Graham Lynham Real Estate Pty Limited ABN 95 140 836 997 and Graham Lynham Real Estate (Rentals) Pty Limited ABN 57 139 493 815, trading as Lynham & Co. Real Estate (together referred to as Lynham & Co., we, us or our), are committed to protecting your privacy and handling your personal information responsibly.
Last updated: 28 August 2026
1. About this Privacy Policy
This Privacy Policy explains how we collect, hold, use, disclose and protect personal information in connection with our real estate sales, property management and related services.
We are committed to handling personal information in accordance with the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs) and other applicable Australian laws.
This Policy applies to personal information we handle about individuals including property owners and prospective owners, sellers, buyers and prospective buyers, tenants and prospective tenants, occupants, guarantors, referees, contractors, suppliers, website visitors and other people who interact with us.
This Privacy Policy should be read together with any specific privacy collection notice or consent provided to you when we collect particular information.
2. What is Personal Information?
Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether it is recorded in a material form or not.
Depending on the nature of your dealings with us, the personal information we collect and hold may include:
- your name, residential, postal or business address;
- telephone number and email address;
- date and place of birth;
- occupation and employment details;
- previous residential addresses and rental history;
- details of other occupants, dependants or persons associated with a tenancy or property;
- emergency contact and next-of-kin information;
- rental references and other references;
- income, employment and financial information where reasonably required;
- rental payment, bond and tenancy information;
- bank account or payment information where required for payments, disbursements or refunds;
- property ownership and property-related information;
- information concerning properties you own, occupy, rent, wish to buy, sell or lease;
- property enquiry, inspection and viewing information;
- offers, expressions of interest, contracts and transaction information;
- correspondence and records of communications with us;
- photographs, videos and inspection records relating to properties;
- maintenance and repair information;
- insurance-related information;
- information supplied in rental applications, sales enquiries, appraisal requests and other forms;
- information about your preferences and requirements in relation to property or our services;
- government-issued identification information such as driver licence, passport or other identification document details;
- information collected for customer identification, verification, fraud prevention, anti-money laundering and counter-terrorism financing purposes;
- technical information relating to your use of our website and electronic services, such as IP address, browser and device information, cookies and website usage information; and
- any other personal information you provide to us or that we are authorised or required by law to collect.
We only collect personal information that is reasonably necessary for our functions and activities or where collection is required or authorised by law.
3. Sensitive Information
Some personal information is classified as sensitive information under the Privacy Act.
We will generally only collect sensitive information where it is reasonably necessary for our functions or activities and you have consented to its collection, or where collection is otherwise permitted or required by law.
Sensitive information may arise, for example, where information is provided in connection with an accommodation request, tenancy matter, identity verification process, legal requirement or other circumstances relevant to the services we provide.
Where biometric information, such as a facial image or video, is collected for electronic identity verification, it will be treated as sensitive information and handled accordingly.
4. How We Collect Personal Information
We generally collect personal information directly from you when you:
- contact or correspond with us;
- telephone, email or visit our office;
- use our website or submit an online enquiry;
- request a property appraisal;
- enquire about buying, selling, renting, leasing or managing a property;
- attend an open home or property inspection;
- submit a rental application;
- enter into a tenancy agreement, management agreement, sales appointment or contract;
- make or receive an offer relating to a property;
- request maintenance or repairs;
- provide identification or complete an identity verification process;
- subscribe to property alerts, newsletters or other communications;
- interact with our staff, contractors or service providers; or
- otherwise provide information to us in connection with our services.
We may also collect personal information about you from third parties where it is reasonable or lawful to do so, including:
- property owners and landlords;
- tenants, occupants and co-applicants;
- sellers and buyers;
- referees;
- employers and previous employers;
- previous landlords and property managers;
- sales agents and other real estate professionals;
- solicitors and conveyancers;
- body corporate or strata managers;
- insurers;
- contractors and tradespeople;
- utility and service providers;
- property portals and property information providers;
- tenancy databases and screening services where permitted by law;
- identity verification providers;
- government departments, agencies and authorities;
- publicly available records and sources; and
- other persons or organisations authorised by you or permitted by law to provide the information.
If you provide us with personal information about another person, you should ensure that you are authorised to do so and, where appropriate, make that person aware that their information has been provided to us.
5. Why We Collect, Hold, Use and Disclose Personal Information
We may collect, hold, use and disclose personal information for purposes including:
- providing real estate sales and property management services;
- marketing, selling, leasing and managing properties;
- processing and assessing rental applications;
- communicating with property owners, tenants, sellers, buyers, applicants and other interested parties;
- arranging property inspections, maintenance and repairs;
- administering tenancies, rent, bonds, invoices, payments and property expenses;
- preparing and administering appointments, agreements, contracts and other property documentation;
- processing enquiries, offers and transactions;
- conducting property appraisals and market analysis;
- managing our relationships with clients, customers, contractors and suppliers;
- verifying identity;
- satisfying customer due diligence and other anti-money laundering and counter-terrorism financing requirements;
- preventing or detecting fraud, identity theft or unlawful activity;
- responding to complaints, disputes, insurance claims and legal proceedings;
- complying with our legal, regulatory and professional obligations;
- maintaining the security of our systems, properties, staff and customers;
- improving our services, systems and website;
- maintaining business and transaction records;
- communicating with you about properties, services and information that may be relevant to you;
- conducting our internal business, administrative and accounting functions; and
- any other purpose required or authorised by law or reasonably related to the purpose for which the information was collected.
