Privacy policy

Who we are

This policy belongs to Redigi Pty Ltd, ACN 683 525 859, ABN 46 683 525 859, of 36/202 The Avenue, Parkville VIC 3052, Australia, trading as Suburb Reports. In this policy, "we", "us" and "our" mean Redigi Pty Ltd.

Suburb Reports is the product behind the campaign pages published on suburbreports.au. Each page is built and run for the real estate agency selling the property it describes, and it wears that agency's brand rather than ours. This is the one privacy policy we publish for all of them.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the thirteen Australian Privacy Principles, and we do not rely on the small business exemption, whatever our turnover. We also follow the Spam Act 2003 (Cth), the Do Not Call Register Act 2006 (Cth) and the Australian Consumer Law.

What this covers

This policy covers suburbreports.au, every campaign page published on it, and the emails sent from those campaigns.

It replaces the privacy notice that individual campaign pages carried in their own footers. Where a page still carries one, this document governs.

The selling agency is a separate business with its own privacy policy and its own obligations. This document says what we do. It does not speak for them, and it does not displace what they publish.

Who collects it, and who it is for

This is the part most marketing companies leave vague, so we will be specific.

The enquiry is for the selling agent, and the agent owns it. When you ask for the documents on a campaign page you are asking the agency selling that property. Your details go to them and into their records: that is how they get the documents to you and answer your questions. That enquiry is theirs.

We are the ones who collect it, and we would rather say so than hide behind the agency's brand. The page is ours, the form is ours, the record is written into our database, the personal link we email you is signed with our key, and the emails leave our systems. Under Australian law an entity that collects and holds personal information carries the obligations of the Privacy Act for what it holds. So we carry them for our copy and the agency carries them for theirs, and neither of us can point at the other.

We hold it to run that agency's campaign, and for nothing else. We act on the agency's instructions for their campaign. We do not use your enquiry for our own marketing, we do not add you to a list of our own, and we do not offer you anything of ours on the back of it.

One agency's information never reaches another. Enquiries, contacts and advertising audiences built for one agency are never pooled with another's, never carried across when a campaign or a client relationship ends, and never sold. There is no shared pot of leads behind the scenes, and a new client starts with a new advertising dataset and a clean audience.

What travels between campaigns is method, not people. We learn what works, for instance that someone who opens a statement of information is likelier to register for the auction. That kind of learning is a number, not a person, and no individual travels inside it.

When an agency stops working with us, we stop using what we hold for them, and we act on their instruction about what happens to it. Our right to use it at all only ever existed so that we could run their campaign.

What we collect

From the enquiry form. A campaign page asks for what the agent needs in order to answer you. Today that is your name, your email address, your phone number, and your answer to one question about where you are at with the property. A page may ask for slightly more or less; whatever it asks is on the page in front of you, and that is the whole of it.

The one field you cannot see. The form carries a single hidden box that a person never sees and never fills in. It exists to catch automated spam, and anything submitted in it is discarded rather than stored. We mention it because "there are no hidden fields" would not be true, and a policy that shades the truth on a small thing is worth nothing on a large one.

What we record alongside your answers. Which campaign and which property you enquired about, which agency it is for, the address of the page you sent it from, and the time.

What the form does not take. When you send the enquiry we do not record your IP address or your device with it.

What we do not want at all. We do not seek sensitive information as the Privacy Act defines it, such as health, race or political views. Please do not send it to us.

Where a campaign page carries advertising tracking, section 7 sets out what that collects and section 8 sets out what is sent to the advertising platform.

Your documents link, and what is recorded

After you ask for the documents we email you a link that is personal to you. It carries a signed code that identifies your enquiry, which is what lets the page know who is opening it.

Each time that link is opened we record it: the time, the browser and device it was opened in, and the page that sent you there. We do not record your IP address.

Why. So the vendor can be told honestly how many buyers actually read the documents. That is the whole purpose, and it is why the link is personal rather than general.

Because the link identifies you, passing it on means someone else's reading is recorded as yours. If a colleague, accountant or solicitor needs the documents, they can ask for their own.

What that link is not. Putting a page behind a link is not a security measure and we do not present it as one. Treat a campaign page as a public place.

Calculators and tools on the page

Some campaign pages carry a calculator, for instance a yield table you can put your own rent assumption into.

Those tools run entirely in your browser. Nothing you type into them is sent anywhere, nothing is saved, and we cannot see what you entered. There is no obligation for us to manage over figures we never receive.

What a calculator produces is arithmetic on an assumption you supplied. It is general information rather than advice, and the terms of use say more about that.

Cookies, tracking and advertising

This section is written to cover advertising whether or not it is running on the page you are reading. A notice that says "nothing here" stops being true the moment something is switched on, and nobody re-reads a policy. So the full set is named once, here.

