, sold, rented or disclosed other than as described in this Privacy Policy.
Any Personal Information about you that our agency collects and records will only be used or disclosed by our agency for the purpose of:
Beyond Twenty One Real Estate may also use or disclose the information it collects for any other purpose specified to you at the time of collection.
Our agency may send you direct marketing communications and information about our services that we consider may be of interest to you. These may include:
These communications may be sent in various forms, including mail, SMS and email, in accordance with applicable marketing laws, such as the Spam Act 2003 (Cth). When our agency does this, we will provide you with the opportunity to opt-out from receiving any further communication from our agency.
You may at any time request not to receive direct marketing from Beyond Twenty One Real Estate by contacting our agency or by using opt-out facilities provided in the marketing communications and we will then ensure that your name is removed from our mailing list.
Beyond Twenty One Real Estate privacy policy also applies to our website at beyondtwentyone.com.au
When you access our website, we may send a "cookie" (which is a small summary file containing a unique ID number) to your computer. This enables us to recognise your computer and greet you each time you visit our website. Our cookies do not collect Personal Information, although they do identify your browser. If you do not wish to receive cookies, you can set your browser so that your computer does not accept them.
As our website is linked to the Internet, and the Internet is inherently insecure, we cannot provide any assurance regarding the security of transmission of information you communicate to us online. We also cannot guarantee that the information you supply will not be intercepted while being transmitted over the Internet. Accordingly, any Personal Information or other information, which you transmit to us online, is transmitted at your own risk.
Our website may contain links to other websites operated by third parties. We make no representations or warranties in relation to the privacy practices of any third party website and we are not responsible for the privacy policies or the content of any third party website. Third party websites are responsible for informing you about their own privacy practices.
Beyond Twenty One Real Estate does not utilise any services that are located outside of Australia.
You may request access to your Personal Information held by our agency, at any time by contacting us. We will try to provide you with suitable means of accessing your Personal Information (for example, by mailing or emailing it to you). We will respond to your request for access within 7 days and endeavour to provide the requested information within 21 days.
There may be instances where Beyond Twenty One Real Estate cannot grant you access to the Personal Information we hold. For example, we may not be able to provide access to information in the following situations:
If for any reason our agency does not allow you to access your Personal Information, we will provide you with reasons in writing for our decision.
If you believe that Personal Information that our agency holds about you is incorrect, incomplete or inaccurate, then you may request that we amend it. Beyond Twenty One Real Estate will consider if the information requires amendment. If our agency does not agree that there are grounds for amendment, then we will add a note to the Personal Information stating that you disagree with it.
We may disclose your Personal Information:
There are some instances when our agency may need to provide your Personal Information to third parties. Beyond Twenty One Real Estate may be bound by law to provide your details to government-related bodies, including the Titles Office or the Residential Tenancies Bond Authority.
Beyond Twenty One Real Estate does not sell your personal details to other organisations. We may however use the information about you to assist us with internal marketing and research.
We may disclose your Personal Information to entities located outside of Australia, including our data hosting and other IT service providers, who may pass information to secondary data hosting providers located outside of Australia.
Beyond Twenty One Real Estate will take reasonable steps to ensure information collected, used or disclosed is stored in a secure environment that is accessed only by persons authorised by our agency so as to prevent interference, misuse, loss, unauthorised access, modification or disclosure.
If the Personal Information is no longer needed for any purpose, our agency will take reasonable steps to destroy or permanently de-identify the Personal Information.
Beyond Twenty One Real Estate endeavours to provide a secure environment and a reliable system but you should be aware that there are inherent risks associated with the electronic storage and transmission of information (particularly via the Internet) which cannot be guaranteed to be 100% secure.
Katherine Gaff as Licensee in Charge can assist you with any enquiries you have about the information that we hold about you.
If you have a complaint or concern you can contact us on the details below. We will do our best to try and resolve your complaint within 30 days.
realestate@beyondtwentyone.com.au
69 Miller Street, Gilgandra NSW 2827
02 6847 2827
If we are unable to resolve your complaint within this time, or you are unhappy with the outcome, you may refer your complaint to the Australian Information Commissioner. The Australian Information Commissioner can be contacted at the below details:
The Office of the Australian Information Commissioner
GPO Box 5218
Sydney NSW 1042
Phone: 1300 363 992
E-mail: enquiries@oaic.gov.au
This privacy policy was last updated on 11th June 2026.
Thank you for taking the time to read our Privacy Statement