Where we collect personal information for a particular purpose, we may also use or disclose it for a related purpose where you would reasonably expect us to do so or where otherwise permitted by law.
6. Rental Applications and Property Management
If you apply to rent a property or become a tenant of a property managed by us, we may collect information reasonably necessary to assess and administer your application and tenancy.
This may include identity information, contact details, rental history, employment and income information, references, details of proposed occupants and pets and other information relevant to assessing the application.
We may contact referees, employers, previous landlords or property managers and other relevant parties to verify information supplied in an application where permitted.
During a tenancy we may also collect and hold information relating to rent payments, property inspections, maintenance, repairs, communications, breaches, disputes, bond matters and the condition and use of the property.
Information may be disclosed to the property owner and other parties involved in the management of the property where reasonably necessary or permitted by law.
7. Property Sales
If you sell, buy or enquire about a property through us, we may collect personal information necessary to provide our sales services, communicate with you, facilitate inspections and offers, prepare documentation, manage the transaction and comply with our legal and regulatory obligations.
Information may be disclosed where appropriate to parties involved in a transaction, including sellers, buyers, solicitors, conveyancers, contractors, service providers, government authorities and other parties where required or authorised by law.
8. Identity Verification and AML/CTF Compliance
We may be required to collect and verify personal information to comply with our obligations under Australian anti-money laundering and counter-terrorism financing laws and other applicable legislation.
This may include collecting information such as:
- your full legal name;
- date of birth;
- residential address;
- information contained in government-issued identification documents;
- information concerning beneficial ownership, control or authority;
- information concerning the nature and purpose of a transaction or business relationship; and
- other information required for customer due diligence, enhanced customer due diligence, ongoing customer due diligence, reporting or record-keeping purposes.
Where required or appropriate, we may use electronic identity verification services.
9. Document Verification Service and Electronic Identity Verification
Where we use electronic identity verification, information you provide may be checked using the Australian Government’s Document Verification Service (DVS) or other lawful verification services.
Where you have consented or where otherwise permitted by law, information such as your name, date of birth and identification document details may be securely provided to an authorised identity verification provider and checked against records held by the Commonwealth, State or Territory authority responsible for the relevant document.
The verification process generally confirms whether the information supplied matches the relevant government record. We do not receive access to the underlying government record merely by undertaking a DVS check.
Electronic identity verification may be carried out by an authorised third-party identity verification provider and its authorised service providers.
Where a particular provider requires additional consents or provides its own privacy collection notice, these may be provided to you as part of the verification process.
10. Biometric Information
An electronic identity verification process may, where applicable and with the required consent or other lawful authority, involve biometric information such as a facial image or short video.
This information may be used to:
- establish that you are a real person;
- confirm that you are physically present during the verification process;
- compare your facial image with the photograph on an identification document;
- verify your identity; and
- reduce the risk of fraud and identity theft.
Biometric information is sensitive information under the Privacy Act and will only be collected, used and disclosed where permitted by law.
If you do not consent to an optional electronic or biometric identity verification process, we may need to verify your identity using an alternative method. In some circumstances, if we cannot satisfy a legal requirement to verify your identity, we may be unable to provide a particular service or proceed with a transaction.
11. Disclosure of Personal Information
We may disclose personal information where reasonably necessary for our business functions, to provide our services, where you have consented, or where disclosure is required or authorised by law.
Recipients may include:
- our related companies;
- our employees and authorised representatives;
- property owners and landlords;
- sellers and buyers;
- tenants and prospective tenants where appropriate;
- solicitors, conveyancers, accountants, auditors and other professional advisers;
- contractors, tradespeople and maintenance providers;
- insurers and insurance representatives;
- body corporate and strata managers;
- property valuers and other property professionals;
- utility and service providers;
- property advertising portals and marketing providers;
- tenancy application, reference checking and tenancy database providers;
- payment processing and financial service providers;
- property management, customer relationship management, inspection and maintenance software providers;
- cloud hosting, data storage, email, communications, document management and information technology providers;
- identity verification and customer due diligence providers;
- Commonwealth, State, Territory and local government authorities;
- AUSTRAC and other regulators;
- courts, tribunals and law enforcement agencies;
- parties involved in a legal proceeding, dispute or insurance claim where permitted by law; and
- other persons or organisations where you have authorised the disclosure or where disclosure is otherwise permitted or required by law.
We do not sell your personal information.
12. Overseas Disclosure and Cloud Services
We use technology, cloud-based software and service providers to operate our business. Some providers may store, process or provide access to personal information using systems or personnel located outside Australia.
Where personal information is disclosed to an overseas recipient, we will handle the disclosure in accordance with applicable requirements of the Privacy Act.
The countries in which overseas recipients are located may vary depending on the service providers and systems we use from time to time. Where it is practicable to identify the countries in which recipients of personal information are likely to be located, we will make that information available through this Policy or an associated privacy notice.
