1. About This Policy

Mowhawk Pty Ltd (ABN 40 087 351 102) ("Mowhawk", "we", "us", "our") operates the Mowhawk platform at mowhawk.com.au. We are committed to protecting the privacy of all individuals who interact with our platform, including property buyers, sellers, renters, landlords, tradespeople, strata managers, and visitors.

This Privacy Policy is issued in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in Schedule 1 of that Act. We handle personal information responsibly and only for purposes that are necessary to operate and improve the platform.

This policy should be read together with our Platform Terms & Conditions and any applicable Role-Specific Terms.

2. What Personal Information We Collect

The types of personal information we collect depend on how you use the platform and which role(s) you select. We collect only the information reasonably necessary for our functions and activities.

2.1 All Users

When you create an account we collect: full name; email address; mobile phone number; date of birth; residential address; and account login credentials (stored in encrypted form).

2.2 Identity Verification (VOI)

Where required — including for buyers submitting offers, sellers listing properties, and tradespeople onboarding — we collect: copies of government-issued identification documents (e.g. driver licence, passport); a selfie or biometric facial image (processed by our VOI provider, bronID); and VOI completion status and reference numbers.

VOI data is collected and processed in accordance with the ARNECC Model Participation Rules and is shared with our network conveyancers as required for settlement purposes.

2.3 Sellers

In addition to the above, sellers provide: property details and listing content including photos, videos, and descriptions; pricing and auction information; and ownership or authority documentation.

2.4 Buyers

In addition to the above, buyers provide: property search preferences; offer details and terms; finance pre-approval documentation (where provided); and bid registration details for auction.

2.5 Landlords

In addition to the above, landlords provide: rental property details and listing content; property management preferences; and bank account details for rent disbursements (processed via Stripe).

2.6 Renters

In addition to the above, renters provide: rental application information including employment history, income details, and rental history; references (including third-party referee personal information); and tenancy payment details.

2.7 Tradespeople

In addition to the above, tradespeople provide: trade licence number(s) and category; public liability insurance details and certificate of currency; business name and ABN (where applicable); and bank account details for payment disbursements (processed via Stripe Connect).

2.8 Strata Managers

In addition to the above, strata managers provide: strata management licence details; details of owners corporations under management; and contact information for lot owners (as provided in the course of management).

2.9 Automatically Collected Information

When you use the platform, we automatically collect: IP address and approximate location; device type, operating system, and browser information; pages visited, features used, and time spent on the platform; and error logs and performance data.

2.10 Third-Party Sourced Information

We may receive personal information about you from: property data providers (such as LANDATA and Vicmap Planning); identity verification providers; reference check providers; and marketing and analytics platforms.

3. How We Collect Personal Information

We collect personal information in the following ways:

• Directly from you — when you register, complete your profile, submit a listing, make or accept an offer, apply for a rental, complete VOI, or contact us;
• Through the platform — automatically when you use platform features, browse listings, or interact with other users;
• From third parties — including property data providers, identity verification services, financial institutions (via Stripe Financial Connections where applicable), and public registries;
• From other users — for example, when a landlord provides renter contact details or when a seller engages a buyer through the platform.

4. Why We Collect and Use Personal Information

4.1 Providing the Platform

• Creating and managing your account;
• Facilitating property listings, offers, tenancy applications, and transactions;
• Processing payments and disbursements;
• Enabling communication between platform users;
• Generating and managing leases, contracts, and settlement documents;
• Coordinating identity verification and settlement services with network conveyancers.

4.2 Safety and Verification

• Verifying the identity of users in accordance with ARNECC VOI requirements;
• Verifying trade licences against the Building and Plumbing Commission (BPC) dataset;
• Verifying gas and electrical licences with Energy Safe Victoria (ESV);
• Detecting and preventing fraud, money laundering, and other illegal activity;
• Maintaining the security and integrity of the platform.

4.3 Legal and Regulatory Compliance

• Complying with obligations under the Privacy Act 1988 (Cth), the Residential Tenancies Act 1997 (Vic), the Sale of Land Act 1962 (Vic), the Owners Corporations Act 2006 (Vic), the Estate Agents Act 1980 (Vic), and other applicable laws;
• Responding to lawful requests from government agencies and law enforcement;
• Maintaining records required by applicable legislation.

4.4 Improving the Platform

• Analysing usage data to improve features and user experience;
• Conducting internal research and product development;
• Monitoring platform performance and resolving technical issues.

4.5 Communications and Marketing

• Sending transactional communications including account notifications, payment receipts, and listing updates;
• Sending service-related announcements (e.g. changes to terms or policy);
• Where you have consented, sending marketing communications about Mowhawk products and services.

You may opt out of marketing communications at any time by clicking the unsubscribe link in any email or contacting us at privacy@mowhawk.com.au.

4.6 AI-Assisted Features

Mowhawk uses artificial intelligence tools to assist with document drafting, listing creation, and property analysis. Personal information used in AI-assisted features is processed in accordance with this policy and our agreements with AI service providers. AI-generated outputs do not constitute legal, financial, or professional advice.

