Privacy Policy

1. Background
1.1 General
Malvern Road Property Development Pty Ltd (ACN 625 285 323) is a proprietary company
limited by shares and part of SHC Group. References to ‘SHC Group’, ‘we’, ‘us’ or ‘our’ are
references to SHC Group and their related bodies corporate (as defined in the Corporations
Act 2001 (Cth)).
SHC Group is committed to protecting your privacy, in accordance with applicable
Australian privacy laws. This policy (‘Privacy Policy’) is designed to give you a greater
understanding of how we collect, use, disclose and otherwise handle personal information.
A copy of this Privacy Policy is available on our website at
https://heartwoodtoorak.com/privacy or you can request a copy by contacting our Privacy
Officer (details under heading 13 below).
1.2 What is personal information?
In general terms, legislation defines ‘personal information’ as information or an opinion
about an identified individual or an individual who is reasonably identifiable, whether the
information is true or not and whether the information or opinion is recorded in a material
form or not.
1.3 Our obligations
We comply with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth)
(Privacy Act). The APPs regulate the manner in which personal information is handled
throughout its life cycle, from collection to use and disclosure, security, accessibility and
disposal.
The Privacy Act also includes a data breach notification regime, which requires SHC Group
to address data breaches involving personal information held by SHC Group.
We also comply with more specific privacy legislation in some circumstances, such as the
Spam Act and the Do Not Call Register Act.
1.4 Employee records
We are generally exempt from the Privacy Act when we collect and handle employee
records and this Privacy Policy does not apply to that information. However, where State or
Territory health privacy legislation applies, we are still required to protect the privacy of
employee health information. This Privacy Policy will apply in those circumstances.
2. What we collect
2.1 General
The type of personal information that we collect about you depends on the type of dealings
you have with us. For example, if you:
• are a purchaser or prospective purchaser of a property, we will collect your name,
contact details (such as address, telephone number and email address), date of
birth, gender, employment details, details of the property that you are interested in
or have agreed to purchase, what prompted you to inspect the project, how you
heard about us, confirm whether you are an Australian resident, information
relating to your financing arrangements
• are a supplier to us, we will collect your name and contact details, details about the
goods or services you supply and payment details
• send us an enquiry, complete a registration of interest or provide us with feedback,
we may collect your name, contact details, details of your enquiry or feedback and
information about our response
• fill in a contact form at one of our sales offices, we will collect your name, age,
address, contact details, details of the properties you are interested in (including
price ranges), what prompted you to inspect the project, whether you are an owner
occupier or investor and how you heard about us or the relevant property
development
• ask us to send you information about our developments or other products and
services, we will collect your name, address, contact details, details of the properties
you are interested in and how you heard about us or the relevant property
development
• apply for a job with us, we will collect the information you include in your job
application, including your cover letter, resume, contact details and referee reports
• enter into any promotions, competitions or special offers, we will collect the
information you provide when submitting your entry
In addition to the above, if you interact with SHC Group generally, SHC Group will collect
your details (e.g. name, telephone number, email address), details of the properties you are
interested in, how you heard about us or the relevant property development and details of
your dealings with us. Other information may be collected from other sources but those
sources should provide you with details of what personal information is being collected and
why.
The personal information collected may vary depending on your particular interaction with
SHC Group but will be limited to that information necessary to record and manage our
interaction with you (e.g. your name, relevant contact details and information about the
interaction) and to that information required to enable you to participate in our services
and other products being offered on The Heartwood’s website.
2.2 Sensitive information
Sensitive information is a subset of personal information that is generally afforded a higher
level of privacy protection, such as health information. We only collect sensitive
information where it is reasonably necessary for our functions or activities and either:
• the individual has consented; or
• we are required or authorised by or under law (including applicable privacy
legislation) to do so.
2.3 Collection of information other than personal information through our website
When you visit our website, some of the information that is collected about your visit is not
personal information, as it does not reveal your identity.
Site visit information
For example, we record your server address, the date and time of your visit, the pages you
visited, any documents you downloaded, the previous site you visited and the type of
device, browser and operating system you used.
