Legal · Privacy

Privacy Policy

Effective date: 7 October 2026 · Last updated: 7 October 2026

This Privacy Policy explains how Tenancy Matters collects, uses, holds and discloses personal information. It is prepared in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who We Are

Tenancy Matters Pty Ltd (Tenancy Matters, we, us, our) is an Australian company based in Victoria that provides tenant representation and lease advisory services. This policy applies to personal information we handle through tenancymatters.com, our client portal at clients.tenancymatters.com, and in the course of providing our services.

Our sister product, leaseSmarter, has its own Privacy Policy at leasesmarter.com.au.

2. What Personal Information We Collect

We may collect the following kinds of personal information:

• Contact and identity information: your name, business name, role, email address and phone number.
• Enquiry information: what you tell us through our contact form, by email or by phone, such as your lease stage and a description of your requirements.
• Engagement information: details of your property requirements, headcount and budget, and documents such as leases, Heads of Agreement, disclosure statements, plans and photographs. These documents may contain personal information about you and others, such as landlords, agents, guarantors and contractors.
• Client portal information: your login email address, and the documents, key dates, contacts, condition report notes and photographs you or we store in the portal.
• Technical information: IP address, browser type and device information collected automatically by our hosting and security providers when you visit the Site.

We do not seek to collect sensitive information (such as health information or government identifiers). Please don't include it in enquiries or uploaded documents unless it is needed.

3. How We Collect Personal Information

• Directly from you, when you submit our contact form, email or call us, meet with us, sign an engagement, or use the client portal.
• From third parties in the course of an engagement, such as landlords, leasing agents, your solicitor or other advisers, where needed to carry out your instructions.
• Automatically, through the technical operation of the Site (see section 8).

Where practicable, we collect personal information directly from you.

4. Why We Collect and Use Personal Information

We collect and use personal information to:

• respond to your enquiries;
• prepare proposals and provide tenant representation and lease advisory services;
• communicate with landlords, agents and other parties on your behalf, as instructed;
• provide and support the client portal;
• keep records of our advice and the work we have done;
• manage invoicing and our business administration;
• maintain the security of the Site and our systems; and
• comply with our legal obligations.

We will not use your personal information for a purpose that is unrelated to the purpose for which it was collected without your consent, unless otherwise permitted by law.

5. Marketing Communications

We will only send you marketing communications, such as market updates or news about our services, if you have agreed to receive them or would reasonably expect to. You can opt out at any time by using the unsubscribe link in the email or by contacting us. We will action opt-out requests within 5 business days.

6. Disclosure of Personal Information

We do not sell, rent or trade your personal information. We may disclose personal information to:

• Parties to your transaction, such as landlords, leasing agents, your solicitor, fit-out contractors and other advisers, where needed to carry out your instructions.
• Formspree, Inc., which processes submissions from the contact form on our website and forwards them to us.
• Google LLC (Google Workspace), which hosts our email, calendar and document storage. Documents you email to us, or share with us through Google Drive, are stored there.
• Supabase, Inc., which hosts our client portal and its data in Australia (Sydney region).
• Netlify, Inc. and Cloudflare, Inc., which host and deliver our website and process technical information (such as IP addresses) to do so.
• Professional advisers such as our lawyers, accountants and insurers, under obligations of confidentiality.
• Law enforcement or government bodies, where required or authorised by law.

7. Overseas Disclosure

Some of our service providers process data outside Australia. As at the date of this policy, these include:

• Formspree, Inc. — United States
• Google LLC (Google Workspace, and YouTube for embedded video) — United States and other locations where Google operates
• Netlify, Inc. and Cloudflare, Inc. — United States, and global delivery networks

Our client portal data is hosted in Australia. Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles it consistently with the Australian Privacy Principles, in line with APP 8.

8. Cookies and Similar Technologies

Our website does not currently use analytics or advertising cookies.

• Embedded video. Our website embeds a video from YouTube in privacy-enhanced mode. YouTube (Google) may set cookies or collect information about your device if you choose to play the video.
• Web fonts. Our pages load fonts from Google Fonts, which means your browser connects to Google's servers and shares your IP address with Google.
• Client portal. The portal stores sign-in session information in your browser so that you stay logged in.

You can block or delete cookies through your browser settings, though some features may not work as a result. If we introduce analytics in future, we will update this policy.

9. Data Security

We take reasonable steps to protect the personal information we hold from misuse, interference, loss, and unauthorised access, modification or disclosure. Our measures include:

• encrypted transmission of data over HTTPS/TLS;
• password-less, email-based sign-in and access controls on the client portal, so each client can see only their own workspace;
• restricting access to personal information to people who need it; and
• using reputable, security-focused service providers.

No transmission of data over the internet is completely secure. If you believe your personal information has been compromised, please contact us immediately.

If an eligible data breach occurs, as defined under Part IIIC of the Privacy Act 1988 (Cth), we will notify affected individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme.

10. Data Retention

We keep personal information only for as long as necessary for the purposes for which it was collected, or as required by law. Engagement records, including file notes of advice and the documents relating to an engagement, are generally kept for seven years after the engagement ends for accounting, legal and professional-compliance purposes. When personal information is no longer required, we take reasonable steps to destroy or de-identify it.

11. Your Rights: Access and Correction

Under the Privacy Act 1988 (Cth) you may:

• request access to the personal information we hold about you;
• ask us to correct personal information that is inaccurate, out of date, incomplete or misleading;
• withdraw your consent to our use of your personal information, where that use is based on consent; and
• ask us to delete your personal information, subject to any legal obligation to retain it.

To make a request, contact us using the details below. We will respond within 30 days and will not charge a fee for making a request or for our response to it. We may decline a request in limited circumstances permitted by the Australian Privacy Principles, and will give written reasons if we do.

12. Children's Privacy

Our services are provided to businesses and are not directed at individuals under the age of 18. We do not knowingly collect personal information from minors.

13. Links to Third-Party Sites

Our website contains links to third-party websites, including leaseSmarter and LinkedIn. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies.

14. Complaints

If you believe we have mishandled your personal information or breached the Australian Privacy Principles, please contact us in writing. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal obligations. The current version will always be available on this page. Where changes are material, we will notify current clients by email.

Contact Us

For privacy enquiries, requests or complaints, please contact:

We aim to respond to all privacy enquiries within 5 business days.