Privacy Policy

Heritage Melbourne is a platform for discovering Melbourne's distinctive apartments and the agents who represent them, operated by Heritage Melbourne Pty Ltd (ABN 50 699 399 043). We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. This policy explains what we collect, why, how we protect it, who we share it with, and the choices and rights you have.

See also our Collection Notice — a short, plain-English summary of the same thing, shown at the point of collection.

1. The information we collect

We collect only what we reasonably need to run the platform:

• Account information — the email address you sign in with, and (for agents) your professional profile details.
• Enquiry details — the name, email, phone and message you choose to send an agent, or provide when registering for an inspection or requesting an appraisal. These are shared with the relevant agent so they can respond.
• Saved searches and preferences — the searches, alerts and saved properties you choose to keep.
• Agent and agency records — for agents who advertise with us, the profile, listing and billing information needed to run that relationship.
• Usage analytics — how the platform is used (pages viewed, searches run, listings and buildings browsed, links and buttons used, how far down a page you read, and whether a form was started or left unfinished — never what you typed into it). This is recorded against a random, anonymous identifier stored in your browser — not against your name. Where available we record only a coarse location (country and state or region) — never your precise location or GPS — and we do not store your raw IP address.

We usually collect this directly from you. We may also receive information about you from an agent or agency you have dealt with. We do not collect sensitive information as that term is defined in the Privacy Act.

2. Anonymous by default

You may browse Heritage Melbourne without identifying yourself, and you have the option of dealing with us anonymously or by pseudonym where it is lawful and practicable (APP 2). Our usage analytics are anonymous by default: they are not linked to your identity unless you are signed in and have given us your express, opt-in consent to do so (see section 5). The site is fully usable whether or not you consent.

We also use Google Analytics to understand how the site is found and used — it is anonymous in the same way, and section 6 sets out exactly what it receives.

3. Cookies and local storage

We use first-party browser storage to keep you signed in, to remember your preferences, and to hold the anonymous identifier used for usage analytics. Google Analytics and the Meta advertising pixel each set their own identifier in this browser so repeat visits can be recognised as the same visitor; neither carries your name. We do not use third-party advertising cookies to build cross-site profiles of you, and we do not permit either provider to use what they receive from us for their own advertising to other businesses. You can clear this storage in your browser at any time, though doing so will sign you out.

4. Why we collect it

We collect and use personal information to:

• operate the platform, your account, and the agent–buyer enquiry process;
• send service messages and, where you have opted in, saved-search alerts and newsletters;
• administer our relationships with agents and agencies, including billing;
• understand and improve how the platform is used, and to build aggregate, de-identified insight about property demand (a data asset we own);
• keep the platform secure and prevent abuse;
• measure whether our advertising works (see section 7); and
• comply with our legal obligations, resolve disputes, and — as a disclosed standing purpose — transfer information as part of a possible sale, merger or restructure of our business (see section 6).

5. Linking analytics to your account (opt-in only)

Today our usage analytics are anonymous and are not linked to your identity. If we introduce identity-linked analytics in future, it will be strictly opt-in: we would link your usage to your account only with your express, specific consent — never bundled into our terms, never pre-ticked, and never required to use the site. You would be able to withdraw that consent at any time, and each consent would be recorded. We also honour browser Global Privacy Control and Do Not Track signals as a request not to link your activity.

6. How we share information

• Agents — your enquiry, inspection or appraisal details are shared with the agent you contacted so they can respond. From that point the agent holds their own copy and handles it under their own legal obligations.
• Service providers — we use trusted providers to run the platform, including Supabase (database and hosting), Vercel (application delivery), and providers for email, telephony and maps. They process data on our behalf under contract.
• Meta (Facebook and Instagram) — we advertise on Facebook and Instagram, and our website includes the Meta advertising pixel. It tells Meta which pages you viewed, which property listings you opened, whether you ran a search, whether you asked to see an agent's phone number, and whether you sent an enquiry, requested an appraisal or created an account, so we can see which of our ads actually work. Some of that is also sent from our own servers rather than your browser, so an ad blocker does not leave us with half a picture; the information is the same either way. We do not send Meta your name, email address, phone number, what you typed into a search box, or anything you write in an enquiry. When you reveal an agent's number we send the fact that you asked, never the number. If your browser sends a Global Privacy Control or Do Not Track signal, the pixel is not loaded at all and nothing is sent from our servers either.
• Google Analytics — we use Google Analytics to understand how people find and use the site: which pages you viewed, which listings you opened, whether you ran a search, whether you sent an enquiry, requested an appraisal or created an account, roughly where in the world you are, and which site or search brought you here. We use it to see which parts of the platform work, not to identify you. We do not send Google your name, email address, phone number, what you typed into a search box, or anything you write in an enquiry, and we do not link what it records to your account. Google receives your IP address in order to derive that rough location and does not make it available to us. The same Don't track me control described in section 7 stops Google Analytics loading, and it is not loaded at all if your browser sends a Global Privacy Control or Do Not Track signal.
• We do not sell information that identifies you. We do not sell or licence person-level behavioural profiles, and we do not provide your details to third parties for their own independent marketing.
• De-identified data — we may create, use, licence or sell data that has been de-identified so it is no longer about an identifiable person. Where we ever offer records that still identify you, we would do so only with your separate, specific consent.
• Legal and safety — we may disclose information where the law requires or permits it, or to protect people, property or the platform.
• Business transfers — if our business (or part of it) is sold or merged, information held by the business may transfer to the new owner, who must continue to handle it under this policy and the Privacy Act.