We use and disclose this information in anonymous, aggregated form only, for purposes
including statistical analysis and to assist us to improve the functionality and usability of our
website. You are not individually identified, however we reserve the right to use or disclose
this information to try to locate an individual where we reasonably believe that the
individual may have engaged in any unlawful or inappropriate activity in connection with
our website, or where we are otherwise required or authorised by law to do so.
Cookies
A cookie is a small string of information that a website transfers to your browser for
identification purposes. The cookies we use do not identify individual users, although they
do identify the user’s internet browser.
We use cookies to hold anonymous session information. This information is used to
personalise your current visit to the website, for example, to allow the website to
remember who you are by keeping server variables linked to your session. We only use nonpersistent cookies. That is, they are held on your browser’s memory only for the duration of
your session.
Most internet browsers are set to accept cookies. If you prefer not to receive them, you can
adjust your internet browser to reject cookies, or to notify you when they are being used.
There are also software products available that can manage cookies for you. Rejecting
cookies can, however, limit the functionality of our website.
Online Behavioural Advertising
We use advertising programs that place cookies on your computer to collect information
about your browsing history (including on external websites). This information, which does
not identify you personally, is collected in order to improve your online experience by
customising the advertising you see to your interests (including the display of more
relevant ads on external websites). You can opt out of these programs at any time by using
the opt-out service provided by Google and Facebook here.
2.4 What if you don’t provide us with your personal information?
We will provide individuals with the option of not identifying themselves, or of using a
pseudonym, when dealing with us if it is lawful and practicable to do so. A pseudonym is a
name or other descriptor that is different to an individual’s actual name. For example, you
can access our website and make general phone queries without having to identify yourself.
In some cases however, if you don’t provide us with your personal information when
requested, we may not be able to provide you with the product or service that you are
seeking. For example, you must identify yourself to register your interest or purchase a
property at any SHC Group development.
3. How we collect personal information
3.1 Methods of collection
We collect personal information in a number of ways, including:
• directly from you in person (for example, if you visit our sales office or development,
or at events or at conferences)
• through our website (for example, by making an online enquiry)
• through our social media pages (for example, through Twitter, LinkedIn or our
Facebook page)
• over the telephone
• through written correspondence (such as letters, faxes and emails)
• on hard copy forms (for example, competition entry forms and surveys)
• through surveillance cameras at our corporate premises and on some of our sales
suites or development sites
• from third parties, including:
• your representatives, including your lawyers, financiers and other authorised agents
• the Land Titles Office
• relevant State and Territory Valuers General
• our sales agents
• other real estate agents
• the Australian Securities and Investment Commission
• mortgage brokers and/or financial service providers
3.2 Collection notices
Where we collect personal information about you, we will take reasonable steps to provide
you with certain details about that collection (such as why we are collecting the information
and who we may share it with). We will generally include this information in a collection
notice.
Collection notices provide more specific information than this Privacy Policy. The terms of
this Privacy Policy are subject to any specific provisions contained in collection notices and
in the terms and conditions of particular offers, products and services. We encourage you to
read those provisions carefully.
3.3 Unsolicited information
Unsolicited personal information is personal information we receive that we have taken no
active steps to collect (such as an employment application sent to us by an individual on
their own initiative, rather than in response to a job advertisement).
We may keep records of unsolicited personal information if the Privacy Act permits it (for
example, if the information is reasonably necessary for one or more of our functions or
activities). If not, we will destroy or de-identify the information as soon as practicable,
provided it is lawful and reasonable to do so.
4. Why we collect personal information
The main purposes for which we collect, hold, use and disclose personal information are set
out below:
• to verify your identity and conduct credit checks
• designing, engineering, constructing and delivering our developments
• to carry out our obligations arising from any contracts entered into between you
and us and to provide you with the products, services and information that you
request from us
• outlining our development products and services to prospective and existing
purchasers
• obtaining finance for our developments
• providing you with information and the services that you have requested
• to communicate with you, including by email, mail or telephone
• processing transactions for the sale of land and/or houses and any applicable
payments and for our billing and account purposes
• to administer our website and for internal operations, including troubleshooting,
data analysis, testing, research, statistical and survey purposes
• promoting ourselves and our products and services, including through direct
marketing, events and competitions
• performing research and statistical analysis, including for customer satisfaction and
service improvement purposes
• protecting the security of our offices, staff, customers and the property held on our
premises
• to assist you with enquiries, resolving complaints or to improve our customer
service;
• recruiting staff and contractors
• to update our records
• to enforce the terms of any agreement that you enter into relating to our products
and services
• complying with legal and regulatory obligations including notifying you of matters
that we may be required by law to notify you of. We may also collect, hold, use and
disclose personal information for other purposes explained at the time of collection
or:
• which are required or authorised by or under law (including, without limitation,
privacy legislation); and
• for which you have provided your consent.
