Privacy Policy

1. Privacy at a glance

Before we get into the detail, here are the most important things to know:

• We collect information needed to provide, support and secure the Platform and to meet our legal obligations.
• Real estate agencies may upload information about tenants, applicants, owners, occupants and contractors. In many cases, the agency decides why that information is collected and used, and we process it to provide the Platform.
• We also collect some information for our own purposes, including account, security, support, website, billing and product-improvement information.
• Personal information may be stored or processed in New Zealand and Australia and, where necessary, in other countries used by our service providers. We apply safeguards required by applicable law.
• We do not sell personal information.
• You can ask to access or correct your personal information and can contact our Privacy Officer with questions or complaints.
• You can manage non-essential cookies through your browser settings and unsubscribe from marketing at any time.

2. What is personal information?

Personal information is information about an identifiable individual. It may include facts, opinions, images, recordings or other information that identifies a person or can reasonably be linked with them. Some information may be personal information even if it does not include the person's name—for example, a property address, account identifier or combination of details that identifies them.

Sensitive information is personal information that is particularly private or revealing, such as health, genetic or biometric information, racial or ethnic origin, religious or political beliefs, sexual orientation or criminal history.

3. What personal information we collect

The information we collect depends on who you are, how you interact with us and which Platform features are used. It may include:

You do not have to provide personal information to us unless it is required by law or needed for a particular Platform feature. However, if you do not provide required information, we or the relevant agency may not be able to create your account, authenticate your access or provide the relevant feature or service.

How information is managed on the Platform

The Platform is used by subscribing real estate agencies and other property businesses (agencies) to manage their rental portfolios.

Agency-managed information: an agency may collect and upload personal information and decide how it is used for property and tenancy management. Subject to the Services Agreement, we generally handle that information on the agency's instructions. The agency remains responsible for its own collection notices, authority and privacy obligations.

Information we manage for our own purposes: we decide how to use information needed to run our business and the Platform—for example, account registration, security logs, support requests, billing, website analytics, legal compliance and communications from us.

If your request concerns a tenancy record or information supplied by your agency, we may refer you to that agency or work with it to respond. We will not use agency-managed personal information for unrelated advertising or sell it.

Information you or an authorised user provide

• identity and contact details, such as your name, preferred name, date of birth, address, email address and phone number;
• account and organisation details, such as employer or agency, role, username, authentication information, permissions and communication preferences;
• property and tenancy information, such as property address, tenancy or application details, lease dates, rent, bond, arrears, household members, occupants, pets and property-owner information;
• financial and transaction information, such as billing details, bank account information, rent or payment records and payment status. Full payment-card details are generally handled by our payment provider rather than stored by us;
• application and verification information, which may include employment, income, references, identity documents and background-check results where the relevant agency is lawfully entitled to collect them;
• inspection, maintenance and property records, including photographs, videos, condition reports, access arrangements, repair requests, invoices and contractor details;
• communications and support information, including messages sent through the Platform, emails, enquiries, complaints, feedback and records of assistance we provide; and
• recruitment or supplier information if you apply to work with us or provide services to our business.

Information collected automatically

When you visit or use the Platform, we and our technology providers may automatically collect:

• IP address, device identifiers, browser, operating system and general device information;
• login times, pages and features used, clicks, navigation, referring pages and session information;
• security, audit and diagnostic logs, including actions taken within an account and error or crash information;
• approximate location derived from an IP address and, only if an enabled feature requires it and your device permissions allow it, more precise location information; and
• information about whether service or marketing messages were delivered, opened or used.

Information from other people and organisations

We commonly receive personal information from someone other than the person it relates to, including from:

• real estate agencies, landlords, property owners, tenants, applicants, occupants, guarantors, referees and contractors;
• an organisation that creates or administers your account;
• property, payment, identity, communications and other third-party services connected to the Platform;
• our service providers and professional advisers; and
• publicly available sources or authorities, where collection is lawful and reasonably necessary.

Sensitive information

You must not upload or otherwise provide sensitive information through the Platform unless the relevant Platform feature expressly permits it or we have expressly agreed to it in writing beforehand.