5. Disclosure of Personal Information

We disclose personal information only where necessary and as described in this policy. We do not sell personal information to third parties.

5.1 Other Platform Users

Certain information is necessarily shared with other platform users in the course of a transaction. For example: a seller's contact details are visible to buyers; a buyer's offer details and VOI confirmation are shared with the seller and network conveyancer; a renter's application details are shared with the relevant landlord; and a tradesperson's name, trade, and licence details are visible to property owners who engage them.

Users who receive personal information about other users must handle it in accordance with the Privacy Act 1988 (Cth) and must not use it for any purpose beyond the relevant transaction.

5.2 Network Conveyancers

Where a sale or purchase is progressed through the platform, we share relevant personal information (including VOI data, offer details, and contact information) with the appointed licensed Victorian conveyancer. Conveyancers are bound by their own professional obligations and by confidentiality agreements with Mowhawk.

5.3 Third-Party Service Providers

We engage third-party service providers who are contractually required to handle personal information only for the purposes we specify and in accordance with applicable privacy law.

5.4 Regulatory and Government Bodies

We may disclose personal information to government agencies or law enforcement where required or authorised by law. This includes the RTBA for bond lodgement; PEXA and Land Use Victoria for settlement; the Building and Plumbing Commission for licence verification; and Energy Safe Victoria for licence verification.

5.5 Business Transfers

If Mowhawk is involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will notify affected users in advance where reasonably practicable.

5.6 With Your Consent

We may disclose personal information for other purposes with your express consent.

6. Cross-Border Disclosure

Some of our third-party service providers store or process data outside Australia, including in the United States and the European Union. Where we disclose personal information to overseas recipients, we take reasonable steps to ensure those recipients handle your information consistently with the Australian Privacy Principles.

By using the platform, you consent to the transfer of your personal information to overseas recipients as described in this policy.

7. Storage and Security

7.1 How We Store Information

Personal information is stored in Supabase cloud infrastructure with role-based access controls to limit access to authorised platform functions and personnel.

7.2 Security Measures

We implement the following security measures:

• Encryption of data in transit using TLS;
• Encryption of sensitive data at rest;
• Two-factor authentication (2FA) available to all users and required for certain roles;
• Role-based access controls limiting internal access to personal information;
• Regular security assessments and platform monitoring via New Relic;
• Contractual security obligations on all third-party service providers.

In the event of a data breach likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required by the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act 1988 (Cth).

7.3 Retention

We retain personal information for as long as necessary to provide the platform services and to meet our legal obligations:

• Account information: retained for the life of the account and for 7 years following account closure;
• Transaction records: retained for 7 years following the conclusion of the transaction;
• VOI data: retained for a minimum of 7 years following the relevant transaction (ARNECC requirements);
• Marketing data: retained until you withdraw consent or request deletion;
• Application logs and technical data: retained for up to 12 months.

When personal information is no longer required, we take reasonable steps to destroy or de-identify it securely.

8. Cookies and Tracking

The Mowhawk platform uses cookies and similar tracking technologies to operate the platform and improve your experience. We use:

• Essential cookies — necessary for platform functionality including authentication and session management;
• Analytics cookies — used to understand how users interact with the platform;
• Marketing cookies — used to deliver relevant advertising where you have consented, including via Meta platforms.

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect your ability to use the platform.

9. Your Privacy Rights

9.1 Access

You have the right to request access to the personal information we hold about you. We will respond within 30 days.

9.2 Correction

If you believe personal information we hold is inaccurate or out of date, you may request correction. You can update most account information through your account settings. For other requests, contact privacy@mowhawk.com.au.

9.3 Deletion

You may request deletion of your personal information where we are not legally required to retain it. Deletion of your account will prevent you from using the platform and may affect active transactions.

9.4 Opt-Out of Marketing

You may opt out of marketing communications at any time via the unsubscribe link in any email or by contacting privacy@mowhawk.com.au.

9.5 Complaints

If you believe we have handled your personal information in breach of the Australian Privacy Principles, contact us at privacy@mowhawk.com.au. We will respond within 30 days. If you are not satisfied, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or by calling 1300 363 992.

10. Sensitive Information

We do not intentionally collect sensitive information unless reasonably necessary and with your consent. Biometric facial images collected during VOI are used solely for identity verification and are processed by bronID. We do not retain biometric images beyond the period required for verification. Financial information is handled by Stripe and is not stored on Mowhawk's servers.

11. Children's Privacy

The Mowhawk platform is not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected personal information from a person under 18, please contact privacy@mowhawk.com.au.

12. Links to Third-Party Sites

The platform may contain links to third-party websites and services. This Privacy Policy does not apply to those websites. We encourage you to review the privacy policies of any third-party sites you visit.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Where we make a material change, we will notify you via email or in-platform notification at least 14 days before the change takes effect. The current version is always available at mowhawk.com.au/privacy.

14. Contact Us

Privacy Officer
Mowhawk Pty Ltd (ABN 40 087 351 102)
Email: privacy@mowhawk.com.au
Website: mowhawk.com.au/privacy

We will acknowledge receipt of your enquiry within 5 business days and respond substantively within 30 days.