Privacy Policy
Last updated: 30 June 2025
About this policy
This privacy policy concerns how we manage information about, or which identifies, an individual (referred to as ‘personal information’ throughout this policy) in the places where we do business. It outlines the kinds of personal information we collect and hold, how we do so and the purposes for which we collect, hold, use and disclose it. This policy also states how individuals may access personal information about them that is held by us and seek correction of it, how individuals may complain about a breach of relevant privacy laws or regulations and how we will deal with such complaints. This policy also states whether we are likely to disclose personal information to overseas recipients and, where practicable, specifies those recipients’ countries.
We take additional steps to give notice of some other matters regarding our collection of personal information. These matters may be specific to particular kinds of personal information. Such notice may be in separate forms or contract terms.
This privacy policy is in addition to some other provisions which may be relevant to our management of individuals’ personal information, depending on their dealings with us and on our particular businesses.
This privacy policy does not apply to acts in respect of personal information which are not governed by the Privacy Act 1988 (Cth). The information we provide in this privacy policy regarding our management of personal information is subject to exceptions or qualifications which are provided for in that Act.
For the purposes of this policy, ‘resident’ means a resident of one of our over 50s communities.
Who are we?
We are an owner and developer of over 50s land lease communities in Australia. Information about our business can be found at https://millbray.com/. Any reference to “we”, “our” and “us” is a reference to Millbray Management Platform Pty Ltd ACN 667 729 651 and those of its related companies (collectively, Group) in relation to their activities and operations in owning, developing or managing those over 50s land lease communities (our communities) and in providing services to residents at those communities.
The kinds of personal information we collect and hold
The kinds of personal information that we collect and hold is set out in the following table.
| Kinds | Details |
| Marketing enquiries: | Contact and other personal information enabling us to provide general information about our services, activities and operations, typically: name, phone number and contact addresses (email, social media, business and home) information relevant to a general marketing enquiry, for example the general types of information of interest to the enquirer such as their preferred type of home. |
| Sales and enquiries: | Contact and other personal information enabling us to provide information specific to an individual about our services, activities and operations relevant to them, typically: name, phone number and contact addresses (email, social media, business and home) and date of birth information about the enquirer including their personal lifestyle, financial situation and health. potential transaction information such as bank account and payment card details information relevant to the enquirer’s specific enquiry. |
| Resident information: | Emergency contact information, including that of residents’ family, next of kin and any nominated emergency contacts. health information. Information collected by our customer services or sales staff in connection with customer service. information in relation to residents’ financial matters including financial standing, receipt of any rental assistance or pension, bank account and payment card details |
| Inductions or visitor registers: | Name, phone number and contact addresses (email, business and home), profession and company/business name and purpose of attendance. |
| Driver licence and vehicle information: | Driver licence details for drivers of residents’ community vehicles. Vehicle information for traffic management at residents’ community sites. |
| Community events: | Name, phone number and contact address, image, video recordings and audio recordings. |
| CCTV: | Photographs, images and video recordings. |
| Recruitment and employment: | Name, phone number and contact addresses (email, social media, business and home), date of birth, drivers licence details, tax file number, superannuation details, next of kin and emergency contact(s). CV, resume or application related information for example information about eligibility to work in Australia, education, academic transcripts, employment and criminal histories, professional memberships or trade qualifications. Health information. Background information checks including references and referees’ opinions about job performance, as well as any other information that may be provided during the background check process. |
| Public and government sources: | Publicly available and government-sourced information available via search services, such as those for recruitment, supplier service, landowner data, social media, company/business name data and land lease data relevant to the Group’s business and activities. |
| Suppliers: | Name, company/business details, phone number and contact addresses (email, social media, business). Health information. Information about suppliers’ services. Information for transactions such as bank account and payment card details. |
| Other: | We may collect other kinds of personal information with the individual’s consent or where that collection is within the individual’s reasonable expectations. |
Health information referred to in this policy would generally be of the type appropriate for providing our services to residents, ensuring safety at our residential sites. managing those sites effectively and, in the case of our staff and suppliers, for the proper conduct of our relationships. That information will typically be some of more of the following:
- basic medical history and current health status (diagnoses and conditions, medications, allergies, medical and surgical history and vaccination history)
- functional abilities and care needs (mobility, activities of daily living needs, cognitive status, communication abilities, dietary requirements and continence status)
- emergency contacts and advance health care directives and
- social and psychological well-being (mental health history, social interests and preferences, personal lifestyle and support network).