7. Direct marketing and advertising

Newsletters and alerts are opt-in. Every marketing message identifies us and includes a working unsubscribe link, and you can change your preferences at any time. If you unsubscribe we keep a record of that request so we can honour it. We do not use our own usage analytics to decide who to email.

Advertising is separate. Because our site carries the Meta advertising pixel, Meta may use the fact that you visited to show you our ads on Facebook or Instagram. Google Analytics does not show you ads — we do not run Google advertising and we have not connected it to any advertising product — but the same control turns it off, because you should not have to work out which tag is which.

You can opt out of that at any time — there is a Don't track me control at the bottom of this page, and the same switch sits under Privacy & data in your account settings if you have an account. Either one stops both the Meta pixel and Google Analytics loading on this browser, including for the page you are on. You can also turn on Global Privacy Control or Do Not Track in your browser, which we honour as a standing refusal, or manage what Meta shows you in Meta's own ad settings. Your choice is stored in this browser, so clearing your browsing data clears it too, and the site works exactly the same either way.

8. Where your information is held

Our primary database is hosted in Australia (the Sydney region). Some application delivery, email, telephony and logging is processed at global edge locations or in the United States by our providers; where this occurs we take the reasonable steps APP 8 requires, and we discard raw IP addresses at the point of collection to minimise what is processed.

Separately, the two third-party tags described in section 6 disclose browsing activity overseas: the Meta advertising pixel to Meta Platforms, Inc. in the United States, and Google Analytics to Google LLC in the United States. Each is handled under that provider's own terms and privacy policy rather than ours. Each is an overseas disclosure for the purposes of APP 8, and both stop entirely if you use the Don't track me control or your browser sends a Global Privacy Control or Do Not Track signal.

9. Data security

We protect personal information with technical and organisational measures, including access controls, encryption in transit and at rest, role-based permissions, and keeping the keys that could link anonymous data to a person strictly separated and access-limited. No system is perfectly secure, but we take our obligations under APP 11 seriously and have a data-breach response process.

10. How long we keep it

We keep personal information only as long as we reasonably need it for the purpose it was collected for, to operate the platform, or to meet a legal or dispute-resolution requirement — after which we destroy or de-identify it. Aggregated, de-identified insight may be kept longer, as it is no longer about you. Account and enquiry records are kept for as long as your account is active or as required by law.

11. Your rights

You can ask us to:

• Access the personal information we hold about you;
• Correct information that is wrong, out of date or incomplete;
• Withdraw any consent you have given; and
• Delete your personal information, where we are not required to keep it. We sever any link to your identity (your activity reverts to anonymous) and recompute our aggregates so your identified contribution is removed.

To make a request, email info@heritagemelbourne.com. We may need to verify your identity first. We will respond within a reasonable period — usually within 30 days — and there is no charge for making a request.

Note that an agent you contacted holds their own copy of your enquiry. To have that copy accessed, corrected or deleted, you will need to ask them directly.

12. Children

Heritage Melbourne is intended for adults — buyers, vendors and property professionals. It is not directed at children and we do not knowingly collect their personal information.

13. Complaints

If you have a privacy concern, please contact us first at info@heritagemelbourne.com so we can resolve it. We will acknowledge your complaint, investigate it, and write to you with the outcome — normally within 30 days.

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or on 1300 363 992.

14. Contact and changes

Heritage Melbourne Pty Ltd · ABN 50 699 399 043

Email: info@heritagemelbourne.com · Telephone: (03) 9000 0175

Post: PO Box 1178, Kensington VIC 3031

We may update this policy from time to time. The current version and effective date appear at the top of this page, and for material changes affecting how we use information about you we will take reasonable steps to let you know.

Heritage Melbourne Pty Ltd · ABN 50 699 399 043 · Version 2026-08-23 · Effective 23 August 2026