Privacy Policy

Last updated: 26 September 2026

Graham Lynham Real Estate Pty Ltd (ABN 57 139 493 815), trading as Lynham & Co. Real Estate (referred to as Lynham & Co., we, us or our), is committed to protecting your privacy and handling your personal information responsibly.

1. About this Privacy Policy

This Privacy Policy explains how we collect, hold, use, disclose and protect personal information in connection with our real estate sales, property management and related services.

We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and other applicable Australian laws.

This Policy applies to personal information we handle about individuals including property owners and prospective owners, sellers, buyers and prospective buyers, tenants and prospective tenants, occupants, guarantors, referees, contractors, suppliers, website visitors and other people who interact with us.

This Privacy Policy should be read together with any specific privacy collection notice or consent provided to you when we collect particular information.

2. What is Personal Information?

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether it is recorded in a material form or not.

Depending on the nature of your dealings with us, the personal information we collect and hold may include:

  • your name, residential, postal or business address;
  • telephone number and email address;
  • date and place of birth;
  • occupation and employment details;
  • previous residential addresses and rental history;
  • details of other occupants, dependants or persons associated with a tenancy or property;
  • emergency contact and next-of-kin information;
  • rental references and other references;
  • income, employment and financial information where reasonably required;
  • rental payment, bond and tenancy information;
  • bank account or payment information where required for payments, disbursements or refunds;
  • property ownership and property-related information;
  • information concerning properties you own, occupy, rent, wish to buy, sell or lease;
  • property enquiry, inspection and viewing information;
  • offers, expressions of interest, contracts and transaction information;
  • correspondence and records of communications with us;
  • photographs, videos and inspection records relating to properties;
  • maintenance and repair information;
  • insurance-related information;
  • information supplied in rental applications, sales enquiries, appraisal requests and other forms;
  • information about your preferences and requirements in relation to property or our services;
  • government-issued identification information such as driver licence, passport or other identification document details;
  • information collected for customer identification, verification, fraud prevention, anti-money laundering and counter-terrorism financing purposes;
  • technical information relating to your use of our website and electronic services, such as IP address, browser and device information, cookies and website usage information; and
  • any other personal information you provide to us or that we are authorised or required by law to collect.

We only collect personal information that is reasonably necessary for our functions and activities or where collection is required or authorised by law.

3. Sensitive Information

Some personal information is classified as sensitive information under the Privacy Act.

We will generally only collect sensitive information where it is reasonably necessary for our functions or activities and you have consented to its collection, or where collection is otherwise permitted or required by law.

Sensitive information may arise, for example, where information is provided in connection with an accommodation request, tenancy matter, identity verification process, legal requirement or other circumstances relevant to the services we provide.

Where biometric information, such as a facial image or video, is collected for electronic identity verification, it will be treated as sensitive information and handled accordingly.

4. How We Collect Personal Information

We generally collect personal information directly from you when you:

  • contact or correspond with us;
  • telephone, email or visit our office;
  • use our website or submit an online enquiry;
  • request a property appraisal;
  • enquire about buying, selling, renting, leasing or managing a property;
  • attend an open home or property inspection;
  • submit a rental application;
  • enter into a tenancy agreement, management agreement, sales appointment or contract;
  • make or receive an offer relating to a property;
  • request maintenance or repairs;
  • provide identification or complete an identity verification process;
  • subscribe to property alerts, newsletters or other communications;
  • interact with our staff, contractors or service providers; or
  • otherwise provide information to us in connection with our services.

We may also collect personal information about you from third parties where it is reasonable or lawful to do so, including:

  • property owners and landlords;
  • tenants, occupants and co-applicants;
  • sellers and buyers;
  • referees;
  • employers and previous employers;
  • previous landlords and property managers;
  • sales agents and other real estate professionals;
  • solicitors and conveyancers;
  • body corporate or strata managers;
  • insurers;
  • contractors and tradespeople;
  • utility and service providers;
  • property portals and property information providers;
  • tenancy databases and screening services where permitted by law;
  • identity verification providers;
  • government departments, agencies and authorities;
  • publicly available records and sources; and
  • other persons or organisations authorised by you or permitted by law to provide the information.

If you provide us with personal information about another person, you should ensure that you are authorised to do so and, where appropriate, make that person aware that their information has been provided to us.

