Privacy Policy – AML

Privacy Policy Ray White Bacchus MarshLast updated: 16 June 2026 1. Introduction Ray White Bacchus Marsh (“we”, “us”, “our”) is committed to protecting your personal information and handling it in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This Privacy Policy explains how we collect, use, store, disclose and protect personal information, including information used to verify your identity. A current version of this Policy is always available on our website at www.raywhitebacchusmarsh.com.au. 2. What Personal Information We Collect We may collect the following personal information about you:

• Full name
• Date and place of birth
• Residential or business address
• Email address and phone number
• Government-issued identification details, such as driver licence, passport, Medicare card or other ID document numbers
• Biometric information, such as a facial image or short video used to verify your identity
• Financial information where required to provide our services
• Information about properties you buy, sell, lease, manage or enquire about
• Information about the services we provide to you and any related transactions
• Any other information you choose to provide to us

We only collect personal information that is reasonably necessary to carry out our business activities, including real estate sales, property management, leasing and compliance obligations. 3. Why We Collect Your Personal Information We collect, use and disclose your personal information to:

• Verify your identity
• Provide and manage our real estate and property management services
• Facilitate the sale, purchase, leasing and management of properties
• Communicate with you regarding your account, property or transaction
• Meet our legal and regulatory obligations, including anti-money laundering and counter-terrorism financing (AML/CTF) requirements
• Detect and prevent fraud and maintain the security of our systems
• Improve our services and customer experience
• Conduct market research and service analysis

4. Identity Verification and Government Data Matching (DVS) To verify your identity, we may use electronic identity verification services, including the Australian Government’s Document Verification Service (DVS). Where you have consented, your name, date of birth and identity document details may be securely sent to the relevant Commonwealth or State authority that issued your document. This may include passport offices, driver licence authorities, the Department of Home Affairs, Births, Deaths and Marriages registries, or other authorised record holders. These authorities check whether the details you have provided match the records they hold. We do not receive a copy of your government records. The authority returns a match result only, confirming whether your details match (yes or no). This process may be carried out through accredited identity verification providers, including APLYiD Pty Ltd (ABN 36 632 866 794) and its authorised sub-providers. More information about the DVS is available at idmatch.gov.au. 5. Biometric Information As part of identity verification, we may collect biometric information, such as a facial image or short video of you holding your identification document. Biometric information may be used to:

• Confirm that you are a real person and physically present
• Match your image to the photograph on your identification document
• Reduce the risk of fraud and identity theft
• Meet our AML/CTF compliance obligations

Biometric information is treated as sensitive information under the Privacy Act. We only use it for identity verification and related compliance purposes, and only with your consent. 6. Consent to Collection and Identity Verification By providing your personal information and completing the identity verification process, you consent to:

• The collection, use and disclosure of your personal information for identity verification, AML/CTF and related compliance purposes
• The collection and use of biometric information, such as a facial image or video, for identity verification
• Your information being checked against records held by Commonwealth and State authorities through the DVS
• Your information being shared with our authorised identity verification providers, including APLYiD

Your consent is voluntary. You can withdraw your consent at any time by contacting us using the details in section 13. If you do not consent, or do not provide the information we require, we may not be able to verify your identity electronically. In that case, we may need to verify your identity in another way, or we may not be able to provide our services. 7. Disclosure of Personal Information We may disclose your personal information to:

• Identity verification providers, including APLYiD and its authorised sub-providers
• Commonwealth and State authorities and official record holders through the DVS
• Our employees and authorised representatives on a need-to-know basis
• The wider Ray White network where necessary to provide services
• Property owners, tenants, purchasers, vendors and their representatives where required in a transaction
• Financial institutions, mortgage brokers and conveyancers involved in a transaction
• Professional advisers such as lawyers, accountants and auditors
• Trusted technology and service providers that help us operate our business
• Regulators, law enforcement agencies or other third parties where required or authorised by law

We do not sell your personal information. 8. Overseas Disclosure Some of our service providers may store or process personal information outside Australia. Where this occurs, we take reasonable steps to ensure that your personal information is handled in accordance with the Australian Privacy Principles, including through contractual protections with our providers. 9. Data Security and Storage We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification or disclosure. These measures include:

• Secure systems and access controls
• Encryption in transit and at rest where appropriate
• Staff training and confidentiality obligations
• Secure disposal and retention procedures

We retain personal information only for as long as necessary for the purposes set out in this Policy or as required by law. When information is no longer required, we securely delete or de-identify it. 10. Access and Correction You have the right to request access to the personal information we hold about you and to request correction if it is inaccurate, incomplete or out of date. To make a request, please contact us using the details in section 13. We will respond within a reasonable time. 11. Direct Marketing From time to time, we may use your contact details to send information about properties, market updates and services that may be of interest to you. You may opt out of marketing communications at any time by using the unsubscribe link in our communications or by contacting us directly. 12. Privacy Complaints If you have a complaint about how we have handled your personal information, please contact us first using the details below. We will acknowledge your complaint, investigate it, and respond within a reasonable time. If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au. 13. Contact Details Business name: Ray White Bacchus Marsh Privacy contact: Office Manager Email:reception.bacchusmarsh@raywhite.comPhone: (03) 4310 0849 Address: Shop 31, The Village Bacchus Marsh, 160–194 Main Street, Bacchus Marsh VIC 3340 14. Updates to This Policy We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal obligations or industry requirements. The latest version will always be available on our website. Where changes are significant, we will take reasonable steps to notify affected individuals.