The Mirvac Group complies with the Australian Privacy Principles contained in the Privacy Act 1988 to protect the personal information Mirvac Group holds about individuals.  

Mirvac’s policy is to only collect personal information which is reasonably necessary for its dealings with the relevant individual. Mirvac only uses personal information for the purpose specified or which is reasonably apparent at the time the information was collected, or for a related purpose for which the individual would reasonably expect it to be used. Mirvac takes reasonable steps to protect personal information that it holds from unauthorised access, modification, misuse, interference and loss. Mirvac may sometimes disclose personal information overseas to allow external parties to perform their services for Mirvac but Mirvac will only do so in accordance with the Australian Privacy Principles.

The Mirvac Group Privacy Policy contains information about how you may request access to and correction of personal information Mirvac holds about you, or to make a complaint about an alleged breach of the Australian Privacy Principles.

Mirvac's Privacy Policy

Updated September 2022

1 Introduction

Mirvac is an Australian listed property group, with an integrated development and asset management capability. Mirvac’s operations are principally located in Australia's four key cities of Sydney, Melbourne, Brisbane and Perth. Our key activities include:

• asset management: Mirvac owns and manages assets across the office, retail and industrial sectors;
• development: Mirvac also develops commercial and residential assets. 

Mirvac recognises the importance of privacy and is committed to protecting individuals’ personal information. This Policy details how Mirvac handles personal information in accordance with the Privacy Act and the Privacy Principles. This Policy sets out the kinds of personal information we collect, how that information may be used, and under what circumstances it may be disclosed. In this Policy, “you” and “your” refers to any individual about whom we collect personal information.

This Policy does not apply to certain types of information which are not covered by the Privacy Act, including certain employee records in relation to our current or former employees. However, where the personal information we have collected in relation to current or former employees is within the scope of the Privacy Act, this Policy applies to that personal information

2 Companies covered by this Policy

The Mirvac group, comprising Mirvac Limited (ABN 92 003 280 699) and Mirvac Property Trust (ARSN 086 780 645), which are stapled and trade together under the market code “MGR” on the Australian Securities Exchange and their respective controlled entities (collectively “Mirvac”, “we”, “us” or “our”) are subject to the Australian Privacy Principles (Privacy Principles) contained in the Privacy Act 1988 (Cth) (Privacy Act).

3 Collection of personal information

The kinds of person information we collect

Personal information is any information (including an opinion) which can be used to identify you. The types of personal information that Mirvac collects about you will depend upon what dealings you may have with Mirvac.

Examples of where Mirvac may collect and hold your personal information include, but are not limited to, situations where you:

• Interact with us in a professional or commercial capacity, including as a customer, a contractor or a business partner;
• purchase, or express an interest to purchase, a Mirvac home or apartment (for example, when entering into a sale and purchase agreement, or when responding to requests for information about a Mirvac home or apartment);
• register or subscribe for electronic newsletters (in person, at one of our shopping centres or online) customer loyalty programs, competitions or promotions run by Mirvac;
• hire mobility equipment in a Mirvac managed shopping centre;
• enter a Mirvac managed shopping centre, building or car park (for example, our camera surveillance systems (commonly referred to as CCTV) may collect footage or still images of individuals and vehicles as well as licence plate details for safety and security purposes);
• visit our sites, offices or other Mirvac managed buildings, where you may be required to register before entry for building safety and contact tracing purposes; 
• park in a Mirvac managed car park that has a ticketless parking system (Mirvac may collect licence plate details and in certain circumstances, name, email address and telephone number to measure parking duration and to provide data to improve the management of the car park);
• use mobile applications developed by Mirvac or logon to wireless facilities provided in a Mirvac managed building or shopping centre;
• lease, or express an interest to lease, premises, or spaces (including retail pop up spaces), including any related guarantors (for example, when negotiating, entering into or applying to enter into a lease with Mirvac);
• seek employment with, or work for, Mirvac including as a contractor (for example, Mirvac may conduct background checks prior to offering you a position of employment);
• supply goods and services (for example, when establishing records and systems to enable payment for goods);
• are a security holder in Mirvac group securities or you invest in Mirvac investment vehicles (for example, when establishing accounts and carrying out due diligence). In the case of Mirvac group securities, Mirvac may collect personal information of its security holders from its external registry service provider, Link Market Services Limited;
• use Mirvac’s websites, social media and other online services;
• are provided a loan or other financial accommodation by Mirvac; or
• otherwise interact with Mirvac.