5. Why We Collect, Hold, Use and Disclose Personal Information

We may collect, hold, use and disclose personal information for purposes including:

  • providing real estate sales and property management services;
  • marketing, selling, leasing and managing properties;
  • processing and assessing rental applications;
  • communicating with property owners, tenants, sellers, buyers, applicants and other interested parties;
  • arranging property inspections, maintenance and repairs;
  • administering tenancies, rent, bonds, invoices, payments and property expenses;
  • preparing and administering appointments, agreements, contracts and other property documentation;
  • processing enquiries, offers and transactions;
  • conducting property appraisals and market analysis;
  • managing our relationships with clients, customers, contractors and suppliers;
  • verifying identity;
  • satisfying customer due diligence and other anti-money laundering and counter-terrorism financing requirements;
  • preventing or detecting fraud, identity theft or unlawful activity;
  • responding to complaints, disputes, insurance claims and legal proceedings;
  • complying with our legal, regulatory and professional obligations;
  • maintaining the security of our systems, properties, staff and customers;
  • improving our services, systems and website;
  • maintaining business and transaction records;
  • communicating with you about properties, services and information that may be relevant to you;
  • conducting our internal business, administrative and accounting functions; and
  • any other purpose required or authorised by law or reasonably related to the purpose for which the information was collected.

Where we collect personal information for a particular purpose, we may also use or disclose it for a related purpose where you would reasonably expect us to do so or where otherwise permitted by law.

6. Rental Applications and Property Management

If you apply to rent a property or become a tenant of a property managed by us, we may collect information reasonably necessary to assess and administer your application and tenancy.

This may include identity information, contact details, rental history, employment and income information, references, details of proposed occupants and pets and other information relevant to assessing the application.

We may contact referees, employers, previous landlords or property managers and other relevant parties to verify information supplied in an application where permitted.

During a tenancy we may also collect and hold information relating to rent payments, property inspections, maintenance, repairs, communications, breaches, disputes, bond matters and the condition and use of the property.

Information may be disclosed to the property owner and other parties involved in the management of the property where reasonably necessary or permitted by law.

7. Property Sales

If you sell, buy or enquire about a property through us, we may collect personal information necessary to provide our sales services, communicate with you, facilitate inspections and offers, prepare documentation, manage the transaction and comply with our legal and regulatory obligations.

Information may be disclosed where appropriate to parties involved in a transaction, including sellers, buyers, solicitors, conveyancers, contractors, service providers, government authorities and other parties where required or authorised by law.

8. Identity Verification and AML/CTF Compliance

We may be required to collect and verify personal information to comply with our obligations under Australian anti-money laundering and counter-terrorism financing laws and other applicable legislation.

This may include collecting information such as:

  • your full legal name;
  • date of birth;
  • residential address;
  • information contained in government-issued identification documents;
  • information concerning beneficial ownership, control or authority;
  • information concerning the nature and purpose of a transaction or business relationship; and
  • other information required for customer due diligence, enhanced customer due diligence, ongoing customer due diligence, reporting or record-keeping purposes.

Where required or appropriate, we may use electronic identity verification services.

9. Document Verification Service and Electronic Identity Verification

To verify your identity, we may use electronic identity verification services, including the Australian Government’s Document Verification Service (DVS).

Where you have consented or where otherwise permitted by law, information such as your name, date of birth and identification document details may be securely provided to the relevant Commonwealth, State or Territory authority or other authorised record holder responsible for the identification document.

These authorities check whether the information you have provided matches the records they hold. We do not receive a copy of the underlying government record through this process. The verification process generally returns a result confirming whether the information supplied matches the relevant record.

We use APLYiD (APLYiD Pty Ltd, ABN 36 632 866 794) and its authorised sub-providers to facilitate electronic identity verification, including verification through the DVS.

Where applicable, APLYiD may also facilitate other identity verification processes, including electronic verification of identification documents and biometric identity verification.

Where a particular verification process requires your consent, you will be asked to provide that consent as part of the identity verification process.

10. Biometric Information

An electronic identity verification process may, where applicable and with the required consent or other lawful authority, involve biometric information such as a facial image or short video.

This information may be used to:

  • establish that you are a real person;
  • confirm that you are physically present during the verification process;
  • compare your facial image with the photograph on an identification document;
  • verify your identity; and
  • reduce the risk of fraud and identity theft.

Biometric information is sensitive information under the Privacy Act and will only be collected, used and disclosed where permitted by law.

11. Consent to Electronic Identity Verification

Where consent is required for an electronic identity verification process, we will obtain that consent before carrying out the relevant verification.

Depending on the verification process, this may include consent to:

  • the collection, use and disclosure of personal information for identity verification, AML/CTF and related compliance purposes;
  • identity information being checked against records held by Commonwealth, State or Territory authorities or other authorised record holders through the Document Verification Service (DVS);
  • personal information being provided to APLYiD (APLYiD Pty Ltd, ABN 36 632 866 794) and its authorised sub-providers for identity verification purposes; and
  • where applicable, the collection and use of biometric information, such as a facial image or video, for identity verification.

Where an electronic or biometric verification process is optional and you do not provide or later withdraw the relevant consent, we may need to verify your identity using another available method.

Where we are legally required to verify your identity and are unable to satisfactorily do so, we may be unable to provide a particular service or proceed with a transaction.

12. Disclosure of Personal Information

We may disclose personal information where reasonably necessary for our business functions, to provide our services, where you have consented, or where disclosure is required or authorised by law.

