Morgan & Hayes Real Estate Privacy Policy

Last updated: 13 July 2026

1. Introduction

Morgan & Hayes Real Estate (we, us, our) is committed to complying with our obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, hold, use and disclose personal information, including information we collect to verify identity, meet our Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF) obligations, and provide real estate sales, leasing and property management services.

We are bound by the APPs either because we are an organisation with an annual turnover of more than $3 million, or because we derive a benefit, service or advantage from the collection or disclosure of personal information.

We will not collect personal information unless it is reasonably necessary for, or directly related to, one or more of our functions or activities.

A current version of this Policy is always available on our website at www.morganhayes.com.au, and a hard copy is available on request from our Privacy Officer.

2. What Personal Information We Collect

The personal information we may collect includes:

  • Names, email addresses, residential and mailing addresses, phone numbers, gender and occupation details.
  • Government-issued identification details, such as:
    • Driver licence
    • Passport
    • Birth certificate
    • Medicare card
    • Rates notices
    • Utility accounts
  • Biometric information, such as a facial image or short verification video, used to confirm your identity (see Section 5).
  • Financial information, including:
    • Assets and liabilities
    • Income and expenses
    • Credit reference information
    • Bank and credit card details
  • Beneficial ownership and company or trust structure information.
  • Property valuations, sales history and details of properties we are engaged to market, sell or lease.
  • Information from sellers, buyers, lessors, tenants and prospective sellers, buyers, lessors and tenants.
  • Tenancy application information and references, including rental history obtained from third-party databases.
  • Photographic identification.
  • Any other information you choose to provide to us.

We only collect personal information that is reasonably necessary to carry out our business activities.

3. How We Collect Personal Information

Wherever reasonably practicable, we collect personal information directly from the individual it relates to.

We may also collect personal information:

  • From agents and representatives, such as lawyers, settlement agents, accountants, financial advisers and banks.
  • From buyers, sellers, lessors, tenants or other users (or potential users) of our services.
  • Through our website and online enquiry forms.
  • Through publicly available sources, such as social media, local councils, Landgate and telephone directories.
  • Where required by law, including under the Real Estate and Business Agents Act 1978 (WA).
  • Through competitions or surveys we or third parties conduct on our behalf.
  • From third-party databases regarding an individual’s rental history.
  • From other real estate agents, for example in a conjunctional sale or where we act for a buyer.
  • Through electronic identity verification systems and government verification services, including the Document Verification Service (DVS).

4. Identity Verification and Government Data Matching (DVS)

To verify your identity and meet our AML/CTF and other legal obligations, we may use electronic identity verification services, including the Australian Government’s Document Verification Service (DVS).

Where you have consented, your name, date of birth and identity document details will be securely sent to the relevant Commonwealth or State authority that issued your document. This may include passport offices, driver licence authorities, the Department of Home Affairs, Births, Deaths and Marriages, or other authorised record holders.

These authorities check whether the details you have provided match the records they hold. We do not receive a copy of your government records—the authority returns a match result only, confirming whether your details match (Yes or No).

This process may be carried out through accredited identity verification providers, including APLYiD (APLYiD Pty Ltd, ABN 36 632 866 794) and its authorised sub-providers.

More information about the DVS is available at idmatch.gov.au.

5. Biometric Information

As part of identity verification, we may collect biometric information, such as a facial image or a short video of you holding your identification document.

Biometric information may be used to:

  • Confirm that you are a real person and physically present.
  • Match your image to the photograph on your identification document.
  • Reduce the risk of fraud and identity theft.

Biometric information is treated as sensitive information under the Privacy Act. We only collect and use it for identity verification and related compliance purposes, and only with your consent.

6. Consent to Collection and Identity Verification

By providing your personal information and completing our identity verification process (including any separate Consent Form provided to you), you consent to:

  • The collection, use and disclosure of your personal information for identity verification, AML/CTF and related compliance purposes.
  • The collection and use of biometric information, such as a facial image or video, for identity verification.
  • Your information being checked against records held by Commonwealth and State authorities through the Document Verification Service (DVS).
  • Your information being shared with our authorised identity verification provider, APLYiD, and our AML/CTF compliance provider, AMLHUB AU.

Your consent is voluntary and you may withdraw it at any time by contacting our Privacy Officer (see Section 13).

If you do not consent, or do not provide the information we require, we may be unable to verify your identity electronically. In that case, we may need to verify your identity using another method, or we may be unable to provide our services to you.

7. Why We Collect, Use and Disclose Your Personal Information

We hold personal information to enable us to conduct our real estate sales, leasing and property management services, market those services, and conduct our business.

