The HMO Property Co

Privacy Policy

Last reviewed and updated 1 September 2026

Who this policy applies to

This Privacy Policy applies to the following companies (together, "we", "us", "our"):

• Coliving Collective Pty Ltd, ABN 71 989 283 390
• The HMO Property Co Pty Ltd, ABN 32 675 348 857
• Living Rooms Pty Ltd, ABN 11 336 767 721
• Reside Living Pty Ltd, ABN 26 199 288 227

We may share your personal information between these companies where it is necessary to deliver the services you have asked us for, to manage a property or an occupancy, or to meet our legal obligations. Each company handles your personal information in accordance with this policy.

We value and respect the privacy of the people we deal with — investors and clients, residents and room applicants, property owners, contractors, suppliers and job applicants. We are committed to protecting your privacy and to handling your personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

This policy explains what personal information we collect, why we collect it, who we share it with, how we keep it secure, and how you can access it, correct it or complain if you are unhappy with how we have handled it.

What is personal information

"Personal information" means any information or opinion, whether true or not, and whether recorded in a material form or not, about an identified individual or an individual who is reasonably identifiable. In general terms this includes information that identifies you either directly, such as your name, or indirectly.

What personal information we collect

What we collect depends on your relationship with us.

Investors and clients

• Name, contact details and date of birth
• Financial information, including income, assets, liabilities, borrowing capacity and correspondence with brokers and lenders
• Identification documents
• Trust, company and other entity details relevant to your investment structure
• Property, build and settlement details
• Records of your communications and dealings with us

Residents and room applicants

• Name, contact details and date of birth
• Tenancy application details, rental history, references and employment or income details
• Identification documents
• Emergency contact details
• Payment details and records relating to your occupancy

Property owners

• Name and contact details
• Bank account details for rental disbursements
• Property, insurance and compliance details

Contractors, suppliers and job applicants

• Name, contact and business details
• Licences, insurances and accreditations
• Resumes, references and other application material

Website visitors and subscribers

• Name, email address and phone number where you give them to us
• Information collected automatically when you use our website, as described under cookies and analytics below

Sensitive information

In some circumstances we may need to collect sensitive information about you. This might include information or an opinion about your racial or ethnic origin, political opinions, religious or philosophical beliefs, membership of a trade union or professional body, sexual orientation, criminal record or health information. We collect sensitive information only with your consent, where it is necessary to prevent a serious and imminent threat to life or health, or as otherwise required or authorised by law, and we take appropriate measures to protect it.

Employee records

Personal information we hold about our current and former employees, where it relates directly to the employment relationship, is generally exempt from the Australian Privacy Principles under the Privacy Act. We nonetheless handle that information in line with this policy and our internal policies.

How we collect your personal information

We collect personal information directly from you when you:

• Interact with us over the phone, in person or online
• Complete an enquiry, concierge, application or booking form
• Subscribe to our mailing list or download a resource from our website
• Participate in a survey or questionnaire, or attend one of our events
• Apply for a room, a property or a position with us as an employee, contractor or volunteer

We also collect personal information about you from third parties, including:

• Referral partners who introduce you to us
• Finance brokers, mortgage brokers and lenders
• Accountants, settlement agents and solicitors acting on your matter
• Builders, developers and real estate agents involved in your project
• Tenancy reference providers and tenancy databases, where you have applied for a room
• Publicly available sources

Where we collect your personal information from someone other than you, we take reasonable steps to make sure you are aware of this policy and of why we hold that information.

You do not have to give us your personal information. Where possible we will give you the option of dealing with us anonymously or under a pseudonym. However, if you choose not to provide your personal information we may not be able to provide our services to you or otherwise deal with you.

Why we use your personal information

We use personal information in connection with our functions and activities, including to:

• Provide the information, products and services you have asked us for
• Assess your circumstances and coordinate finance, structuring, sourcing, build and settlement for your investment
• Assess room applications, manage occupancy and match housemates
• Manage properties on behalf of owners, including leasing, maintenance and rental payments
• Deliver a more personalised experience and service
• Improve the quality of our services
• Carry out internal administration, accounting and record keeping
• Undertake marketing and research
• Meet our legal, regulatory and contractual obligations

Who we share your personal information with

We disclose your personal information to third parties where you would reasonably expect us to, where it is necessary for the purpose it was collected, or where you have consented. This may include:

• Finance brokers, mortgage brokers and lenders appointed to your matter
• Accountants, settlement agents and solicitors
• Builders, developers, trades and consultants involved in your project
• External property management, letting and housemate-matching partners
• Tenancy reference providers and tenancy databases, where relevant to a room application
• Our IT, hosting and cybersecurity providers
• Our CRM, marketing and analytics providers
• Our professional advisors, insurers and auditors
• Government agencies, regulators, courts and tribunals, where required or authorised by law

We do not sell your personal information.

