Privacy Policy — FiveFold Property Partners

1. Who we are

FiveFold Property Partners is the trading name of Bonnie Jean McKenzie (ABN 59 942 856 625), a licensed buyer's agency operating in New South Wales and Queensland, Australia.

Licences held: NSW Class 1 Real Estate Licence No. 20565004; QLD Real Estate Licence No. 4915418
Postal address: 11 Marina Crescent, Gymea Bay NSW 2227, Australia
Email: hello@fivefoldproperty.com.au
Phone: 0438 512 375
Website: fivefoldproperty.com.au

In this policy, "we", "us", and "our" mean FiveFold Property Partners. "You" means anyone whose personal information we hold — clients, prospective clients, broker partners, newsletter subscribers, and other contacts.

We are committed to protecting your privacy. This policy explains what personal information we collect, why we collect it, who we share it with, and your rights in relation to that information. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and — from 1 July 2026 — the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) ("AML/CTF Act") as it applies to real estate agents under the Tranche 2 reforms.

2. What information we collect

The personal information we collect depends on how you interact with us. It includes:

Contact and identity information

Name, postal address, email address, phone number
Date of birth (required for AML verification once you become a client)
Identification documents (driver's licence, passport, Medicare card, etc. — for AML/CTF verification only, retained per Section 6)
Photograph or facial image (digital identity verification — Stripe Identity or GreenID)

Financial and engagement information

Budget range, deposit position, pre-approval status
Income source (employee / self-employed), without verifying loan details
Source of funds — a written declaration of where the deposit and balance funds come from (required for AML/CTF)
Property preferences, search criteria, decision context
Records of engagement agreements, fees, and authorisations

Transaction and due diligence information

Property addresses being considered or acquired
Contracts, strata reports, building and pest reports, and other due diligence documents
Correspondence with vendors, agents, conveyancers, and lenders on your behalf
Bidding authorities and offer history

Communications

Emails, WhatsApp messages, SMS, phone records, and meeting notes (including transcripts generated by tools such as Fireflies, where you've been notified the meeting is being recorded)

Website and marketing information

IP address, browser type, pages viewed, referral source
Newsletter subscription details and engagement (open/click data)
Information you submit via web forms

We do not collect sensitive information (e.g. health, political, religious, sexual orientation) unless it's directly relevant to a service you've engaged us for and you've consented to its collection.

3. Why we collect it

We collect personal information so we can:

Provide buyer's agency services — property research, due diligence, negotiation, bidding, settlement coordination
Comply with our obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) — from 1 July 2026, this includes customer due diligence, identity verification, ongoing monitoring of active engagements, and (where applicable) reporting suspicious matters to AUSTRAC
Comply with our obligations under the Property and Stock Agents Act 2002 (NSW) and equivalent QLD legislation
Communicate with you about your engagement and the property market
Send you marketing communications (newsletters, market updates, property insights) — only with your consent, and only until you opt out
Improve our services and website
Respond to enquiries and complaints
Meet our record-keeping and reporting obligations

If you don't provide the information we ask for, we may not be able to deliver the service you've requested — particularly for AML/CTF verification, where identification, source-of-funds disclosure, and sanctions/PEP screening are legal requirements that gate the engagement.

4. How we collect it

We collect personal information:

Directly from you — when you contact us, engage our services, complete a brief survey, attend a meeting, or subscribe to communications
From your broker, conveyancer, or other professionals you've asked to work with us
From public sources — such as property listing platforms, council records, ASIC, land titles registries, the DFAT consolidated sanctions list, parliamentary registers (for PEP screening), and open-source news searches
From service providers we use to verify identity (Stripe Identity, GreenID via Vexur, or equivalent) or run our business (HubSpot CRM, Vexur, Fireflies, Google Workspace)
Through cookies and analytics on our website (see Section 9)

Where reasonably practical, we collect personal information directly from you rather than from third parties.