The honest position as at the effective date above. No campaign page on suburbreports.au carries an advertising pixel or an analytics tag, and none sets a cookie. The only thing any of them fetches from anyone else is the typeface, loaded from Google Fonts, which tells Google the address you connected from and the browser you used. That is not tracking and it sets no cookie, but it is not nothing, so we name it.

What changes when a campaign is advertised. These campaigns are advertised, mostly on Facebook and Instagram, and a page that is being advertised usually carries measurement. When that is switched on for a campaign page, these are the technologies involved.

The platforms. Today that means Meta, being Facebook and Instagram, and Google. We also name TikTok, LinkedIn, Pinterest and X · not in use yet, so that this policy does not have to change the day one of them is switched on. None of those four has been used for anybody.

If a page is tracking you, that page will tell you. A campaign page carrying advertising measurement says so on the page, rather than relying on you finding this document.

How to turn it off. Block cookies in your browser, though parts of a page may then not work. Use the advertising controls inside your own Facebook or Instagram account, or the equivalent controls on any other platform named above. Unsubscribe from us, which also takes you out of the audiences we control. Any one of those works on its own; you do not have to do all three.

Advanced Matching

This gets its own section, because it is genuinely not obvious and most policies bury it.

When we send advertising events to a platform named in section 7, we may include your email address, phone number, name or location, scrambled through a one-way process called hashing. The platform scrambles the details it already holds the same way and compares the two. If they match, the platform knows the person who took the action is one of its users.

Being straight with you about what that means. Hashing means we are not handing over your email address as text, and a hash cannot practically be turned back into it. But hashing is not anonymity. The whole purpose is that the platform identifies you. It remains your personal information, and sending it remains a disclosure. Anyone who tells you hashed data is anonymous is being loose with the word.

Why we do it. So a vendor's advertising budget is not spent showing the campaign to the wrong people, and so the agent can be told honestly what the advertising achieved.

How to stop it. Unsubscribe from us, and separately use the advertising controls inside your own Facebook or Instagram account, or the equivalent on any other platform named in section 7.

Whose pixel, whose audiences

The advertising dataset belongs to the agency whose campaign it measures. Our agreement with them says so in terms: the agency retains full ownership of its data and of its advertising dataset or pixel. It is theirs while we work together, and it stays theirs afterwards, when they elect whether we delete it or hand it back.

The advertising account the campaigns run from is ours, and the experience it accumulates is ours.

Neither of those disturbs the rule in clause 3.5. Audiences built from one agency's campaign are never used for another agency's, and a new client starts with a new advertising dataset. That is a commitment we hold ourselves to, over and above what the platforms and the law require.

Emails, and how to stop them

What you will be sent. Having asked for the documents on a campaign, you get the documents and the things that follow for that same campaign: a schedule the day it is released, a registration link the day it lands, a change to an auction time. That is what you asked for, and it is the whole of what we send.

Every message identifies who sent it and carries a working unsubscribe. You can also simply reply to any of them with the word unsubscribe.

One step, and it holds. Unsubscribing stops the campaign emails permanently. You only have to say it once, and you do not have to say it again for each later send: every send checks first.

We keep a minimal record of that unsubscribe permanently, because forgetting it would mean contacting you again after you told us not to. That retention protects you rather than us.

Unsubscribing from us does not unsubscribe you from the agency. They hold their own copy and send their own messages. Tell us and we will tell you exactly who to contact there, rather than leave you working it out.

To stop everything at once, or to ask us to take you out of advertising audiences we control, email privacy@suburbreports.au.

Software, and what it does not decide

We use software throughout this, and we would rather tell you plainly than leave you guessing.

What is not decided by software at all. No computer decides whether you can buy a property, what price you are offered, or whether an agent will deal with you. Those are decisions people make, at the agency.

What software does. It takes the form, it sends the emails, it records that a personal link was opened, and, where advertising runs, it groups people into advertising audiences based on what they engaged with. Where enquiries are put in an order for an agent to work through, software does that too.

If a campaign page ever answers you automatically, that page will say so, and you will be able to ask for a person. We will not let anyone believe they are talking to a human when they are not, including by saying nothing.

Who else sees it

We disclose personal information to:

• The selling agency named on the campaign page you used. This is the point of the enquiry, not a side effect of it.
• Advertising platforms, where a campaign is advertised, as described in sections 7 and 8.
• The suppliers who run the machinery, named, because a list of categories tells you nothing: Supabase (the database, hosted in Sydney), Cloudflare (page hosting and delivery), Google (the Workspace account the campaign emails send from, and the typeface the pages load), Resend (delivery for some of our email), and the automation service that carries an enquiry from the form to the email that answers it.
• Professional advisers such as accountants and lawyers, where a matter needs them.
• Anyone we must tell by law, or to protect someone's safety.

