Legal

Privacy Policy

Last updated: 22 June 2026

1. Who we are

This Privacy Policy explains how PremiumRea Pty Ltd (“PremiumRea”, “we”, “us”, “our”) handles personal information. We are an Australian Privacy Principles (APP) entity and are bound by the Privacy Act 1988 (Cth). This policy applies to all personal information we collect through the premiumrea.com.au website, our tools, our email and messaging channels, our phone lines, and our in-person meetings.

2. What personal information we collect

We collect the following categories of personal information:

  • Contact information you give us when you fill out a form, call, email, book a meeting, or start a chat: name, email address, phone number, suburb, investment preferences, and any message content you provide.
  • Identification and transaction information when you become a client: identification documents required by law, buyer's agency agreements, trust/SMSF structure, finance details, and settlement documents.
  • Website usage information collected automatically when you visit the site: IP address, browser and device information, referrer URL, pages visited, time on page, scroll depth, click paths, and approximate location derived from IP.
  • Identifiers stored in your browser so we can recognise returning visitors and group visits into sessions: a persistent “visitor ID” in localStorage and a short-lived “session ID” in sessionStorage.
  • Session recordings and heatmaps captured by Microsoft Clarity, which may record mouse movements, clicks, scrolls, and page content (with sensitive fields masked) on an aggregated, de-identified basis.
  • Communications — we keep records of emails, chat transcripts, Lark messages, and phone notes for training, quality, and compliance purposes.
  • Google Sign-In data — when you sign in with Google to access our free suburb intelligence tools (at /tools/*), we receive from Google: your unique Google account identifier (sub), email address, verified-email flag, display name, first and last name, profile picture URL, language preference (locale), and, if you use a Google Workspace account, your organisation's hosted domain (hd). If and when Google approves our verification request for additional (sensitive) scopes, we may additionally receive — only with your explicit consent on Google's authorisation screen — your phone number(s), date of birth or age range, self-reported gender, saved addresses, self-reported organisations and job titles, additional email addresses, and language list. We record the date and version of the Terms & Conditions you accepted at sign-in, and we associate your authenticated account with any anonymous browsing data previously captured under the same browser (see section 6).

We do not collect sensitive information (health, race, political beliefs, etc.) unless it is necessary for a service you have asked us to provide and you have consented.

3. How we collect it

We collect personal information directly from you when you submit a form, send us an email, call us, message us, or meet with us. We also collect website usage information automatically when you browse the site, using first-party JavaScript, cookies, and local storage (see section 6). In limited cases we may collect information from third parties such as referrers, mortgage brokers, accountants, or public property databases, where you have authorised us to do so.

4. Why we collect it and how we use it

We use personal information to:

  • respond to enquiries, provide information you have requested, and arrange meetings;
  • deliver buyer's agency services to clients, including property search, due diligence, offer and negotiation, and settlement support;
  • comply with our legal and regulatory obligations, including anti-money-laundering, real-estate licensing, tax, and record-keeping laws;
  • measure how people find and use the website so we can improve it and prioritise content;
  • send you updates, newsletters, guides, or marketing about our services where you have opted in (you can unsubscribe at any time);
  • investigate and resolve complaints, fraud, or misuse of the website.

5. Who we disclose it to

We may disclose personal information to:

  • our staff, contractors, and related entities within the Premium Real Estate group, including any affiliated property management service provider;
  • service providers who help us run the website, backend database, analytics, email, phones, chat, CRM, scheduling, and cloud infrastructure (see section 7 for named providers);
  • third parties you ask us to deal with on your behalf, such as mortgage brokers, accountants, solicitors, conveyancers, builders, property managers, and vendors' agents;
  • government bodies and regulators where we are legally required to, including the Australian Taxation Office and Consumer Affairs Victoria;
  • professional advisers and insurers where necessary for the operation of our business.

We do not sell personal information.

6. Cookies, tracking, and analytics

The website uses first-party JavaScript and browser storage to recognise visitors and sessions, measure performance, debug issues, and improve content. Specifically:

  • Visitor and session identifiers are stored in your browser's localStorage and sessionStorage. These are not cookies, but they operate similarly.
  • Page views, events, and form submissions are sent to our backend database together with your IP address, page path, scroll depth, and time on page.
  • Google Analytics 4 collects aggregated usage statistics.
  • Microsoft Clarity records session heatmaps and anonymised session replays with sensitive form fields masked.

Most browsers let you clear storage, block cookies, or use private browsing mode. Doing so may prevent parts of the site from working correctly.