How we collect and hold personal information
How we collect personal information
We collect personal information from a number of sources and in a number of ways.
Sources
The sources of personal information we collect are mainly:
- residents
- residents’ family, next of kin and emergency contacts
- visitors to our community sites
- volunteers at our community sites
- suppliers to residents (including health service providers and contractors)
- employees and contractors and prospective employees and contractors
- regulators (including taxation, law enforcement, land lease, employment, corporate regulators).
Ways of collecting personal information
The ways we collect personal information may be in person, via communications and forms (paper or electronic) and via online interactions and (in the case of CCTV and community events), photography, video recording and sound recording. The general me for this collection are:
| Directly from individuals: | This occurs for most of the kinds of personal information we collect. This can be in person, via correspondence and forms (paper or electronically) and via online interactions (through our website, our apps, by social media and by smart phones and tablets). In the case of some health information, via observation of individuals. |
| From third parties: | This occurs, for example, where we collect personal information from residents’ family, emergency contacts and next of kin service providers, for example health service providers in connection with services to residents and others on our sites community events organisers and participants. |
| Public and government sources: | This occurs, for example, where we search for information, such as about potential job applicants, supplier services, landowner data, social media posts, company/business name data and land lease data relevant to the Group’s business and activities. |
| CCTV: | This occurs where we place CCTV devices at community sites. |
| Inductions or visitor registers: | This occurs directly from visitors or inductees, via paper or digital form. |
| Community events: | This may occur as part of events hosted by us or others at community sites. |
| Other | We may collect personal information in other ways where doing so is with the individual’s consent or within the individual’s reasonable expectations. |
How we hold personal information
We hold personal information in paper format at our business sites and in infrastructure owned or controlled by us or by a third party service provider. We have security measures in place regarding this infrastructure.
Purposes: why we collect, hold, use and disclose personal information
We collect personal information from, and disclose personal information to, a number of people. Depending on the types of personal information involved, these people are mainly:
- residents
- residents’ family, next of kin and emergency contacts
- visitors
- volunteers
- suppliers to residents and to us (including health service providers and contractors)
- employees and contractors and prospective employees and contractors
- regulators (including taxation, law enforcement, land lease, employment, corporate regulators)
In general terms, our purposes of collecting, holding, using and disclosing personal information are for the effective management of relationships with and between residents and of our functions and activities in promoting and managing Group community sites. Some specific purposes are set out below. Not all of these apply to all kinds of the personal information, or to all of the people to and from whom we collect personal information, as referred to above in this policy. The terms of contracts with us, and notices we may provide at or around the time of collection, may give more specific notice of our purposes.
- Preparing, finalising and complying with documents for land lease transactions, for example expressions of interest, contracts of sale and deposit forms.
- Communications with health service providers, family, next of kin and emergency contacts in connection with health-related incidents and services.
- Processing sales deposits/rent payments.
- Complying with safety obligations and procedures
- Recording, investigating and responding to health or safety incidents
- Including residents’ chosen contact numbers in community directories
- Assessing and monitoring candidates for paid and unpaid roles at Group sites
- Drug and other medical screening
- Administering relationships with past, present and future employees, contractors, supervisors, volunteers, trainees and students
- monitoring and reporting on systems and performance, including regular audits of our recruitment and contract work arrangements.
- meeting regulatory compliance obligations, including to taxation, superannuation, memployment and land lease regulators
- Providing support in respect of technical and professional skills and well-being
- Processing payments to and from third parties, for example payments from residents, payments to suppliers and payments to staff and contractors (whether hourly rates or wages or salary)
- Responding to sales enquiries
- Enrolling individuals on our mailing lists
- Data analytics, with or without de-identification
- Direct and indirect marketing
- As reasonably anticipated by individuals
- As consented to by individuals
Business acquisitions
From time to time we may be involved in actual or proposed business acquisitions. For these, we may collect, hold, use and disclose personal information to, with or from third parties (namely counterparties to those transactions). In these situations, it is our policy to observe the following:
- require confidentiality arrangements to be in place before any personal information transfers;
- only collect or as requires disclose personal information to the extent reasonably appropriate, for example appropriate due diligence processes;
- be satisfied about the security arrangements attendant on the transfers of personal information to and from the counterparties;
- de-identify personal information until such time as identification is reasonably necessary and
- have arrangements in place for the destruction or delivery up of personal information to the extent it is no longer reasonably required in connection with the relevant transaction.
Pseudonyms and anonymity
It is generally not practicable for our activities and operations to be carried out in respect of individuals whose identity is not reasonably apparent to us. There are also some laws that require or authorise us to deal with those who have identified themselves. Other than in these cases, individuals who deal with us have the option of not identifying themselves, or of using a pseudonym, when dealing with us in relation to particular matters. Choosing not to identify themselves when dealing with us may mean that we are not be able to provide the individuals with the products or services they require.
Marketing communications
We communicate details about our properties and services to past, existing and potential clients and their representatives. These communications are sent in various forms, including mail, SMS, email, telephone and social media. Individuals can opt out of receiving direct marketing communications at any time by lodging a request with our Privacy Officer or by using opt out facilities provided in our direct marketing communications.
How individuals may access and seek correction of their personal information
Individuals may request access to personal information we hold about them by making a request by telephone or email to our Privacy Officer. For phone contacts, our Privacy Officer may ask that the request be put in writing. Contact details for our Privacy Officer are set out below. We may charge a fee for providing access if it requires a significant amount of time to locate the requested personal information or to collate or present it in an appropriate form. We may decline to provide access to personal information where doing so may have an unreasonable impact upon the privacy of others or where we are not required by applicable privacy or other laws to give that access.
Where their personal information is inaccurate, out of date, incomplete, irrelevant or misleading, individuals may inform us of this and request that we correct it.
Complaints
If individuals are not satisfied with how we manage their personal information, they may lodge a complaint in writing with our Privacy Officer. Our policy is to aim for a response time within 14 days to discuss concerns and outline options about how they may be resolved. Our policy is to aim for privacy complaints to be resolved in an appropriate manner with which the complainant is satisfied. Individuals may contact our Privacy Officer to enquire about the progress of their complaint.
If individuals are not happy with how we have resolved their complaint, they may lodge a complaint with the Australian privacy regulator whose contact details are:
Australian Information Commissioner
www.oaic.gov.au
Telephone: +61 1300 363 992
Disclosures to overseas recipients
We are likely to disclose personal information outside Australia. Our reasons are:
- in connection with services provided by us via us from a provider who is located, or uses locations outside Australia
- in connection with services outsourced by us to a provider who is located or uses locations outside Australia, for example, data storage services.
These overseas recipients or their data storage servers may be located, and may store personal information from time to time, in a number of countries. For practical and security reasons, we are not able to provide a complete list of the organisations and locations to which we share personal information, however the provider of our customer relationship management (CRM) system has advised that, for it, those countries are likely to be the United States of America, European Union countries, India, Japan, Canada, the United Kingdom and South Africa.
Our Privacy Officer contact
Our Privacy Officer’s contact details are:
Email: clayton.simons@millbray.com
Modifications and updates
We may change this privacy policy from time to time. If we do this, we will give 14 days’ prior notice of the change via a notice on our website. If an individual does not agree to our continued use of their personal information due to the changes in our Privacy Policy, they may cease providing us with their personal information and contact our Privacy Officer at the details given above.