Mirvac only collects personal information that is reasonably necessary for us to conduct and operate our business. The types of personal information which we collect include:

•  personal details (for example, your name, gender, address, email address, contact details, date of birth, photographic or video images); 
• information needed to verify your identity such as your drivers licence, passport or Medicare details; 
• your tax file number; 
• information about your financial position and credit-worthiness; 
• professional details (such as your occupation and job title);
• information including your image collected via our CCTV systems; 
• information about you that is required or authorised by law; 
• your opinions and/or preferences about Mirvac’s products, services or staff;
• information about how you use our products and services; and
• other details regarding our interactions and transactions with you.

Sensitive Information

Sensitive information is a subset of personal information which includes (for example) information about race or ethnicity, political or religious beliefs, sexual preferences, criminal record and health information (including biometric data). 

Mirvac generally does not need to collect sensitive personal information to operate our business. However, in certain circumstances, Mirvac may collect sensitive information about you if it is reasonably necessary to do so. Where this is required, we will obtain your consent to collect this information. Your consent to our collection and retention of this information can be withdrawn at any time by contacting the Privacy Officer (refer to details at Section 11). To update senstive information, refer to Section 9 of this Policy. Applying for employment with Mirvac.

Mirvac collects personal information from you if you submit an application or register interest for employment with Mirvac, such as your name, title, gender, date of birth, contact details, qualifications and work history (including references and other information included in a CV, resume or cover letter as part of the application 
process). Generally we will collect this information directly from you.

We may also collect personal information from third parties in ways which you would expect (for example, from recruitment agencies or referees you have nominated). Before offering you a position, we may collect additional details such as your tax file number and superannuation information, and other information necessary to conduct background checks to determine your suitability for certain positions. We may also collect information from third party sources including any information that is readily available via publicly accessible online profiles, where the collection is reasonably necessary for our functions and activities.

If your application is unsuccessful, Mirvac may retain your personal information for a reaonable period, to consider you if a more appropriate opportunity becomes available. Where you do not want us to do so, you can request the removal of this information. 

Security holders

We (or our external registry service provider, Link Market Services Limited) may also collect information to maintain security holder information in accordance with Australian Securities Exchange requirements, such as:

• the name of the individual security holder and any trustee (if applicable);
• personal details relating to any power of attorney (e.g. the attorney’s name, address, occupation, 
  date of birth and phone number);
• bank account details; and
• your SRN or HIN.

When we collect personal information from security holders, we may also use and disclose it for other reasons relating to your security holding, such as identity verification, providing security holder services, sending you correspondence and documents and responding to complaints or enquiries. 

Information collected online 

Mirvac may collect the following information from you if you interact with us online, including when you use an application developed by us: 

• Cookies

A cookie is a small data file that may be placed on your computer (usually in the browser software folder) during a visit to a Mirvac website. Cookies are necessary to allow the Mirvac website and your computer to interact effectively and enhance security. Cookies can record information about your visit to assist Mirvac in better understanding your needs. For example, this data may be collected and used to infer demographic information about you using various web analytic technologies. Mirvac sometimes also uses performance tracking technology (such as conversion tags) to help Mirvac to track your behaviour on our websites. General user traffic and performance tracking data is collected on an aggregate level to report statistics to assist Mirvac to improve the quality and relevancy of its services. If you have completed the online registration form on Mirvac’s websites, cookie data may be linked to the personal information Mirvac holds about you. In these circumstances, this cookie data will be treated the same manner as the personal information to which it has been linked. 

Mirvac may also use cookies from third party ad servers for the purpose of targeting our online advertisements on other sites. The cookies provided by the third party ad servers will collect information about the device you use to access our website (such as the type of device, the browser type or the operating system), your browsing behaviour (such as what you searched for, the pages you viewed, the date and time of the visit and how long you stayed) and the performance of our marketing campaigns (such as which ads or online content the user viewed or accessed). The information collected through this technology is not personally identifiable but such information will be shared with the third party ad servers for the purposes of showing you more relevant advertising on Mirvac’s websites or partner sites.

If you access a Mirvac group website and do not wish to receive any cookies, you should set your browser to refuse cookies. If you do so you may not be able to use certain parts of the Mirvac website. If you do not want third party ad servers to use cookies for targeted advertising purposes, you can use an opt out mechanism provided by various advertising industry bodies such as Network Advertising Initiative opt-out (http://www.networkadvertising.org/choices/DAA).

•  Wi-Fi networks (or similar) 

Where electronic devices such as mobile phones and tablets are enabled to allow connectivity to and are detected by Wi-Fi networks (or similar) in Mirvac managed buildings or shopping centres, Mirvac may automatically collect data relating to the device identification code and its location. Mirvac may use the anonymised data to create aggregate information to, among other things, analyse shopping behaviour to improve its shopping centres, but the aggregate information will not identify you. If you do not wish to have your device identification code detected, you should disable the Wi-Fi network (or similar) connectivity of your device. 

