Privacy Policy

01 About Willis Conveyancing

Willis Conveyancing is a licensed conveyancing practice operating in Victoria, with offices in Ferny Creek, Melbourne CBD and Bendigo. We act for clients in residential purchases and sales, off-the-plan and commercial transactions, transfers, and rural and regional matters.

02 The information we collect

"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable. The kinds of personal information we collect depend on the services we provide to you and our legal obligations. They typically include:

Sensitive information

Some of the information we collect is "sensitive information" under the Privacy Act (for example, biometric information used for identity verification, or information that may reveal certain personal attributes). We collect sensitive information only where you have consented, or where the collection is required or authorised by or under an Australian law — including our AML/CTF identity verification obligations — and we apply additional care to protecting it.

03 How we collect your information

We collect personal information in a number of ways, including:

• directly from you — when you instruct us, complete our onboarding or client due diligence forms, provide identity documents, or communicate with us by phone, email or in person;
• from our identity verification and onboarding tools — including electronic verification of identity (VOI) and electronic signing services we use to onboard you and execute documents;
• from third parties involved in your matter — such as real estate agents, the other party's representatives, your financier or mortgage broker, accountants, financial advisers, and other conveyancers or solicitors;
• from government bodies, registries and search providers — such as Land Use Victoria, the State Revenue Office (SRO), local councils, water and other authorities, and title and property information search providers;
• from sanctions, PEP and adverse-media screening services we use to meet our AML/CTF obligations; and
• automatically, when you visit our website or interact with our digital tools (see section 12).

Where it is reasonable and practicable, we collect personal information directly from you. Where we collect your information from a third party, or where you provide us with information about another person, we will (and you should) take reasonable steps to ensure the relevant individual is made aware of this Policy.

04 Why we collect, hold, use and disclose your information

We collect, hold, use and disclose personal information for purposes connected with providing our services and meeting our legal obligations, including to:

• act for you in your conveyancing or property transaction and provide related advice and services;
• verify your identity and the identity of other parties to a transaction;
• complete searches, prepare and lodge documents, and effect electronic settlement and lodgement;
• invoice you, process payments, and account for trust monies;
• meet our anti-money laundering and counter-terrorism financing obligations (see section 5);
• comply with our other legal, regulatory, professional and record-keeping obligations;
• manage our relationship with you, respond to your enquiries, and handle complaints; and
• with your consent or as otherwise permitted, send you information about our services (see section 11).

Where the law requires us to collect certain information and you do not provide it, we may be unable to act for you or to complete your transaction. In particular, if you do not provide the information we need to verify your identity and complete our customer due diligence, we are legally prohibited from providing the relevant designated service to you.

05 Anti-Money Laundering and Counter-Terrorism Financing (AML/CTF)

From 1 July 2026, Willis Conveyancing is a reporting entity regulated by the Australian Transaction Reports and Analysis Centre (AUSTRAC) under the AML/CTF Act. This means we are required by law to identify and verify our clients, to monitor the matters we act on, to keep specific records, and to report certain matters to AUSTRAC. These obligations apply in addition to, and are separate from, our obligations under the Privacy Act.

Customer due diligence (CDD)

Before we provide a designated service — and on an ongoing basis throughout our relationship with you — we are required to carry out customer due diligence. Depending on the assessed level of risk, this may include collecting and verifying:

• your identity, using reliable and independent documents, data or electronic verification;
• the identity of any agent acting on your behalf, and their authority to act;
• where you are a company, trust or other entity — information about your structure, beneficial owners, and the individuals who control you;
• whether you, a beneficial owner or a related party is a politically exposed person (PEP) or is subject to sanctions; and
• for higher-risk matters, information about the source of your funds and source of wealth, and the purpose and intended nature of the transaction.

We apply a risk-based approach and may apply simplified, standard or enhanced due diligence depending on the circumstances of the matter. We are required to collect this information whether or not you consent, because its collection is required or authorised by or under an Australian law.

Ongoing monitoring

We are required to monitor our business relationship with you for the duration of a matter, including keeping the information we hold about you up to date and reviewing transactions for unusual or suspicious features. We may ask you for further information or clarification at any stage to meet this obligation.

Reporting to AUSTRAC and the prohibition on "tipping off"

The AML/CTF Act requires us to report certain matters to AUSTRAC, including:

• suspicious matter reports, where we form a relevant suspicion in connection with a transaction or a person;
• threshold transaction reports, for cash or certain other transactions at or above the prescribed reporting threshold; and
• other reports required from time to time under the AML/CTF Act and rules.