Consent on our forms

When you complete our concierge or enquiry forms you will be asked to consent to us sharing the information you give us with the third parties described above, so that we can deliver our services to you. You can withdraw that consent at any time by contacting our Privacy Officer, although if you do we may not be able to continue providing some or all of our services.

Sending information overseas

Some of the platforms and service providers we use store or access personal information outside Australia. This currently includes:

• monday.com, our project and construction management platform. monday.com is operated by a company headquartered in Israel and hosts customer data with Amazon Web Services in one of three data regions — the United States, the European Union (Germany) or Asia Pacific (Australia) — depending on the region assigned to our account. Some account information, including user credentials and usage analytics, is processed in the United States, and data may also be processed in Israel.
• ActiveCampaign, our email marketing and CRM platform. ActiveCampaign is operated by a company based in the United States and hosts contact data in a regional data centre in the United States, the European Union or Australia, based on the location of our account. Some processing continues in the United States and in other countries where ActiveCampaign and its sub-processors operate.
• GoHighLevel, our marketing and CRM platform. GoHighLevel is operated by HighLevel Inc, a company based in the United States, and data is hosted in the United States.
• A contractor located in the Philippines, who provides administrative support to our property management team, Living Rooms.

Before we disclose personal information to an overseas recipient we take reasonable steps to ensure that the recipient handles it in a way consistent with the Australian Privacy Principles, including through written confidentiality and data protection obligations.

How we protect your personal information

We take reasonable steps to keep the personal information we hold confidential and secure, including by:

• Maintaining physical security over our premises, databases and records
• Limiting access to personal information to personnel who need it to do their job
• Using technological measures such as firewalls, anti-virus software, multi-factor authentication and password management
• Requiring our staff to comply with confidentiality obligations in their employment contracts and our internal policies
• Putting confidentiality and data protection obligations in place with our contractors and service providers
• Destroying or de-identifying personal information when we no longer need it

Data breaches

We maintain a data breach response plan. Our staff and contractors are required to report any suspected or actual unauthorised access to, disclosure of, or loss of personal information to our Privacy Officer immediately.

If a data breach occurs we will contain it, assess what has happened and what harm may result, and take steps to reduce that harm. Where we have reasonable grounds to believe an eligible data breach has occurred — meaning a breach that is likely to result in serious harm — we will notify the affected individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme under Part IIIC of the Privacy Act.

Cookies, website analytics and advertising

Our website uses cookies. A cookie is a small file of letters and numbers that a website places on your device if you allow it. Cookies let us recognise a device that has visited our website before, which helps us distinguish you from other users and improve your experience. If you would prefer not to accept cookies you can change your browser settings, but please be aware that parts of our website may not work properly as a result.

We use Google Analytics to understand visitor traffic so that we can improve our website and services. Although this data is mostly anonymous, in some circumstances it may be connected to you. We also use advertising and remarketing tools provided by Google, Meta (Facebook and Instagram) and TikTok. These tools may use cookies, tracking pixels or similar technologies to measure how our advertising performs and to show you our advertising on those platforms and on other websites.

Direct marketing

We may send you marketing communications about our services, opportunities and events where you have requested or consented to receive them. These may be sent by mail, SMS, email or other means, in accordance with applicable marketing laws including the Spam Act 2003 (Cth). If you tell us you prefer a particular method of communication we will use it wherever practical. You can opt out at any time by using the unsubscribe link in the relevant message or by contacting us using the details below, and we will action your request promptly.

How long we keep your personal information

We do not keep your personal information for longer than we need it. In most cases we retain it for the duration of your relationship with us and for as long afterwards as we are required to by law, for example under record keeping, taxation and residential tenancy legislation. When we no longer need it, we take reasonable steps to destroy it or de-identify it.

Accessing and correcting your personal information

You have the right to ask for access to the personal information we hold about you, and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. To make a request, contact our Privacy Officer using the details below. We may need to verify your identity before we can act on your request.

We will respond to your request within 30 days, and in most cases sooner. If we refuse your request, we will tell you why in writing and explain how you can complain about that decision.

Complaints

If you have a concern about how we have handled your personal information, please tell us so that we can put it right. Contact our Privacy Officer using the details below, setting out what happened and what outcome you are looking for.

We will acknowledge your complaint within 5 business days and respond to it within 30 days. If we need longer we will tell you why and keep you updated.

If you are not satisfied with our response, you can lodge a complaint with the Office of the Australian Information Commissioner. The OAIC generally expects you to raise your complaint with us first and to give us 30 days to respond.

• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

Changes to this policy

We review this policy regularly and may update it from time to time. The current version is always available on this page and shows the date it was last reviewed.