When you register to use Wi-Fi services provided by Mirvac, Mirvac collects your personal information in relation to your use of the Wi-Fi services, and for any other purposes you consent to at the time of registration. 

• Applications

When you download and use applications developed by Mirvac, Mirvac may collect and use your personal information in relation to your use of those applications, and for any other purposes which you consent to at the time. Where it does so, Mirvac will handle your personal information in accordance with any applicable terms of use of the application, and this Policy.

• Website Analytics

Mirvac’s websites use, among other technologies, Google’s suite of analytics programs to track website traffic. Where you have chosen to enable Google to associate your web and app browsing history with your Google account, and to use information from your Google account to personalise ads, Google will use data from its signed-in users together with Mirvac’s Google Analytics data to build audience lists for cross-device remarketing. For users of Mirvac’s websites, Google Analytics will collect Google-authenticated identifiers associated with your Google Accounts (and therefore, personal information). Google Analytics will also temporarily join these identifiers to Mirvac’s Google Analytics data. If you do not wish to have your Google-authenticated identifiers joined with Mirvac’s Google Analytics data, you should opt out of the ‘personalised ads’ option via your Google account.

How Mirvac collects your personal information

As long as it is reasonable and practicable for us to do so, Mirvac will only collect personal information about you directly from you. However, in some circumstances, it may be necessary for us to access or collect personal information about you from a third party, including an agent, employee or Mirvac’s authorised agents, service providers and subcontractors. 

4 Notification of Collection of Personal Information

Mirvac takes reasonable steps to provide a privacy collection statement at the time we collect personal information from you. This privacy collection statement will generally include details about the purpose of the collection, the entities that your personal information will be disclosed to, overseas recipients of your personal information (where applicable), and that this Policy contains information about how you may access your personal information held by Mirvac and how you may make a complaint.

5 Use and Disclosure of Personal Information

Mirvac operates a number of businesses which handle personal information. The personal information we collect will generally be used or disclosed for the purposes for which it is collected, and for any other purpose related to that primary purpose and for which you might reasonably expect us to use it (including as described in this Policy).

In general, Mirvac uses personal information for the following purposes:

• to manage our relationship with you;
• to provide products or services that have been requested by you;
• to communicate with you;
• to manage and enhance our products and services, including analysing customer feedback and future customer needs;
• to provide ongoing information and marketing about products and services that Mirvac believes you may be interested in, where you have requested or agreed to receive this information and have not opted out;
• to manage security and safety requirements in Mirvac managed buildings and sites;
• to assess your suitability as a prospective tenant, employee or business partner;
• to recruit employees and contractors;
• to fulfill our obligations to employees; and
• to comply with our regulatory and legal obligations

Your personal information may be disclosed to other entities within the Mirvac group and used by those entities for the same purposes for which we are entitled to use it. 

Disclosures of personal information to external third parties

We may also disclose your personal information to external third parties in certain circumstances where authorised or permitted by law. Those third parties may include:

• Mirvac's contractors, consultants, advisers and service providers who assist Mirvac in the operation of its business or provide services to us or our customers (for example, a company which helps maintain Mirvac's computer systems or sends out Mirvac's mail); 
• joint venture partners for the purposes of seeking relevant regulatory approvals; 
• third party lenders and insurers; 
• the Australian Securities Exchange, the Australian Securities and Investments Commission and other regulatory authorities or government agencies as agreed to or required by law; 
• anyone authorised by you; and
• relevant external third parties in situations when Mirvac is required by law to provide the information.

Mirvac does not sell personal information to entities outside the Mirvac Group. 

Disclosures of personal information to overseas recipients 

From time to time, Mirvac may disclose personal information to external third parties located outside of Australia. These currently include organisations located in the countries listed in the Appendix to this Policy. Mirvac will only disclose personal information overseas in accordance with the Privacy Act. This includes taking reasonable steps to ensure that the third party has appropriate data handling arrangements in place. 

6 Direct Marketing

Mirvac may use or disclose your personal information for the purpose of sending you marketing materials to inform you about our products and services, upcoming promotions and events, or other opportunities that may interest you or as otherwise permitted under applicable laws. 

The individual’s prior consent will be obtained before personal information is used for marketing purposes in situations where the personal information has been collected from the individual and the individual would not reasonably expect Mirvac to use the information for that purpose, the personal information has not been collected directly from the individual or where sensitive information is involved. If you no longer wish to receive marketing materials from us, you can opt-out via the relevant method provided for in an electronic marketing message you receive (e.g. via an ‘unsubscribe’ link) or write to the Mirvac Privacy Officer (refer to contact details below) at any time.

If you opt-out of receiving marketing material from us, Mirvac may still contact you in relation to our ongoing relationship with you.