Where we are required to report a matter, or where we make enquiries to meet our AML/CTF obligations, the law restricts what we can tell you. In particular, it is a criminal offence for us to disclose that we have formed a suspicion, that we have made or may make a report to AUSTRAC, or to disclose related information, where doing so could prejudice an investigation (the "tipping off" prohibition). As a result, there may be circumstances in which we cannot tell you that your information has been, or may be, disclosed to AUSTRAC, and in which we cannot explain a delay or a decision to stop acting.

AUSTRAC may in turn share the information we report with law enforcement, revenue and other government agencies as permitted by law.

AML/CTF record-keeping

We are required to keep records relating to our customer due diligence, the matters we act on and our AML/CTF program for at least seven years after our relationship with you ends or a transaction is completed. This requirement applies even if you ask us to delete your information — we cannot delete records we are legally obliged to retain (see section 9).

06 Who we disclose your information to

We disclose personal information only where it is reasonably necessary for the purposes described in this Policy, or where the disclosure is required or authorised by law. We may disclose your information to:

We do not sell your personal information. We will not disclose your information for purposes unrelated to those described in this Policy unless you have consented or the disclosure is required or authorised by law.

Electronic settlement (PEXA and ELNOs)

Where your transaction settles electronically, your personal information is handled through an Electronic Lodgement Network (ELN). By proceeding with an electronic settlement, you consent to:

• disclosure of that personal information to PEXA or any other Electronic Lodgement Network Operator (ELNO), for use in connection with an Electronic Workspace;
• disclosure of that personal information to other participants in the ELN (including through mobile applications provided by PEXA), an Electronic Workspace, or a Conveyancing Transaction the subject of an Electronic Workspace;
• use and disclosure of that personal information by PEXA and the other participants in an Electronic Workspace or in a Conveyancing Transaction the subject of an Electronic Workspace;
• collection, use, handling and disclosure of that personal information at least to the extent necessary to enable PEXA to provide its services in accordance with its Participation Agreement; and
• disclosure of that personal information to a Registrar or Duty Authority.

For further information, please refer to the PEXA privacy policy, available at www.pexa.com.au/privacy-policy.

07 Overseas disclosure

Some of the service providers we use — for example, cloud hosting, identity verification, screening or software providers — may store or process information on servers located outside Australia, or may have related entities or support functions overseas. Where this occurs, we take reasonable steps to ensure those providers handle your information consistently with the APPs and under appropriate contractual protections. The countries in which your information may be handled can change as our providers change; if you would like current details, please contact our Privacy Officer.

08 How we keep your information secure

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include:

• access controls and authentication for our systems, and limiting access to those who need it;
• encryption of information in transit and, where appropriate, at rest;
• use of reputable, security-assessed practice management, verification and signing platforms;
• staff confidentiality obligations and training; and
• secure destruction or de-identification of information when it is no longer required and we are no longer legally obliged to keep it.

No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security.

Data breaches

We maintain procedures to identify, contain, assess and respond to data breaches. If we experience an eligible data breach that is likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme in the Privacy Act.

09 How long we keep your information

We keep personal information only for as long as it is needed for the purposes described in this Policy, or for as long as we are required to keep it by law. Conveyancing and AML/CTF record-keeping obligations require us to retain many records for extended periods — in the case of AML/CTF records, for at least seven years after the relevant matter ends. Because of these obligations, we may be unable to delete some of your information even if you ask us to. When information is no longer required and we are no longer legally obliged to keep it, we take reasonable steps to securely destroy or de-identify it.

10 Accessing and correcting your information

You may request access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. To make a request, please contact our Privacy Officer (see section 13). We may need to verify your identity before responding.

We will respond within a reasonable time. In limited circumstances we may decline a request — for example, where giving access would be unlawful, would prejudice an AML/CTF investigation, or where another exception under the Privacy Act applies. If we refuse, we will tell you why (to the extent we are legally able to) and how you can complain.

11 Direct marketing

From time to time we may send you information about our services that we think may be of interest to you. You can opt out of receiving marketing communications at any time by using the unsubscribe facility in the message or by contacting us. We will not use sensitive information for direct marketing without your consent, and we do not use information collected for AML/CTF purposes for marketing.

12 Our website, cookies and analytics

When you visit our website, we may collect technical information such as your IP address, device and browser type, and the pages you view. We use cookies and similar technologies to operate the site, remember your preferences and understand how the site is used. You can control or disable cookies through your browser settings, although some features may not work properly if you do. Where our website uses third-party analytics, those providers handle information in accordance with their own privacy terms.

13 Complaints and how to contact us

If you have a question about this Policy, or a concern or complaint about how we have handled your personal information, please contact our Privacy Officer:

We will acknowledge your complaint promptly and aim to resolve it within a reasonable time. If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC):

• Website: www.oaic.gov.au
• Phone: 1300 363 992

14 Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or the law, including the commencement and ongoing operation of our AML/CTF obligations. The current version will always be available on our website, and the effective date appears at the top of this document.