4.1 Direct marketing
You consent (until such time as you opt out, as described below) that we may use your
personal information to let you know about us and our products and services (including
promotions, special offers and events) and our third party products and services, either
where we have your express or implied consent, or where we are otherwise permitted by
law to do so. We may contact you for these purposes in a variety of ways, including by mail,
email, SMS, telephone and online advertising.
Opting out
Where you have consented to receiving marketing communications from us, your consent
will remain current until you advise us otherwise. However, you can opt out at any time, by:
• contacting us (details under heading 13 below)
• advising us if you receive a marketing call that you no longer wish to receive these
calls
• using the unsubscribe facility that we include in our commercial electronic messages
(such as emails and SMS’s)
Once you do this, we will update your profile to ensure that you don’t receive further
marketing
messages. Stopping marketing messages will not stop service communications (such as
contract updates).
Third-party marketing
We will get your express opt-in consent before we share your personal data with any
company outside the SHC Group entities for marketing purposes.
Notification of source
If we have collected the personal information that we use to send you marketing
communications from a third party (for example a direct mail database provider), you can
ask us to notify you of our source of information, and we will do so, unless this would be
unreasonable or impracticable.
5. Who we may share your personal information with
SHC Group may disclose your personal information, and you consent to SHC Group
disclosing your personal information, to Tract’s related bodies corporate and associated
entities (as those terms are defined in the Corporations Act 2001 (Cth)).
SHC Group may also disclose your personal information, and you consent to SHC Group
disclosing your personal information, to the following third parties:
• responsible authorities, such as local councils and water authorities
• builders and their housing consultants
• sub-contractors
• the Land Titles Office
• relevant State and Territory Valuers General
• real estate agents
• Australian Securities and Investment Commission
• financiers and prospective financiers
• financial institutions for payment processing
• an individual’s agent or authorised representative
• referees whose details are provided to us by job applicants
• third parties who support our information technology or handle mailings on our
behalf
• our contracted service providers (including payment processors). In each case, we
may disclose personal information to the service provider and the service provider
may in turn provide us with personal information collected from you in the course of
providing the relevant products or services;
• law enforcement agencies, other governmental agencies or third parties if we are
required by law to do so, or in other limited circumstances (for example if required
by a court order or regulatory authority, or if we believe that such action is
necessary to prevent fraud or cyber-crime or to protect our website, our products or
our technology assets or the rights, property or personal safety of any person)
• our professional advisers
In each case, we may disclose personal information to the service provider and the service
provider may in turn provide us with personal information collected from you in the course
of providing the relevant services.
We may also disclose information to provide our products and services, to respond to legal
requirements, enforce our policies, and protect our rights and property.
6. Cross border disclosure of personal information
We do not currently disclose personal information to third parties located overseas. If this
changes at some time in the future, we will comply with the requirements of the Privacy
Act that apply to cross border disclosures of personal information and this Privacy Policy
will be amended accordingly.
7. Use of government related identifiers
We will not:
• use a government related identifier of an individual (such as a Medicare number or
driver’s licence number) as our own identifier of individuals; or
• otherwise use or disclose such a government related identifier, unless this is
permitted by the Privacy Act (for example, use of an identifier to verify an
individual’s identity or uses or disclosures required or authorised by or under an
Australian law).
8. Data quality and security
8.1 General
SHC Group is committed to keeping your personal information secure and confidential. All
reasonable precautions will be taken to protect personal information from loss, misuse,
unauthorised access or alteration. Paper documents are held in locked drawers and
cabinets. Paper files may also be archived in boxes and stored offsite in secure facilities.