5. Who we share it with

We share personal information only when it's necessary to deliver our services or meet our legal obligations. Recipients may include:

Service delivery

Selling agents and vendors (e.g. to make offers, register interest, or attend inspections on your behalf)
Building and pest inspectors, strata report providers, asbestos inspectors
Conveyancers and solicitors you've appointed
Mortgage brokers and lenders you've appointed
Valuers, where engaged

Compliance and regulatory

AUSTRAC — where required to report suspicious matters, threshold transactions, or annual compliance returns under the AML/CTF Act. AUSTRAC reporting is a statutory obligation that overrides general confidentiality.
AML compliance professionals — where we engage external experts for case-specific or systemic compliance advice. These professionals are bound by their own privacy and confidentiality obligations.
NSW Fair Trading, QLD Office of Fair Trading, or our licensing regulator
Our professional indemnity insurer, if a claim or potential claim arises
Officers of a court, where compelled by court order, subpoena, or other lawful request

Business operations

Our software providers — HubSpot (CRM), Vexur (buyer's agency platform, including potential built-in AML module), Stripe Identity (identity verification), GreenID (third-party verification, accessed via Vexur), AML platform providers (if engaged), Fireflies (meeting transcription), Google Workspace (email and storage), Anthropic (Claude AI workspace — used internally for drafting and research, not for storing client identity documents)
Our accountant and bookkeeper

With your consent

Anyone else you've authorised in writing

We do not sell your personal information. We do not share it with third parties for their own marketing purposes.

6. AML/CTF — how we handle identity and screening information

From 1 July 2026, the AML/CTF Act applies to FiveFold's buyer's agency services. We collect and handle the following AML-related information:

What we collect for AML/CTF

Two forms of identification (one primary photo ID, one secondary)
Date of birth
Source-of-funds declaration (and, for higher-risk customers, source-of-wealth information and bank statements)
For corporate / trust / SMSF customers: beneficial-ownership information
Results of sanctions screening (DFAT consolidated list) and PEP (Politically Exposed Person) screening
Customer Risk Assessment outcome

How we hold it

The ID document image (the photo/scan of your passport, licence, etc.) is destroyed within 30 days of verification, per the Privacy Act 1988 APP 11.2. We do not keep the document image beyond what's needed to complete verification.
The verification record (a separate internal document confirming what we checked, when, the document number(s), the outcome, and the destruction date of the image) is retained for 7 years from the end of the business relationship, per the AML/CTF Act.
Sanctions and PEP screening results are retained 7 years.
Source-of-funds declarations are retained 7 years.
All AML records are stored in a restricted-access folder accessible only to Bonnie McKenzie.

How it's used

AML records are used only for AML/CTF verification, ongoing monitoring of your active engagement, and reporting to AUSTRAC where legally required.
They are not used for marketing, profiling, secondary commercial purposes, or any purpose unrelated to AML compliance.

Suspicious Matter Reports

If we form a reasonable suspicion of money laundering, terrorism financing, or related offences, we are legally required to file a Suspicious Matter Report with AUSTRAC. The AML/CTF Act prohibits us from telling you if such a report is being considered or has been filed — this prohibition is known as "tipping off" and is a criminal offence. Where we file a report, we may continue to act on your engagement unless there are other reasons to terminate.

Your right to erasure — the AML/CTF override

If you ask us to delete your AML records before the 7-year retention period ends, we cannot do so. Our obligations under the AML/CTF Act override your general right to erasure under the Privacy Act. This applies only to AML records; you may still request deletion of marketing data, communication records, or other non-AML information (subject to any other applicable retention obligations — e.g. NSW Fair Trading's 3-year minimum for agency records).

6A. Privacy Collection Notice

This notice is required by the Privacy Act 1988 (Cth) as amended in January 2026. Every time we collect personal information about you, we provide this notice.

Identity of the collecting entity. FiveFold Property Partners — Bonnie McKenzie, ABN 59 942 856 625. Contact details in Section 1 above.

What we collect. The information listed in Section 2 above, including (for clients) AML/CTF information per Section 6.

Why we collect it. The purposes listed in Section 3 above, including (for clients) compliance with the AML/CTF Act and applicable real estate licensing legislation.

Consequences of not providing it. If you choose not to provide the information we ask for, we may not be able to deliver the service you've requested. In particular, for AML/CTF verification we are legally prohibited from providing buyer's agency services to a client we cannot verify.

False or misleading information — AML/CTF Act sections 137 and 140. It is an offence under sections 137 and 140 of the AML/CTF Act to provide false or misleading information in any AML/CTF form or document you provide to us, or to receive a designated service from us using a false name or anonymously. By providing AML/CTF information to FiveFold, you confirm the information is correct and accurate. You also consent to your identity (and any representative's identity) being verified electronically and to us disclosing your information to third parties to help us meet our obligations under the AML/CTF Act.

Who we usually disclose to. The recipients listed in Section 5 above. For AML/CTF information specifically: AUSTRAC (where legally required), AML compliance professionals (where engaged), officers of a court (where compelled), and AML platform providers as applicable to the engagement.

How to access and correct. You can access the personal information we hold about you, and ask us to correct anything inaccurate, by emailing hello@fivefoldproperty.com.au. We respond within 30 days. See Section 11 for full rights detail.

Complaints. If you think we've mishandled your information, please raise it with Bonnie McKenzie directly first (Section 12). You can also complain to the Office of the Australian Information Commissioner (OAIC).

Overseas disclosure. Some of our service providers store or process data outside Australia (see Section 10).

7. How we store and protect it

We store personal information in a local working environment (Bonnie's password-protected, full-disk-encrypted Windows device), Google Workspace, HubSpot CRM, Vexur, and identity-verification processors (Stripe Identity and/or GreenID), each with their own security certifications.

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. These include:

Multi-factor authentication on all critical accounts
Encrypted storage and transmission
Restricted-access folders for sensitive information (AML records — Bonnie only)
Regular backups and version control
Secure disposal of physical documents (cross-cut shredder)
Destruction of ID document images within 30 days of AML verification

No system is 100% secure. If we ever become aware of a data breach that's likely to result in serious harm, we'll notify you and the Office of the Australian Information Commissioner (OAIC) in line with the Notifiable Data Breaches scheme.

8. Marketing — and how to opt out

If you've subscribed to our newsletter, attended a webinar, or otherwise opted in, we'll send you property market updates, insights, and occasional service announcements.

You can opt out at any time by clicking the "unsubscribe" link at the bottom of any marketing email, or by emailing us at hello@fivefoldproperty.com.au with "unsubscribe" in the subject line. Opting out of marketing won't affect any active client engagement — we'll still send you the operational communications you need for your property search.

9. Website and cookies

Our website uses cookies and similar technologies to remember your preferences, measure how the site is used, and improve performance and content. You can disable cookies in your browser settings, though some features may not work properly without them.

We use third-party analytics providers (such as Google Analytics) that collect aggregated, non-identifying information about site traffic. Your IP address may be sent to these providers' servers, including outside Australia.

10. Overseas disclosures

Some of our service providers store or process data outside Australia, including Google Workspace (primarily United States and Singapore), HubSpot (United States and European Union), Stripe Identity (United States), Anthropic / Claude (United States), and Fireflies (United States). GreenID and Vexur store data in Australia. We only use providers that have appropriate security and privacy protections in place, and where transferring data overseas is necessary for the service to function.

11. Your rights

Under the Privacy Act, you have the right to:

Access — ask us what personal information we hold about you. We'll respond within 30 days. There's no charge for reasonable access requests.
Correct — ask us to correct information that's inaccurate, out of date, incomplete, irrelevant, or misleading. If we disagree, we'll tell you why and you can ask us to attach a statement noting your view.
Opt out — withdraw consent for marketing communications at any time (see Section 8).
Complain — raise a privacy concern with us (see Section 12) or with the OAIC.
Anonymity or pseudonymity — where it's lawful and practical, you may deal with us anonymously or under a pseudonym (note: not possible for AML/CTF-regulated services — identification is a legal requirement).

Note on AML records (Section 6): the general right to erasure does not apply to AML/CTF records during the statutory 7-year retention period. To make a request, email hello@fivefoldproperty.com.au. We may need to verify your identity before acting on the request.

12. Complaints

Step 1. Email Bonnie McKenzie at hello@fivefoldproperty.com.au with the subject line "Privacy complaint". Tell us what happened and what outcome you'd like. We'll acknowledge within 5 business days and aim to respond substantively within 30 days.

Step 2. If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC): oaic.gov.au · 1300 363 992 · GPO Box 5288, Sydney NSW 2001.

13. Changes to this policy

We may update this policy from time to time — for example, when we add a new service provider, change our practices, or respond to changes in privacy or AML law. The "Last reviewed" date at the top of this policy shows when it was last updated. Substantive changes will be flagged on our website and, where appropriate, communicated to active clients.

14. Contact us

For any privacy questions or to exercise any of the rights in Section 11:

FiveFold Property Partners
Attn: Bonnie McKenzie (Privacy Officer)
Email: hello@fivefoldproperty.com.au
Phone: 0438 512 375
Postal: 11 Marina Crescent, Gymea Bay NSW 2227, Australia