We do not sell your personal information, and we do not share one agency's enquiries with another.

Outsourcing does not move our responsibility. If a supplier we chose mishandles your information, that remains our problem to answer for.

Our services agreement requires every agency to handle the information we pass them lawfully and properly. That is a term of the agreement, not a hope.

If our business is ever sold or merges, information may transfer with it. Whoever took it on would be bound by this policy, or would have to tell you before anything changed.

Links to other places. Campaign pages and the emails link to places we do not run, including the agency's own site, portals and auction platforms. Once you follow a link you are on their territory and their privacy practices apply, not ours.

Sending information overseas

Our database is hosted in Sydney, Australia, so your enquiry sits in Australia.

Some of the suppliers and platforms above are overseas, so depending on the campaign and how you dealt with it, information can be handled in these places.

The one we have not settled. The automation service that carries an enquiry from the form to the email answering it may handle that information outside Australia. We are confirming exactly where before we name a country, and we would rather tell you that we are still checking than name one we have not checked.

Before we send personal information overseas we take reasonable steps to see that it is handled consistently with the Australian Privacy Principles.

A platform marked "not in use yet" is one we offer but have not run for anybody. It is named because we would rather list it once than quietly add a country later, but nothing has gone there.

How long we keep it

We keep personal information only while we need it, then destroy it or strip it of anything that identifies you.

That last one is the exception worth explaining. If you unsubscribe we keep a minimal record of it forever, because forgetting that you opted out would mean contacting you again after you told us not to. That retention protects you rather than us.

The agency keeps its own copy on its own schedule. Ours ending does not end theirs.

Keeping it safe

We protect your information with access controls, encryption in transit, credentials held in a secure vault rather than in code, and access limited to the people who need it.

No system is perfectly secure. If a data breach happens that is likely to cause you serious harm, we will assess it promptly and notify you and the Office of the Australian Information Commissioner as the law requires.

Your rights

You may:

• Ask what we hold about you, and get a copy.
• Correct it if it is wrong or out of date.
• Stop the emails at any time, in one step.
• Ask us to delete it, as described in section 17.
• Ask how we got it, if you did not give it to us directly.
• Complain, as described in section 18.

Email privacy@suburbreports.au. We will respond within 30 days and we will not charge you to ask.

We may need to check it is really you before we act. That is not obstruction, it is the point: handing someone's information to a stranger who claimed to be them, or deleting it on a stranger's say-so, would be the worse failure. We will ask for the least we can get away with.

Someone else can act for you, an accountant or a solicitor for instance, and we will ask for proof you authorised them.

These rights are not absolute, and occasionally the law lets us decline part of a request. If that happens we will tell you which part and why, rather than going quiet.

Asking never counts against you. We will not treat you differently, or stop helping you, because you exercised any of these rights.

Deleting your information

You can ask us to delete the personal information we hold about you at any time.

Email privacy@suburbreports.au from the address or number you used. We will confirm within 30 days what we deleted, and what, if anything, we had to keep and why.

We may need to keep a small amount, for example the record that you unsubscribed so we do not contact you again. We will tell you if that applies.

The agency holds its own copy, and deleting ours does not delete theirs. We will act on ours, and tell you exactly who to contact at the agency so you can ask them too. We will not leave you to work that out.

Deleting your information sets out the same route step by step, including what happens to your place in an advertising audience.

Complaints

Tell us first. Email privacy@suburbreports.au and we will acknowledge within 5 business days and respond within 30 days.

Coming to us first is offered, not required. If you are not satisfied, or if you would rather not come to us at all, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992. Complaints about spam or telemarketing go to the Australian Communications and Media Authority at acma.gov.au.

Changes

We may update this policy as the service changes or the law does. The current version always sits at this address with the date it took effect. If a change materially affects you, we will do more than quietly update the page.

Because this one document serves every campaign page on suburbreports.au, a change here changes what all of them say at once. That is the point of having one rather than a notice per campaign, which is how a set of pages ends up disagreeing with itself.

Contact us

Redigi Pty Ltd, trading as Suburb Reports
ACN 683 525 859  ·  ABN 46 683 525 859
36/202 The Avenue, Parkville VIC 3052, Australia
privacy@suburbreports.au
1300 287 682

privacy@redigi.com.au reaches the same people, if you would rather write to the company than to the product.

Either address reaches a person, for anything about this policy, your information or your privacy.

A question about the property itself goes to the selling agent, not to us, because they hold the answer and we do not. Getting in touch sets out which questions reach whom.