Privacy Policy

---

As the owner of Everest Property Buyers Agency,  I understand that privacy is important to you.  It is also subject to the requirements of the National Privacy Principles which are contained in the Privacy Act 1988 (the Privacy Act) and which govern how private sector organisations handle personal information.

 The Privacy Policy is designed to protect clients' personal information. The policy outlines how we collect, store, use, protect, and manage the information provided by clients. In order to assist clients in purchasing a property, personal information will need to be obtained. 

We will not disclose any personal information, unless:

• It is to be used to assist in the search and negotiation of a property that fits your requirements; or
• It is to be used to market the Agent with your consent; or
• Such information as required by law to be disclosed

You may access this  file relating to your brief, at any time. This shall be done by contacting the agency. You also have the right to correct any information that may be inaccurate, incomplete or out-of-date.

What personal information do we collect?

Personal information means any information that can identify you.

The agent may obtain personal information to provide services and manage relationships with clients. When clients acquire services, they may be asked to provide certain details, including their name and contact information, property preferences, budget for the purchase, birth date, income, and other financial information. 

 At times, personal information may need to be collected about individuals who are not customers of the Agent, such as business contact details of company representatives with whom the agent interacts.

Generally, sensitive information about clients—such as race, political beliefs, religion, or health—will not be collected unless necessary to provide services. If sensitive information is required, consent will be sought at the time of collection, unless an exception applies.

Everest ID Handling & Verification Policy

1. The "Sight, Don't Store" Rule

To minimize cyber risk, the policy of Everest Property Buyers Agency is to verify identity without retaining permanent copies of high-risk documents (like Passports or Licenses) unless strictly required for the Agency Agreement.

• Face-to-Face/Zoom: We must sight the original documents.
• Recording: Instead  of keeping a photo of the Passport/License, we record the details (Full  Name, Document Number (passport or License No), Expiry Date) in your Identity Verification  Register.
• Driver’s  Licenses: If we must collect a copy, it must be deleted immediately once the "Verification of Identity" (VOI) is complete.

2. Manual Verification Procedure (Step-by-Step)

For Zoom Meetings:

1. We ask  the client to hold the ID to the camera.
2. We compare  the photo to the person on the screen.
3. We Do not screenshot the ID during the Zoom call (this creates an  unencrypted image on your computer).
4. Manually  type the ID details directly into your Identity Verification  Register while on the call.

For Face-to-Face Meetings:

1. Physically  inspect the ID for signs of tampering.
2. If  we take a photo on your phone to "process later," we must move  that photo to a secure cloud folder (e.g., OneDrive/Dropbox with MFA)  and delete it from your phone's "Recently Deleted"  folder immediately.

3. Storage and Security

• Encryption: Any  digital copies of ID must be stored in a folder protected by passwords or Multi-Factor  Authentication (MFA).
• No Email Storage: We never leave copies of client IDs in your "Sent" or "Inbox" folders. Once received, we move them to  secure storage and delete the email permanently.
• Access: As  the sole director, only I (Prakash Pathak) have access to these records.

Identity Verification & AML/CTF Compliance

To comply with the Property and Stock Agents Act 2002 and AML/CTF Act 2006, Everest Property Buyers Agency is required to verify the identity of all clients. We prioritize your data security by:

• Verifying documents  manually via face-to-face or secure video link.
• Only recording necessary document numbers in a secure, protected register.
• Permanently destroying or  deleting copies of your ID once the verification process is completed and logged.

 To meet our legal obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act), we collect specific personal information during customer onboarding and due diligence. This text-based information may include:

• Full legal name, date of birth, and current residential address.
• Identification details such as driver's license number, passport number, or document expiry dates.
• Corporate structures, ultimate beneficial ownership details, and verified source of funds (where Enhanced Due Diligence is required).

Note on Data Minimisation: In accordance with the OAIC’s AML/CTF Privacy Guidance, we do not retain photocopies, scans, or full digital images of your physical identity documents. Once verification is completed via our compliant check processes, original digital image uploads are immediately and permanently destroyed, and only the required textual metadata and verification outcomes are recorded for compliance purposes. 

How is personal information collected and stored?

 The collection of personal information will depend on how clients interact with the Agent or the services they request. Personal information may be collected through an enquiry form on the website, during discovery or strategic calls, through the completion of a buyer's brief, or verbally during a personal consultation with the agent.

The Agent takes reasonable steps to ensure the security of personal information held, protecting it from risks such as loss, unauthorized access, destruction, use, modification, or disclosure.