If we authorise it, you must ensure that the collection and disclosure are lawful, reasonably necessary for the authorised purpose and supported by the individual's consent or another lawful basis.

Where Australian law applies, sensitive information will only be collected with the individual's consent unless an exception under the Privacy Act 1988 (Cth) applies. We may remove or restrict access to sensitive or high-risk information that is provided without appropriate authority.

4. Why we collect and use personal information

We collect and use personal information where reasonably necessary for the purpose for which it was collected or another purpose permitted by law, including to:

• provide, administer and support the Platform and its property management features;
• create accounts, authenticate users, manage permissions and keep records of authorised activity;
• enable agencies and authorised users to communicate, manage tenancies, applications, inspections, maintenance, documents, payments and related workflows;
• process subscriptions, invoices and payments;
• connect integrations selected by an agency or authorised user;
• respond to enquiries, complaints, privacy requests and support needs;
• monitor reliability, troubleshoot problems, analyse use and improve accessibility, performance and user experience;
• protect users, prevent fraud and misuse, investigate incidents and maintain security;
• meet legal, regulatory, tax, accounting, audit and dispute-resolution requirements;
• manage our suppliers, recruitment, corporate transactions and ordinary business operations; and
• send service communications and, where permitted, marketing communications.

If we introduce artificial-intelligence or automated tools that process personal information, we will assess the privacy risks, describe any material use in this Privacy Policy or an appropriate privacy notice, and include suitable human oversight for decisions that could significantly affect a person.

We may create aggregated or de-identified data from information held through the Platform. Where that data no longer identifies, and is not reasonably capable of identifying, an individual, we may use, disclose, license and commercialise it for lawful business purposes. These purposes may include benchmarking, industry insights and reports, analytics, security, research, product development, service improvement and planning. We will take reasonable steps to prevent the data or any published output from identifying an individual, property or agency, and we will not attempt to re-identify it except where permitted by law to test and improve our privacy safeguards.

5. How we share personal information

We only share personal information where reasonably necessary for the purposes described in this Privacy Policy, where you or the relevant agency has authorised it, or where the law permits or requires it. Recipients may include:

• the agency, organisation and authorised users connected with the relevant property, application or tenancy;
• a person authorised to act for you, such as a lawyer, guardian or other representative, after we take reasonable steps to verify their identity and authority. You should contact us or your managing agency if you wish to withdraw that authority;
• landlords, owners, tenants, applicants, occupants, guarantors, referees, contractors and service providers, but only to the extent appropriate for the relevant task or relationship;
• hosting, cloud storage, cybersecurity, customer-support, communications, analytics, document, identity, payment and other technology providers;
• third-party applications or integrations activated by an agency or authorised user;
• professional advisers, auditors, insurers and financiers;
• government agencies, regulators, courts, tribunals, law-enforcement bodies or emergency services where authorised or required by law or reasonably necessary to address a serious threat; and
• a prospective purchaser, investor or successor in connection with a genuine financing, restructure, merger or sale, subject to appropriate confidentiality and privacy protections.

We do not sell personal information. If an integration provider has its own relationship with you or an agency, it may collect and use information under its own privacy policy. Please review that policy before enabling the integration.

6. Overseas storage and disclosure

Our primary data-hosting locations are New Zealand and Australia. Some support and technology providers may process information in other countries, including the United States.

Before disclosing personal information outside New Zealand or Australia, we will take reasonable steps to ensure that the information is subject to appropriate privacy and security protections.

7. Cookies and similar technologies

Cookies are small pieces of data stored by your browser or device when you use a website or app. We may also use pixels, local storage, software development kits and similar technologies. Some information collected through these technologies may be personal information, particularly when linked with an account or device identifier.

We use these technologies to operate and secure the Platform, remember preferences, understand performance and usage and, if enabled, measure or personalise marketing. The cookies used at launch must be confirmed in the Platform's cookie scanner and consent-management tool.

Managing cookies

You can manage non-essential cookies through your browser or device settings. Blocking cookies may affect some Platform features. Browser “Do Not Track” signals are not applied consistently across the industry; we respond where required by law and otherwise provide the controls described above.