Additionally, we also take reasonable steps to:
• make sure that the personal information that we collect, use and disclose is
accurate, up to date and complete and (in the case of use and disclosure) relevant;
• protect the personal information that we hold from misuse, interference and loss
and from unauthorised access, modification or disclosure; and
• destroy or permanently de-identify personal information that is no longer needed
for any purpose that is permitted by the APPs.
You can help us keep your information up to date, by letting us know about any changes to
your details, such as your address, email address or phone number.
You acknowledge that the security of online transactions you conduct using the website
cannot be guaranteed. To the fullest extent permitted at law, SHC Group does not accept
responsibility for misuse of or loss of, or unauthorised access to, your personal information
where the security of that information is not within SHC Group’s control.
Within SHC Group, access to personal information is restricted to personnel on a need to
know basis. SHC Group has directed its staff that personal information must be dealt with
in accordance with this Privacy Policy and kept secure from unauthorised access or
disclosure. We educate our staff about their duty to protect your privacy and provide
training regarding this Privacy Policy.
8.2 Security
The steps we take to secure the personal information we hold include website protection
measures (such as firewalls and anti-virus software), security restrictions on access to our
computer systems (such as login and password protection), controlled access to our
corporate premises, policies on document storage and security, personnel security
(including restricting access to personal information on our systems to staff who need that
access to carry out their duties), staff training and workplace policies.
Online credit card payment security
We process payments using EFTPOS and online technologies. All transactions processed by
us meet industry security standards to ensure payment details are protected.
Website security
While we strive to protect the personal information and privacy of users of our website, we
cannot guarantee the security of any information that you disclose online and you disclose
that information at your own risk. If you are concerned about sending your information
over the internet, you can contact us by telephone or post (details under heading 13 below).
If you are a registered user of our website, you can also help to protect the privacy of your
personal information by maintaining the confidentiality of your username and password
and by ensuring that you log out of the website when you have finished using it. In addition,
if you become aware of any security breach, please let us know as soon as possible.
IP Address
An IP (internet protocol) address is a number that is automatically assigned to your
computer by your internet service provider when you log on. Your IP address is not linked to
your personal information but we do preserve the right to use IP addresses to identify
individuals who may threaten our site, services or clients. IP addresses may also be used to
help diagnose problems with our website and to gather broad demographic information.
Third party websites
Links to third party websites that are not operated or controlled by us are provided for your
convenience. We are not responsible for the privacy or security practices of those websites,
which are not covered by this Privacy Policy. Third party websites should have their own
privacy and security policies, which we encourage you to read before supplying any
personal information to them.
Data breaches
If there is any breach of your personal information, SHC Group will deal with such breach
and notify you in accordance with its obligations under the Privacy Act.
9. How long we keep your information
We will only keep the information we collect about you for as long as required for the
purposes set out above or as required to comply with any legal obligations to which we are
subject. This will involve us regularly reviewing our files to check that information is
accurate, up-to-date and still required.
If you close an account you have with us or you decide not to go ahead with purchasing a
property for which you have registered, we may still keep your information.
10. Mail and email information
If you wish to stop receiving any e-mails or other communications from SHC Group which
may be sent to you in the future, or if you have submitted personal information through the
website and would like to have that information deleted from our records, please
unsubscribe through the link at the bottom of any email or notify us at
info@theshcgroup.com
SHC Group will preserve the contents of any e-mail message that you send if we believe
that we have a legal requirement to do so. E-mails sent to or from SHC Group are routinely
monitored for quality control, systems administration and legal compliance purposes.
11. Access and Correction
11.1 General
Please contact our Privacy Officer (details under heading 13 below) if you would like to
access or correct the personal information that we hold about you. We may require you to
verify your identity before processing any access or correction requests, to make sure that
the personal information we hold is properly protected.
11.2 Access
We will generally provide you with access to your personal information, subject to some
exceptions permitted by law. We will also generally provide access in the manner that you
have requested (eg by providing photocopies or allowing a file to be viewed), provided it is
reasonable and practicable for us to do so. We may however charge a fee to cover our
reasonable costs of locating the information and providing it to you.