7 Security of Personal Information

Mirvac stores information in paper-based files or electronic record keeping methods in secure databases (including trusted third party storage providers based in Australia and overseas). Personal information may be collected in paper-based documents and coverted to electronic form for use or storage (with the original paper-based documents either archived or securely destroyed). 

Mirvac takes reasonable steps to protect personal information that it holds from misuse, interference and loss and from unauthorised access, modification or disclosure. Mirvac maintains physical security measures over its physical premises and paper data stores (including through locks and security systems at our premises), and a range of computer and network security measures over its electronic systems (such as systems access, user identifiers and passwords, multi-factor authentication, firewalls and data encryption while data is in transit and at rest). Our websites use encryption and other technologies to ensure the secure transmission of information via the internet. Notwithstanding our use of encryption or other technologies to ensure secure transmission of information, users of our websites are encouraged to exercise care in sending personal information via the internet.

8  Access to your Personal Information 

You are entitled to access your personal information, including any sensitive information in relation to you, held by Mirvac on request. To request access to this information, please contact the Mirvac Privacy Officer (refer to contact details in Section 11). Mirvac will require evidence to verify your identity prior to determining if your request can be fulfilled.

This service is free of charge unless the personal information requested requires additional preparation time. In this situation, Mirvac will provide a reasonable estimate of how much this service will cost and request agreement from you before proceeding.

In normal circumstances, Mirvac will provide you with access to your personal information. However, in some circumstances, there may be legal, regulatory or administrative reasons to deny your requested access. If access is denied, Mirvac will provide you with the reasons for doing so. 

9 Changing your Personal Information

We will take reasonable steps to ensure that the personal information we collect, use or disclose is accurate, complete and up-to-date. You can help us to do this by letting us know if you notice errors or discrepancies in information we hold about you and letting us know if your personal details change.

If you consider any personal information we hold about you is inaccurate, out-of-date, incomplete, irrelevant or misleading you are entitled to request the correction of your personal information by contacting the Mirvac Privacy Officer (refer to contact details below). After receiving a request from you, we will take reasonable steps to correct your information.

We may decline your request to correct your personal information in certain circumstances in accordance with the Privacy Principles, If we do refuse your request, we will provide you with the reasons for doing so and will include a statement with your personal information about the requested correction.

10 Retention of Personal Information

Where we no longer need to use or disclose your personal information for any purpose required under the Privacy Act, this Policy, or where we are not otherwise legally required to retain that information, we will take reasonable steps to either destroy or de-identify personal information.

11 Complaints

You can make a complaint to the Mirvac Privacy Officer if you believe that we have breached our obligations under the Privacy Act or failed to comply with this Policy. Any complaint should be made in writing and sent to us using the contact details in Section 11.

Mirvac takes privacy-related complaints very seriously.We will acknowledge receipt of your complaint within a week and endeavour to complete our investigation into your complaint promptly. First, we will consider your complaint to determine whether there are simple or immediate steps which can be taken to resolve the complaint.

If your complaint requires more detailed consideration or investigation, we may ask you to provide further information about your complaint and the outcome you are seeking. We will then typically gather relevant facts, locate and review relevant documents and speak with individuals involved.

In most cases, we will investigate and respond to a complaint within 30 days of receipt of the complaint. If the matter is more complex or our investigation may take longer, we will let you know. 

If you are not satisfied with our response, or we have not responded to your complaint within 30 days, you can refer your complaint to the Office of the Australian Information Commissioner (OAIC).as follows: 

Phone: 1300 363 992 
Web: www.oaic.gov.au
Address: GPO Box 5218 Sydney, NSW 2001

Where your complaint relates to the Mirvac Property Trust, you may also be able to refer your complaint to the Australian Financial Complaints Authority (AFCA). Please refer to afca.org.au for further details. 

12 Contacting Mirvac

The Mirvac Privacy Officer can be contacted as follows: 

Phone: (02) 9080 8000 
Email: privacy@mirvac.com 
Address: 'Mirvac Privacy Officer' 
Mirvac Group Compliance
Level 28, 200 George Street 
Sydney, NSW 2000 

13 Changes to this Policy

We may update this Policy from time to time to reflect our current information handling practices, to take account of new laws and technologies or the changing business environment, and to reflect changes to our operations and practices.  

When we do so, the updated Policy will be available on the Mirvac website at http://www.mirvac.com. We recommend that you regularly visit our website and review this Policy.

14 Approved and Adopted

This Policy was last approved and adopted by Mirvac on 15 September 2022.

Appendix - Disclosure to other countries

Updated 15 September 2022

Personal information may be disclosed to third parties performing services for Mirvac located in the following jurisdictions:

• the United States of America;
• Japan;
• the Philippines; and
• the United Kingdom; and
• Ireland