Cookie choices are generally stored on the browser or device you are using. You may therefore need to update your preferences separately on each browser or device.

8. Marketing communications

We may send information about The Rental Home where you have agreed to receive it or where otherwise permitted by law. We will comply with the New Zealand Unsolicited Electronic Messages Act 2007, the Australian Spam Act 2003 (Cth) and other applicable marketing rules.

You can opt out at any time by using the unsubscribe link in a marketing message, updating account preferences or contacting us. We may still send essential account, security, legal and service messages.

9. Security and privacy incidents

Protecting personal information is important to us. We use reasonable technical and organisational safeguards appropriate to the nature of the information and risks involved. These may include encryption in transit and at rest, access controls, multi-factor authentication, logging and monitoring, secure development and testing, backups, staff confidentiality and security training, vendor reviews and incident-response procedures.

No online system is completely secure. Users and agencies also play an important role by protecting credentials, using available security features, managing permissions and telling us promptly about suspected unauthorised access.

If a privacy breach occurs, we will contain and assess it, work with affected agencies where appropriate, and notify the Office of the New Zealand Privacy Commissioner and affected people where the breach has caused or is likely to cause serious harm. Where Australian law applies, we will also comply with the Notifiable Data Breaches scheme, including notifying the Office of the Australian Information Commissioner and affected people when required.

10. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, to provide the Platform, meet legal and professional record-keeping obligations, resolve disputes, maintain security and backups, and enforce our agreements. Retention periods vary according to the type of information and the agency's instructions under the Services Agreement.

When information is no longer required, we take reasonable steps to delete or de-identify it. Information may remain for a limited period in secure backups or where retention is required by law, subject to access restrictions. Agencies are responsible for configuring and applying their own lawful retention requirements for agency-managed records.

11. Children and young people

The Platform is intended for people aged 18 or over. However, agencies may sometimes hold information about children or young people as occupants, dependants, emergency contacts or parties connected with a tenancy. A person under 18 may only use an account where the relevant feature has been expressly enabled, they have been invited by an authorised agency, and any consent required from a parent or legal guardian has been obtained.

We and agencies must take particular care to collect only information about children and young people that is lawful, appropriate and reasonably necessary. If you believe a child or young person is using the Platform without appropriate authority, or that their information has been provided inappropriately, please contact our Privacy Officer.

12. Your privacy choices and rights

Depending on where you live and the law that applies, you may have certain rights in relation to your personal information. In New Zealand and Australia, these include rights to request access to and correction of personal information. You may also ask us to delete information, withdraw consent or stop particular uses; these requests will be considered under applicable law and may be limited by lawful retention needs or another person's rights.

To make a request, contact our Privacy Officer using the details below. Please describe the information or account involved. We may need to verify your identity and authority before responding. We will respond within the time required by law—generally within 20 working days for New Zealand Privacy Act requests and within a reasonable period for Australian requests—and will explain any lawful reason for refusing or limiting a request.

If the information is managed by an agency, you may wish to contact that agency directly. We may refer the request to the agency or assist it to respond. You can also update some account details and preferences within the Platform.

13. Complaints

If you have a privacy concern, please contact us first so we can try to resolve it. Please include your contact details, a description of the concern and any relevant supporting information. We will acknowledge your complaint and aim to respond within 30 days, although complex matters may take longer. We will keep you informed if we need more time.

If you are not satisfied with our response, you may contact:

• New Zealand: Office of the Privacy Commissioner — https://www.privacy.org.nz
• Australia: Office of the Australian Information Commissioner — https://www.oaic.gov.au

14. Third-party sites and services

The Platform may contain links to, or integrate with, third-party websites and services. Those organisations have their own privacy practices. Unless we say otherwise, we are not responsible for how an independent third party handles information. We encourage you to review its privacy policy before providing information or enabling an integration.

15. Changes to this Privacy Policy

We may update this Privacy Policy as the Platform, our practices or the law changes. We will publish the current version and “last updated” date on our website. If a change is material, we will take reasonable additional steps to notify affected users where appropriate or required by law.

16. Contact us

We welcome questions, requests and feedback about privacy. Please contact: