Privacy Policy
1. About this policy
This policy explains how Elate Holdings Pty Ltd (ABN 58 655 961 176), trading as Copay (Copay, we, us, our), collects, holds, uses and discloses personal information. It applies to copay.au, our owner portal, our chat, and our emails, calls, events and social media pages. It covers everyone who deals with us: people interested in co-ownership, applicants, co-owners and their representatives, guests, agents and partners, suppliers and job applicants.
We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and we comply with the Privacy (Tax File Number) Rule 2015 when we handle tax file numbers.
The trustee of each home is a separate company and is not part of Copay. When we keep the unit register and owner records for a trustee, we do so on its behalf, and the trustee’s privacy policy also applies. We name the trustee for a home, and tell you where to find its privacy policy, in the documents for that home.
In short: we collect what we need to answer your enquiry, assess an application, run your home and meet our legal obligations. We do not sell personal information. You can ask to see or correct your information, opt out of marketing, and complain to us or to the Office of the Australian Information Commissioner.
2. Contact us
Privacy Officer, Copay, Level 18, 324 Queen Street, Brisbane QLD 4000 · director@copay.au · 0410 080 691
3. The personal information we collect
| If you are | We may collect |
|---|---|
| Interested in co-ownership | Name, email, phone, suburb or postcode, the places and homes you are interested in, your preferred timing and budget range, how you heard about us, your chat messages, emails and call notes, and your marketing and advertising preferences |
| An applicant or co-owner | The above, plus your date of birth, residential address, identity documents and verification results, whether you are a foreign person and related approvals, your units, nights, bookings and stays, registered guests, levy payments and arrears, payment details, votes, correspondence, and your tax file number if the trustee asks for it |
| Acting for a co-owner | Your name, contact details, and evidence of your authority, such as a power of attorney or grant of probate |
| A guest | Your name, contact details and stay dates, given to us by the co-owner who registered you |
| Attending an event or webinar | Your name, contact details, attendance and any questions you ask |
| A visitor to our website | Device and browser information, IP address, pages viewed, the referring site, and cookie and pixel data, as described in section 11 |
| An agent, partner or supplier | Your name, business and contact details, licence details, and records of our dealings |
| A job applicant | Your application, work history and referee details |
Sensitive information. We collect sensitive information only with your consent and only where we need it:
- if you tell us about access or health needs so a home can be prepared for your stay, we use that information only for that purpose; and
- if you choose to verify your identity by face matching, our identity verification provider compares a photo of your face with the photo in your identity document. The resulting biometric information is used only to verify your identity and is kept as set out in section 12. You may choose another verification method instead.
Children. Our services are for adults. We collect information about a child only when a parent or guardian registers the child as a guest, and then only the child’s name.
4. How we collect it
We collect most personal information directly from you, when you complete a form, register interest in a home, chat with us, call, email, attend an event or use the owner portal. We also collect it:
- from a real estate agent, finance partner or other person who introduces you to us, with your agreement;
- from Meta, when you submit a lead form on Facebook or Instagram;
- from a co-owner who registers you as a guest or appoints you as their representative;
- from the trustee of a home, and from the local manager, about stays and the home;
- from our identity verification provider, and from public registers and sanctions lists, when we verify an applicant; and
- automatically, through cookies, pixels and similar technologies on our website and in our emails.
If we receive personal information we did not ask for and do not need, we destroy or de-identify it where it is lawful and reasonable to do so.
If you do not give us the information we ask for, we may be unable to answer your enquiry, assess your application, admit you as a co-owner or manage your bookings.
5. How we use and disclose it
We use personal information to:
- answer enquiries and tell you about the homes and places you have asked about;
- assess applications, verify identity, and meet our legal obligations, including under tax and foreign acquisitions laws, and anti-money laundering laws where they apply to us;
- admit co-owners and keep the unit register for the trustee;
- run bookings, the peak draft, the Christmas and New Year rotation, swaps, gifts and cancellations;
- issue levies, collect payments and manage overdue amounts;
- coordinate the local manager, cleaners and tradespeople;
- run meetings, votes, transfers and estate matters;
- send service messages, and marketing where you have agreed or the law permits;
- improve our website, portal and services; and
- handle complaints and disputes.
We may also use or disclose personal information for a related purpose you would reasonably expect, or where the law requires or permits it.
Artificial intelligence tools. We use artificial intelligence tools in some of our work, including in our chat and to help draft and summarise messages. A person checks anything we send you that an AI tool has helped prepare. We do not enter sensitive information, identity documents or tax file numbers into AI tools, and we use providers that do not use your information to train their models. AI tools are not used to make the decisions described in section 7.
6. Direct marketing
We send marketing emails and SMS only with your consent or where the Spam Act 2003 (Cth) otherwise permits. Every marketing message identifies Copay and tells you how to unsubscribe, and we act on your request within five business days.
We may call you about an enquiry you have made or a home you have registered interest in. If you ask us not to call you, we will not.
If you have agreed, we may use your email address or phone number, in hashed form, to show you Copay advertising on Facebook and Instagram, or to find people with similar interests. We use co-owners’ details only to exclude them from advertising.
You can ask us at any time to stop sending you marketing, or to stop using your information for advertising, by using the unsubscribe link, replying STOP to an SMS, or contacting our Privacy Officer. You can also ask us where we got your information, and we will tell you unless that is impracticable or unreasonable. We keep a record of your request so that we continue to honour it.
7. Automated decisions
We use computer programs, including the rules-based software in our owner portal and our customer database, to make some decisions, or to do things that are substantially and directly related to making decisions, that could reasonably be expected to significantly affect your rights or interests. This section describes the kinds of personal information those programs use and the kinds of decisions involved.
Kinds of personal information used
- your contact and enquiry details, the homes and places you are interested in, and how you engage with our emails and website;
- your identity details and documents, and the results of identity and sanctions checks;
- your units, nights, nights used and remaining, position in the peak draft and the Christmas and New Year rotation, booking requests, stays and cancellations; and
- your levy balances, payment dates and whether a default notice under the trust deed applies to your units.
Kinds of decisions made solely by a computer program
- whether a booking request, change or swap is confirmed or declined, applying availability and the Booking and Allocation Rules, such as the minimum and maximum length of a stay, the gap between your stays and the limit on stays held in advance;
- the order of picks in the annual peak draft, and the allocation of the Christmas and New Year block, applying the published rotation;
- counting the nights you use, and whether cancelled nights are restored to you or counted, applying the cancellation rules;
- offering and confirming pool nights for short-notice stays;
- pausing new bookings and voting while a pause applies under the trust deed because of unpaid amounts;
- sending payment reminders; and
- which updates about homes you receive after you enquire or register interest, and when.
Kinds of decisions where a computer program does something substantially and directly related to the decision, and a person makes the decision
- identity verification and sanctions screening for an application: the program checks your documents and screens the lists, a person reviews any check that is not passed, and the trustee decides whether to accept the application;
- which enquiries our team follows up first: the program ranks enquiries and a person decides whom to contact;
- whether to issue a default notice under the trust deed: the program identifies overdue amounts and a person decides whether to issue the notice; and
- allocating units among co-owners who accept a first offer on a transfer: the program calculates each co-owner’s share and a person confirms the allocation.
If you think an automated decision about you is wrong, contact us. A person will review it and tell you the outcome within five business days. This does not limit any review or dispute process in the trust deed or the Booking and Allocation Rules.
8. Who we disclose it to
We disclose personal information, only as needed for the purposes in section 5, to:
- the trustee of the home you own or are applying for;
- the local manager, cleaners and tradespeople, limited to what they need for a stay;
- other co-owners of the same home, limited to what the trust deed and the Booking and Allocation Rules require, such as which dates are held;
- our service providers, including hosting, customer database, email, SMS, chat, payments, identity verification, accounting, IT support and professional advisers;
- valuers, mediators, experts and lawyers in a transfer, default or dispute;
- a buyer of your units, and your executor or legal representative;
- a person who takes over as manager of a home, or who acquires our business;
- Meta, if you have agreed to advertising matching under section 6; and
- government agencies and courts where the law requires or authorises it, including the Australian Taxation Office, state and territory revenue offices, the Treasury and the Foreign Investment Review Board, and AUSTRAC where anti-money laundering laws apply to us.
We do not sell personal information, and we do not disclose it to credit reporting bodies.
9. Disclosure overseas
Some of our service providers store, process or access personal information outside Australia, including in the United States. Before we disclose personal information to an overseas recipient, we take reasonable steps, including through contract terms, to ensure it handles the information consistently with the Australian Privacy Principles.
10. Storage and security
We hold personal information in cloud systems operated by our service providers. We take reasonable steps, including technical and organisational measures, to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure. These include access limited to people who need it, multi-factor authentication for our staff, encryption in transit and at rest, staff training, and checks on the security of our service providers. Tax file numbers and identity documents are held with further access restrictions.
12. Retention
We keep personal information only for as long as we need it for the purposes in section 5 or as the law requires. We then destroy it or de-identify it.
| Record | How long we keep it |
|---|---|
| Enquiries with no continuing relationship | Up to three years after last contact |
| Co-owner records | While you hold units and for seven years afterwards |
| Tax records | At least five years |
| Company financial records | Seven years |
| Identity verification records | Seven years after the end of the relationship where anti-money laundering laws apply to us, and otherwise for as long as we need them for the purposes in section 5 |
| Face images and biometric information | Deleted by our provider once verification is complete |
| Chat transcripts | For as long as we need them for the purposes in section 5, and then destroyed or de-identified |
| Job applications | 12 months after the role is filled |
| Marketing opt-out records | As long as needed to honour your request |
13. Anonymity and pseudonymity
You may browse our website and ask general questions in our chat without identifying yourself or by using a pseudonym. To register interest in a home, apply or become a co-owner, we need to know who you are.
14. Tax file numbers
The trustee of a home may ask for your tax file number under the Income Tax Assessment Act 1936 (Cth) and the Taxation Administration Act 1953 (Cth), so that it can meet its tax reporting obligations. Giving your tax file number is voluntary, and it is not an offence to decline. If you do not give it, the trustee may be required to withhold tax at the highest marginal rate plus the Medicare levy from any amount the trust pays or credits to you. Tax file numbers are collected, used, disclosed and kept only as permitted by tax law and the Privacy (Tax File Number) Rule 2015, and are securely destroyed when no longer required.
15. Access and correction
You may ask for access to the personal information we hold about you, or ask us to correct it, by contacting our Privacy Officer. We do not charge for a request. We may charge a reasonable fee for the cost of giving access, and we will tell you the amount first. We will respond within 30 days. If we refuse, we will explain why in writing and tell you how to complain. If we do not correct information you asked us to correct, you may ask us to attach a statement that you believe it is wrong.
16. Data breaches
If we suspect a data breach, we act to contain it and assess it promptly, within 30 days. If it is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as soon as practicable, as required by the Notifiable Data Breaches scheme. This includes breaches involving tax file numbers.
17. Complaints
If you are concerned about how we have handled your personal information, please contact our Privacy Officer and explain your concern. We will acknowledge your complaint within five business days, investigate it, and give you our response in writing within 30 days. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.
18. Changes to this policy
We will update this policy when our practices or the law change, and publish the current version, with its effective date, on copay.au. We will tell co-owners about material changes through the owner portal and by email.