Privacy Collection Notice — Customer Due Diligence (AML/CTF)

This notice explains how Tom Pellegrini & Partners Pty Ltd, ABN 76 661 152 450, ACN 661 152 450 ("TP&P"), handles personal information collected for customer due diligence ("CDD") under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) ("AML/CTF Act").

It applies where TP&P is required to conduct CDD in connection with a designated service and supplements our Privacy Policy and general Privacy Collection Notice.

We collect personal information to meet applicable CDD and related obligations under the AML/CTF Act.

Depending on the circumstances, this may include:

• establishing and verifying identity;
• identifying and verifying persons acting for a customer, beneficial owners or controllers;
• assessing and managing applicable AML/CTF risk;
• undertaking relevant PEP, sanctions or adverse-media screening;
• conducting additional or ongoing customer due diligence where required; and
• meeting applicable reporting and record-keeping obligations.

Depending on the circumstances, we may collect:

• name, date of birth, residential address and contact details;
• identification-document details and, where necessary for verification, an image of the document;
• information about authority to act for another person or organisation;
• information about companies, trusts or other structures and their beneficial owners or controllers;
• tax or equivalent government identifiers where relevant;
• source-of-funds or source-of-wealth information where required;
• information relevant to PEP, sanctions or adverse-media screening;
• other information reasonably required for applicable CDD; and
• records of verification and CDD outcomes.

Some underlying information used for screening may be sensitive information under the Privacy Act 1988 (Cth), such as political-association or criminal-record information.

We seek to collect only information reasonably necessary for the applicable CDD purpose.

We may collect information:

• directly from you;
• from a person authorised to act for you;
• from reliable and independent documents or data;
• from official, regulatory or publicly available records; and
• through identity-verification and AML/CTF screening providers.

Where used to collect or verify information on our behalf, we currently use NameScan, a service of Member Check Pty Limited, for identity verification and AML/CTF screening.

We may also check relevant information against official Australian Government sanctions sources.

TP&P remains responsible for the CDD and compliance decisions for which it is legally responsible.

Where an identity document is needed for verification, it may be collected or temporarily processed for that purpose.

Our approach is to minimise retention of complete identity-document images. Where practicable, once verification has been completed, we retain the information and verification record required for compliance rather than the complete document image.

A complete identity-document copy may be retained where continued retention is separately required or authorised by law or reasonably necessary for another lawful purpose.

Where reasonably necessary or required or authorised by law, we may disclose relevant personal information to:

• identity-verification or AML/CTF screening providers;
• technology or professional service providers supporting the compliance process;
• AUSTRAC; and
• other government, regulatory or law-enforcement authorities.

Where a property matter also involves Prestige by Harcourts Property Centre or another Harcourts network participant, any disclosure to that entity depends on the circumstances and lawful basis for disclosure.

Each legal entity remains responsible for its own applicable privacy and AML/CTF obligations.

Our primary customer and compliance systems are currently hosted in the United States.

The NameScan/MemberCheck identity-verification and AML/CTF screening service currently used by TP&P is hosted in Australia.

Where personal information is otherwise likely to be disclosed to an overseas recipient, relevant countries will be identified where practicable.

If you do not provide information reasonably required for CDD, or if required information cannot be satisfactorily verified, we may be unable to commence or continue the relevant designated service.

Depending on the circumstances, we may also need to request or verify additional information or undertake further or ongoing customer due diligence in order to continue meeting our legal obligations.

CDD and related compliance records are retained for the periods required by applicable law.

Where a complete identity-document image has been collected solely for verification, our approach is to minimise its retention and, where practicable, retain the required verification record rather than the complete identity-document image.

You may request access to or correction of personal information we hold about you, subject to applicable legal restrictions.

In some circumstances, Australian law may restrict the information we can provide, including under AML/CTF secrecy, confidentiality or tipping-off provisions.

Our Privacy Policy explains how to request access or correction and how to make a privacy complaint.

For privacy enquiries relating to CDD, contact:

Privacy Officer

Tom Pellegrini & Partners Pty Ltd

Email: tom@tompellegriniandpartners.com.au

Phone: +61 477 546 168

Address: c/o Prestige by Harcourts Property Centre, 15 Malt Street, Fortitude Valley, QLD 4006