11.3 Correction
If you ask us to correct personal information that we hold about you, or if we are satisfied
that the personal information we hold is inaccurate, out of date, incomplete, irrelevant or
misleading, we will take reasonable steps to correct that information to ensure that, having
regard to the purpose for which it is held, the information is accurate, up-to-date,
complete, relevant and not misleading.
If we correct personal information about you, and we have previously disclosed that
information to another agency or organisation that is subject to the Privacy Act, you may
ask us to notify that other entity. If so, we will take reasonable steps to do so, unless this
would be impracticable or unlawful.
11.4 Timeframe for access and correction requests
Except in the case of more complicated requests, we will endeavour to respond to access
and correction requests within 30 days.
11.5 What if we do not agree to your request for access or correction?
If we do not agree to your access or correction request, or if we do not agree to give you
access in the manner you requested, we will provide you with a written notice setting out:
• the reasons for our decision (except to the extent that, having regard to the grounds
for refusal, it would be unreasonable to do so); and
• available complaint mechanisms.
In addition, if we refuse to correct personal information in the manner you have requested,
you may ask us to associate with the information a statement that the information is
inaccurate, out-of-date, incomplete, irrelevant or misleading, and we will take reasonable
steps to do this in such a way that will make the statement apparent to users of the
information.
12. Complaints
If you have a complaint about how we have collected or handled your personal information,
please contact our Privacy Officer (details under heading 13 below).
We will endeavour in the first instance to deal with your complaint and take any steps
necessary to resolve the matter within a week. If your complaint can’t be resolved at the
first instance, we will ask you to submit your complaint in writing.
In most cases, we expect to investigate written complaints will be investigated and a
response provided within 30 days of receipt. If the matter is more complex and our
investigation may take longer, we will write and let you know, and tell you when we expect
to provide our response.
If you are not satisfied with our response, you can refer your complaint to the Office of the
Australian Information Commissioner (see here for further information).
13. Our contact details
Please contact us if you have any queries about the personal information that we hold
about you or the way we handle that personal information. Our contact details are set out
below.
Mail: Penny Privacy Officer, Office 1/642, Doncaster Road, Doncaster VIC 3108
Email: info@theshcgroup.com
Telephone: 61 4 1133 2127
Further general information about privacy is available on the website of the Office of the
Australian Information Commissioner at www.oaic.gov.au or by calling the OAIC’s enquiry
line at 1300 363 992.
14. Changes to this Policy
We may amend this Privacy Policy from time to time. The current version will be posted on
our website and a copy may be obtained by contacting our Privacy Officer (details above).
All amended terms will automatically take effect immediately on posting. Please check this
Privacy Policy periodically to inform yourself of any changes. If you do not accept the
changes made to this Privacy Policy you should immediately stop using the website and our
products and services.
Privacy Collection Statement
This privacy collection statement relates to the collection of personal information in
relation to the EOI for the Development.
The EOI and Development are operated by SHC Group.
The SHC Group collects and uses personal information about you to engage with you in
relation to the EOI and the sale of property to you. SHC Group also uses your personal
information for related purposes including to request your feedback on the products and
services provided by SHC Group.
Wherever possible SHC Group will collect personal information directly from you including
information that you directly supply when submitting your EOI registration or application.
Such information collected includes your name, address, email address and telephone
number. If you do not provide all the personal information SHC Group requests from you,
SHC Group will not be able to contact you your EOI for a property at the Development.
SHC Group may disclose personal information about you to third party agents and service
providers to assist SHC Group in the sale of property at the Development and in the
operation of its business to provide the products and services you request. Your personal
information may also be disclosed to overseas recipients who use the personal information
to assist SHC Group in the operation its business.
The general SHC Group Privacy Policy contains information about how you may request
access to and correction of personal information SHC Group holds about you, or to make a
complaint about an alleged breach of the Australian Privacy Principles.
Promotion of other products and services
You agree to SHC Group using your personal information in relation to the EOI and to
promote its products and services to you. If you no longer wish to receive promotional
information from SHC Group, you may advise SHC Group of your wish. The general SHC
Group Privacy Policy contains information about how you may send your request to SHC
Group.
If you have any queries about privacy, please contact our Privacy Officer, SHC Group, Office
1/642 Doncaster Road, Doncaster VIC 3108, phone 614 1133 2127, or by email at
info@theshcgroup.com.