7. Third-party service providers and overseas disclosure

The backend database and chat API that power premiumrea.com.au run on Alibaba Cloud infrastructure hosted in Hong Kong SAR. This means some personal information you submit through forms or chat is transmitted to, and stored on, servers located outside Australia. Other service providers we use include Google (Analytics, Cloud Run, Artifact Registry — Singapore, Identity Services / OAuth 2.0for Google Sign-In, and the Google People API for any additional profile data you consent to share), Microsoft (Clarity), Lark/ByteDance (messaging and calendar), and standard email providers. When you sign in with Google, the authentication itself happens on Google's servers (primarily in the United States), after which Google returns your verified profile data to our Hong Kong backend over TLS. By using the website and submitting information or signing in, you acknowledge that personal information may be disclosed to these overseas recipients. We take reasonable steps to ensure that overseas recipients handle personal information in a manner consistent with the Australian Privacy Principles, but you understand that Australian law may not apply to them.

8. Social media platform integrations

PremiumRea operates an internal publishing tool that connects to selected social media platforms — currently TikTok, YouTube, Instagram, and LinkedIn — through each platform's official Content Posting and Publishing APIs. This section explains what data is involved.

8.1 Scope of the integration

This tool is used exclusively to publish content from and to social media accounts that PremiumRea Pty Ltd owns or directly operates (for example, our @sharedopt presence on TikTok). It does not access, ingest, or process content belonging to any third-party user, audience member, follower, or commenter.

8.2 What data we receive from these platforms

When an authorised account owner authorises the integration via the platform's OAuth flow, we receive only:

  • a platform-issued account identifier (for example, the TikTok open_id);
  • an OAuth access token and refresh token scoped to publishing permissions only (for example, video.publish, video.upload, and user.info.basic);
  • basic account capability metadata (for example, the privacy levels the account is permitted to publish at) returned by the platform at publish time.

We do not access follower lists, direct messages, audience analytics, comments, or any personal data belonging to other users who interact with our content.

8.3 Storage and security of platform credentials

OAuth access and refresh tokens are stored on infrastructure controlled by PremiumRea, encrypted at rest using AES-256-GCM with keys derived per installation using HKDF. Tokens are transmitted only over TLS and are never written to application logs or shared with third-party analytics providers.

8.4 Retention and revocation

Tokens are retained only while the corresponding account is actively used for publishing. Tokens are deleted when (a) the account owner revokes access through the source platform's app management settings, (b) we discontinue use of the integration for that account, or (c) the platform invalidates the credential. We honour any revocation signal from the source platform immediately on the next API call.

If you are an authorised account owner and wish to revoke our access, you can do so at any time through the source platform's settings (for example, on TikTok: Settings & Privacy → Security & permissions → Manage app permissions). You may also email admin@premiumrea.com.au to request immediate deletion of the stored credentials on our side.

8.5 Governing platform terms

Our use of these integrations is governed by the Australian Privacy Principles and the respective platform developer terms, including the TikTok Developer Terms of Service and the TikTok Platform Developer Policies.

9. Storage, security, and retention

We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure — including TLS in transit, access controls, hardened servers, and restricted administrator access. No internet transmission or electronic storage is completely secure.

We retain personal information only for as long as we need it for the purposes described in this policy, or for as long as we are required to keep it by law. Client records are typically retained for seven years after the end of the engagement, in line with tax and record-keeping rules.

10. Your rights — access, correction, and complaints

You may request access to the personal information we hold about you, or ask us to correct it if it is inaccurate, out of date, incomplete, or misleading, by emailing admin@premiumrea.com.au. We will respond within a reasonable time.

If you believe we have breached the Australian Privacy Principles, please contact us first. If you are not satisfied with our response, you may make a complaint to the Office of the Australian Information Commissioner at oaic.gov.au.

11. Marketing and unsubscribing

If you opt in to marketing communications, you can unsubscribe at any time by clicking the unsubscribe link at the bottom of any marketing email, or by replying to any message asking to be removed. We comply with the Spam Act 2003 (Cth).

12. Children

The website is not directed at children under 16 and we do not knowingly collect personal information from them.

13. Changes to this policy

We may update this policy from time to time. When we do, we will update the “last updated” date at the top of the page. Significant changes will be highlighted on the website.

14. How to contact us

PremiumRea Pty Ltd
Suite 631, 44 Lakeview Drive, Scoresby VIC 3179
Email: admin@premiumrea.com.au
Phone: +61 480 099 909

See also: Website Disclaimer · Terms of Use

Want a new feature?

Tell us what to build next — get free Beta access.

Share an idea →