13. Website, Cookies and Analytics
When you visit our website, certain technical information may be collected automatically, including your IP address, browser type, device information, pages visited, referring website and the date and time of your visit.
Our website may use cookies and similar technologies to:
- enable website functionality;
- remember preferences;
- understand how visitors use our website;
- measure website performance;
- improve our website and services; and
- support advertising and marketing activities where applicable.
Cookies are small data files stored on or associated with your device.
You can generally configure your browser to reject or limit cookies. Disabling some cookies may affect the functionality of our website.
Our website may also contain links to third-party websites or services. Those third parties have their own privacy practices and we encourage you to review their privacy policies. We are not responsible for the privacy practices or content of third-party websites merely because our website contains a link to them.
14. Direct Marketing and Property Communications
Where permitted by law, we may use your personal information to communicate with you about:
- properties for sale or lease;
- property market updates;
- appraisal opportunities;
- real estate and property management services;
- newsletters;
- events; and
- other information we reasonably believe may be relevant or of interest to you.
You can ask us to stop sending direct marketing communications at any time.
Where an electronic marketing communication contains an unsubscribe facility, you can use that facility. You can also contact us directly and ask to be removed from a particular marketing list.
We will take reasonable steps to action an opt-out request in accordance with applicable law.
Opting out of marketing communications will not prevent us from sending communications that are reasonably necessary to provide services to you, administer a transaction, manage a property or tenancy, or comply with our legal obligations.
15. Anonymity and Pseudonyms
Where practicable and lawful, you may interact with us anonymously or by using a pseudonym.
However, because of the nature of real estate transactions and property management, there will be many circumstances where it is impracticable for us to provide our services without knowing your identity or where we are required by law to identify and verify you.
16. Accuracy of Personal Information
We take reasonable steps to ensure that the personal information we collect, use and disclose is accurate, complete and up to date where appropriate.
We ask that you tell us if your personal information changes or if you believe information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading.
17. Security of Personal Information
We take reasonable steps to protect personal information from misuse, interference and loss and from unauthorised access, modification or disclosure.
Depending on the information and systems involved, these measures may include:
- access controls and user permissions;
- password and authentication controls;
- secure cloud and information technology systems;
- physical security measures;
- staff policies and procedures;
- appropriate contractual arrangements with service providers; and
- encryption and other technical security measures where appropriate.
No method of electronic transmission or storage can be guaranteed to be completely secure. If you communicate personal information electronically, you should also take reasonable precautions to protect your information.
18. Retention and Destruction
We retain personal information for as long as reasonably necessary for the purposes for which it was collected and to meet our legal, regulatory, taxation, accounting, insurance, dispute resolution and record-keeping obligations.
The period for which information is retained will depend upon the type of information and the circumstances in which it was collected.
When personal information is no longer required to be retained and we are not legally required to retain it, we will take reasonable steps to destroy it or de-identify it in accordance with applicable law.
19. Data Breaches
We have procedures for responding to suspected or actual privacy and data security incidents.
If we become aware of a data breach involving personal information, we will assess and respond to the incident in accordance with our obligations under the Privacy Act.
Where the Notifiable Data Breaches scheme requires us to do so, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) of an eligible data breach.
20. Access to Your Personal Information
You may request access to personal information we hold about you.
Requests should be made to our Privacy Officer using the contact details below.
We will respond to requests within a reasonable period and provide access in the manner requested where it is reasonable and practicable to do so.
In some circumstances we may be permitted or required by law to refuse access to some or all of the information requested. If we refuse access where the Privacy Act requires us to provide reasons, we will explain the reason for the refusal and available complaint mechanisms.
We may need to verify your identity before providing access to personal information.
21. Correction of Personal Information
If you believe personal information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, you may ask us to correct it.
We will take reasonable steps to consider and respond to your request in accordance with the Privacy Act.
We may need to verify your identity before acting on a correction request.
22. Privacy Complaints
If you have a concern or complaint about how we have collected, held, used or disclosed your personal information or believe we have breached the Australian Privacy Principles, please contact our Privacy Officer.
Please provide sufficient information for us to understand and investigate your complaint.
We will acknowledge and investigate privacy complaints and aim to provide a response within 30 days, although more complex matters may require additional time. If additional time is required, we will endeavour to keep you informed.
If you are not satisfied with our response, you may be entitled to lodge a complaint with the Office of the Australian Information Commissioner (OAIC).
Information about making a privacy complaint is available at the OAIC website: www.oaic.gov.au.
23. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our business practices, technology, service providers or legal and regulatory obligations.
The current version will be published on our website.
Where appropriate, we may also notify affected individuals of significant changes through other reasonable means.
24. Contact Us
For questions about this Privacy Policy, requests to access or correct personal information, privacy complaints or other privacy enquiries, please contact:
Privacy Officer
Lynham & Co. Real Estate
37 Thuringowa Drive
Kirwan QLD 4817
Phone: 07 4723 3222
Email: office@lynham.com.au
Graham Lynham Real Estate (Rentals) Pty Limited
ABN 57 139 493 815