In particular, we use personal information to:

  • Provide services connected with the sale and/or leasing of properties and businesses.
  • Provide advice to customers and prospective customers on real estate and business agency matters.
  • Obtain information from Landgate to assist with valuing, selling and/or leasing properties.
  • Assess applications for residential and commercial tenancies.
  • Market the services of the agency, including through the internet and property portals.
  • Advise clients of additional information or services (from us or third parties) that may interest them.
  • Manage our business efficiently, including via cloud software and CRM providers.
  • Meet AML/CTF and other legal and regulatory obligations, including customer due diligence, beneficial ownership verification, politically exposed person (PEP) and sanctions screening, and ongoing transaction monitoring.
  • Detect and prevent fraud, identity theft and unlawful transactions, and keep our systems secure.

We do not sell your personal information.

8. Disclosure of Personal Information

We may disclose your personal information to:

  • Landgate and the Real Estate Institute of Western Australia (REIWA).
  • Settlement agents, conveyancers and solicitors.
  • Financial institutions.
  • Government departments and regulators, including for AML/CTF reporting.
  • AML/CTF compliance providers, including AMLHUB AU.
  • Identity verification providers, including APLYiD Pty Ltd (ABN 36 632 866 794) and its authorised sub-providers.
  • Marketing agencies, photographers and floorplan providers.
  • Property portals, including realestate.com.au, REIWA.com and other advertising platforms.
  • Cloud software and CRM providers used by our agency, including:
    • Reapit (Australia & New Zealand)
    • Reapit Sales uses Tier 3 AWS Data Centres to securely store client data.
    • Regular penetration testing is undertaken to maintain platform security.
    • Appropriate disaster recovery policies and procedures are maintained.
    • Personal information is managed in accordance with the Australian Privacy Principles (APPs) and applicable privacy legislation.
  • PropertyMe.
  • Staff Link.
  • Airtable.
  • Debt collection agencies for tenancy management purposes.
  • Our employees, authorised representatives and professional advisers on a need-to-know basis.
  • Other contractors or service providers reasonably required to facilitate our services.
  • Regulators, law enforcement agencies or other third parties where required or authorised by law.

We do not sell your personal information and only disclose it where reasonably necessary for the purposes outlined in this Privacy Policy.

9. Overseas Disclosure

Some of our service providers, including cloud software and CRM providers, may store or process personal information outside Australia.

Where this occurs, we take reasonable steps to ensure your personal information is handled in accordance with the Australian Privacy Principles, including through appropriate contractual protections with our service providers.

10. Data Security and Retention

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure.

Information is stored electronically in secure databases and cloud-based systems operated by us and our approved service providers, using appropriate access controls and encryption in transit and at rest where appropriate.

We retain personal information only for as long as necessary for the purposes described in this Privacy Policy, or as required by law, including AML/CTF record-keeping requirements.

When we no longer require your personal information, we securely delete or de-identify it.

To verify your identity and meet our AML/CTF and other legal obligations, we may use electronic identity verification services, including the Australian Government’s Document Verification Service (DVS).

Where you have consented, your name, date of birth and identity document details will be securely sent to the relevant Commonwealth or State authority that issued your document. This may include:

  • Passport offices
  • Driver licence authorities
  • The Department of Home Affairs
  • Births, Deaths and Marriages
  • Other authorised record holders

These authorities check whether the details you have provided match the records they hold.

We do not receive a copy of your government records. The authority returns only a match result confirming whether your details match (Yes or No).

This process may be carried out through accredited identity verification providers, including APLYiD Pty Ltd (ABN 36 632 866 794) and its authorised sub-providers.

More information about the Document Verification Service (DVS) is available at idmatch.gov.au.

  • Confirm that you are a real person and physically present.
  • Match your image to the photograph on your identification document.
  • Reduce the risk of fraud and identity theft.

11. Access and Correction

You have the right to request access to the personal information we hold about you, and to ask us to correct it if it is inaccurate, incomplete or out of date.

Requests should be made in writing to our Privacy Officer. Subject to the exemptions in the Australian Privacy Principles (APPs) and satisfactory proof of identity, we will provide access, generally within 14 days, or within 30 days for more complex requests.

We may charge a reasonable fee based on the administrative cost of supplying the information. If we refuse a request to access or correct information, we will provide written reasons.

12. Direct Marketing

From time to time, we may use your contact details to send you information about our services that we think may be of interest to you.

You can opt out of marketing communications at any time by using the unsubscribe link in our messages or by contacting our Privacy Officer using the details in Section 13.

13. Privacy Complaints

If you have a complaint about how we have handled your personal information, please contact our Privacy Officer first, in writing.

We will acknowledge your complaint, investigate it and respond within a reasonable time.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC).

14. Contact Details

If you have any questions about this Privacy Policy, or wish to exercise any of your privacy rights, please contact our Privacy Officer:

  • Business Name: Morgan & Hayes Real Estate
  • Privacy Officer: Kym Chamberlain
  • Email: sales@morganhayes.com.au
  • Phone: 6250 6500
  • Address: Shop 11, 55–59 Central Road, Rossmoyne WA 6148

15. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in the law.

This Policy is reviewed periodically and kept up to date. The latest version will always be available on our website, and any significant changes will be posted there.

Where changes are significant, we will take reasonable steps to notify you.