 Information collected for customer verification is segregated and given enhanced security controls. We store these securely utilizing MFA and restricted access controls. Access is limited strictly to authorized compliance personnel within Everest Property Buyers Agency. These compliance records are securely archived for the statutory period of seven (7) years following the end of our business relationship, after which they are permanently and securely deleted. 

How is personal information used?

The policy is to use personal information only for the primary business purposes for which it was collected. The personal information collected may be used to:

• Provide clients with services or information they have requested
• Notify clients about other services or promotions from time to time
• Manage the relationship with clients

If clients wish to stop receiving notifications the Agent's services or promotions, they can inform so. By providing personal information, clients consent to receiving communication from the agent via phone calls, SMS messages, and email.

 We use the regulatory data collected exclusively to:

• Establish and verify your identity before providing buyers' agency or property brokerage services.
• Assess and manage potential money laundering or terrorism financing risks associated with property transactions.
• Maintain mandatory compliance records and generate reports legally required by the Australian Transaction Reports and Analysis Centre (AUSTRAC).

Information collected for AML/CTF purposes will strictly not be used or disclosed for any secondary marketing or unrelated commercial purposes. 

Will personal information be given to anyone else?

 The policy is designed to maintain the confidentiality of all personal information held by the Agent and to prevent its misuse. The agent does not sell, rent, or trade personal information with third parties.

However, in certain circumstances, personal information may be disclosed as below:

• Legal disclosures may need to be made to law enforcement agencies, government bodies, courts, or external advisers.
• Personal information may be shared with third parties when related to the provision of services. Clients will be informed of such disclosures when they request services from the agency.

Additionally, personal information may be disclosed to third parties that the agent contracts for specialized functions, such as mailing houses and printing companies. In these cases, steps will be taken to ensure that those contractors comply with the Privacy Act and are authorized only to use personal information for the functions required by the Agent.

 We may disclose your personal information to third parties only where required or permitted by law. This includes disclosures to:

• Government agencies and regulatory bodies, including AUSTRAC, law enforcement, and federal courts.
• Third-party identity verification service providers utilized exclusively to validate the authenticity of onboarding data.

Under the AML/CTF Act’s strict "tipping-off" legislative provisions, we are legally prohibited from disclosing to any client if a suspicious matter report or regulatory investigation has been triggered. Consequently, access requests to your records may be lawfully refused if they violate these statutory secrecy rules. 

How can you access and correct your personal information?

 Under the Privacy Act, clients have the right to seek access to information held about them, although there are some exceptions. Clients also have the right to request corrections to any inaccurate, incomplete, or outdated information. The Agent's  policy is to consider requests for access or correction in a timely manner.

To provide access to personal information, the agency would typically supply a printout of the relevant information from current databases or copies of computer records files.

Data Breach Notification & Response

In the event of a suspected data breach involving personal information held by Everest Property Buyers Agency, we will act in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988.

We will immediately:

• Contain: Take all reasonable  steps to contain the breach and limit further access.
• Assess: Conduct an expeditious assessment within 30 days to determine if the breach is likely to result in "serious harm" to any individual.
• Notify: If a breach is  assessed as an "eligible data breach," we will notify the Office of the Australian Information Commissioner (OAIC) and  all affected individuals as soon as practicable.

Notification will include a description of the breach, the types of information involved, and recommendations on steps you should take (e.g., changing passwords or monitoring for identity theft etc.).

Questions or Complaints

 If clients have any questions about the privacy policy, wish to lodge a complaint regarding the handling of their personal information, or seek to access or correct their personal information, they are encouraged to contact us directly.

Phone: 0402 520 095

Email: admin@everestpropertybuyers.com.au  or prakash@everestpropertybuyers.com.au

Address: 67 Budapest Street Rooty Hill NSW 2766

Complaints Handling Procedure

Everest Property Buyers Agency is committed to providing excellent service. If you feel we have fallen short, we want to hear from you.   

Step 1: Contact us directly
Please email or contact us  on the above address with the subject line "Formal Complaint." Include:

• Your name and contact details.
• A clear description of the  issue.
• What you would like to happen to resolve the matter.

Step 2: Acknowledgment
We will acknowledge receipt of your complaint within 24–48 hours.

Step 3: Investigation and Response
As a sole trader, Prakash Pathak will personally investigate the matter. We aim to provide a formal written response and a proposed resolution within 7 business days.

Step 4: External Review
If you are not satisfied with our response, you may contact NSW Fair Trading at 13 32 20 or visit www.fairtrading.nsw.gov.au.

This privacy policy may change from time to time.
Last Updated: May 2026