Recipients may include:

  • our employees and authorised representatives;
  • property owners and landlords;
  • sellers and buyers;
  • tenants and prospective tenants where appropriate;
  • solicitors, conveyancers, accountants, auditors and other professional advisers;
  • contractors, tradespeople and maintenance providers;
  • insurers and insurance representatives;
  • body corporate and strata managers;
  • property valuers and other property professionals;
  • utility and service providers;
  • property advertising portals and marketing providers;
  • tenancy application, reference checking and tenancy database providers;
  • payment processing and financial service providers;
  • property management, customer relationship management, inspection and maintenance software providers;
  • cloud hosting, data storage, email, communications, document management and information technology providers;
  • APLYiD (APLYiD Pty Ltd, ABN 36 632 866 794), its authorised sub-providers and other identity verification and customer due diligence providers;
  • Commonwealth, State and Territory authorities and authorised record holders for the purposes of identity verification, including through the DVS;
  • AUSTRAC and other government agencies or regulators where disclosure is required or authorised by law;
  • courts, tribunals and law enforcement agencies;
  • parties involved in a legal proceeding, dispute or insurance claim where permitted by law; and
  • other persons or organisations where you have authorised the disclosure or where disclosure is otherwise permitted or required by law.

We do not sell your personal information.

13. Overseas Disclosure and Cloud Services

We use technology, cloud-based software and service providers to operate our business. Some providers may store, process or provide access to personal information using systems or personnel located outside Australia.

Where personal information is disclosed to an overseas recipient, we will handle the disclosure in accordance with applicable requirements of the Privacy Act.

The countries in which overseas recipients are located may vary depending on the service providers and systems we use from time to time. Where it is practicable to identify the countries in which recipients of personal information are likely to be located, we will make that information available through this Policy or an associated privacy notice.

14. Website, Cookies and Analytics

When you visit our website, certain technical information may be collected automatically, including your IP address, browser type, device information, pages visited, referring website and the date and time of your visit.

Our website may use cookies and similar technologies to:

  • enable website functionality;
  • remember preferences;
  • understand how visitors use our website;
  • measure website performance;
  • improve our website and services; and
  • support advertising and marketing activities where applicable.

Cookies are small data files stored on or associated with your device.

You can generally configure your browser to reject or limit cookies. Disabling some cookies may affect the functionality of our website.

Our website may also contain links to third-party websites or services. Those third parties have their own privacy practices and we encourage you to review their privacy policies. We are not responsible for the privacy practices or content of third-party websites merely because our website contains a link to them.

15. Direct Marketing and Property Communications

Where permitted by law, we may use your personal information to communicate with you about:

  • properties for sale or lease;
  • property market updates;
  • appraisal opportunities;
  • real estate and property management services;
  • newsletters;
  • events; and
  • other information we reasonably believe may be relevant or of interest to you.

You can ask us to stop sending direct marketing communications at any time.

Where an electronic marketing communication contains an unsubscribe facility, you can use that facility. You can also contact us directly and ask to be removed from a particular marketing list.

We will take reasonable steps to action an opt-out request in accordance with applicable law.

Opting out of marketing communications will not prevent us from sending communications that are reasonably necessary to provide services to you, administer a transaction, manage a property or tenancy, or comply with our legal obligations.

16. Anonymity and Pseudonyms

Where practicable and lawful, you may interact with us anonymously or by using a pseudonym.

However, because of the nature of real estate transactions and property management, there will be many circumstances where it is impracticable for us to provide our services without knowing your identity or where we are required by law to identify and verify you.

17. Accuracy of Personal Information

We take reasonable steps to ensure that the personal information we collect, use and disclose is accurate, complete and up to date where appropriate.

We ask that you tell us if your personal information changes or if you believe information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading.

18. Security of Personal Information

We take reasonable steps to protect personal information from misuse, interference and loss and from unauthorised access, modification or disclosure.

Depending on the information and systems involved, these measures may include:

  • access controls and user permissions;
  • password and authentication controls;
  • secure cloud and information technology systems;
  • physical security measures;
  • staff policies and procedures;
  • appropriate contractual arrangements with service providers; and
  • encryption and other technical security measures where appropriate.

No method of electronic transmission or storage can be guaranteed to be completely secure. If you communicate personal information electronically, you should also take reasonable precautions to protect your information.

19. Retention and Destruction

We retain personal information for as long as reasonably necessary for the purposes for which it was collected and to meet our legal, regulatory, taxation, accounting, insurance, dispute resolution and record-keeping obligations.

The period for which information is retained will depend upon the type of information and the circumstances in which it was collected.

When personal information is no longer required to be retained and we are not legally required to retain it, we will take reasonable steps to destroy it or de-identify it in accordance with applicable law.

20. Data Breaches

We have procedures for responding to suspected or actual privacy and data security incidents.

If we become aware of a data breach involving personal information, we will assess and respond to the