Privacy Policy

GFM is the holding entity behind the Home build-to-rent brand and acts as the Trustee for the Home Fund (GFM Home Trust) and the CASA Fund (GFM BTS Trust) developing and managing projects on behalf of institutional investors.

GFM is committed to protecting the privacy of personal information and complying with the Australian Privacy Principles and related requirements in the Privacy Act 1988 (Cth). This Policy describes how GFM complies with these requirements when handling personal information.

‘Personal information’ means information or an opinion about an identified individual or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether the information or opinion is recorded in a material form or not. An individual’s name and address are examples of personal information

‘Sensitive information’ is a type of personal information that has specific protection under the Privacy Act. Sensitive information includes information about an individual’s race or ethnic origin, political opinions, religious or philosophical beliefs, sexual orientation or practice, membership of a union or professional or trade association or criminal record.  Health information and biometric data (such as finger scans or images used by facial recognition systems) are also protected as sensitive information.

2. GFM’s Collection of Personal Information

The type of personal information that GFM collects will depend upon its relationship or dealings with individuals and the activities to be carried out. GFM may collect and hold information about:

• individuals as tenants, potential tenants or other individuals such as householders in Home properties;
• individuals as suppliers (for example: when managing payment for goods);
• individuals as contractors (for example: when managing payment for services);
• job applicants;
• representatives of institutional investors (for example: due diligence information); and
• other individuals who may come into contact with GFM.

GFM only collects personal information as necessary for its functions and activities and in a way that is not unfair, unlawful or unreasonably intrusive. GFM’s adherence to other laws such as residential tenancy laws helps to achieve this.

The types of personal information GFM may collect may include:

• biographical information (for example: name, address, contact details, date of birth);
• information about an individual’s general financial position (for example: for a rental application);
• payment information (to manage a rental agreement)
• photos and images (for example: at Home community events or in CCTV used for security in common areas) and
• any other information relevant to GFM’s business functions or as required or authorised by law.

GFM generally does not collect sensitive information but may collect it if it is necessary for the activity and the individual has provided their consent or if the collection is required by law.

Wherever possible, GFM aims to collect personal information directly from individuals. However, there are certain situations where GFM may collect personal information from other sources. In either case, GFM will take reasonable steps to ensure the individual is aware of the purposes for which the information is collected and any other significant matters in line with the Privacy Act.

3. Links to other websites

GFM conducts some business functions through web-based applications of its service providers such as Yardi Systems Inc. and RentCafé.  Information about the way these third-party websites manage information about website usage can be found in the policies of those sites.  They are presented wherever personal information is collected through those third-party websites.

Before providing your personal information via any other website, we advise you to examine the terms and conditions of using that website and its privacy policy.

GFM’s contractual arrangements with third-party service providers are described further below.

4. Our Use and Disclosure of Personal Information

In most cases GFM will use and disclose personal information for the purpose for which the information was collected for related and reasonably expected purpose or where the individual has consented to the use or disclosure.

In general, GFM uses personal information for the following purposes:

• to provide products or services that have been requested;
• to provide information about GFM’s products or services where GFM considers this may be of interest;
• to communicate about specific matters such as the administration of a rental agreement;
• to comply with regulatory and legal obligations; and
• to recruit employees or engage contractors.

GFM may give external parties access to or provide them with personal information in certain circumstances. These include but are not limited to:

• GFM’s contractors and service providers assisting in the operation of GFM’s business (for example: to help GFM with data processing and data analysis) or to provide a particular customer service;
• joint venture partners to manage new business initiatives;
• third party lenders and insurers;
• the Victorian Civil and Administrative Tribunal as necessary to administer a rental agreement;
• other government agencies as agreed to or required by law; and
• any authorised representative of an individual.

GFM will only disclose personal information to its third-party service providers on a confidential basis so that the service provider can assist GFM and under strict conditions for data security.

GFM holds and stores the personal information of rental applicants, renters and job candidates within Australia.  For its broader business GFM may, from time to time, disclose personal information to parties outside Australia that are performing contracted services. GFM will only disclose personal information overseas when it is necessary for the service and this is in accordance with the Australian Privacy Principles. This includes taking reasonable steps to ensure that the overseas recipient of the information has appropriate data handling arrangements in place.

Personal information may be shared between companies within the GFM group. In those cases, the purpose for which the information was originally collected will guide its uses, which will adhere to the Australian Privacy Principles.

GFM may otherwise use or disclose personal information where required or authorised to do so by law including under the Australian Privacy Principles. This may include responding in emergency situations and assisting in law enforcement.

5. Marketing of GFM’s products and services

GFM engages in direct marketing through various methods, but predominantly through phone and email communications. GFM may send marketing materials to its customers or potential customers on an ‘opt-out’ basis in line with the Australian Privacy Principles.  This is where GFM has collected the personal information from the individual and the marketing material is related to the purpose for which the information was collected.

Consent will be obtained before personal information is used for marketing purposes if the personal information was not collected directly from the individual or where sensitive information is involved.

GFM’s marketing communications include an ‘unsubscribe’ instruction embedded in the communication.  If a customer no longer wishes GFM to use their personal information to send marketing materials they can use the unsubscribe instruction or advise GFM’s Company Secretary (Contact details listed below).

6. Applying for Employment with GFM

GFM collects personal information from individuals who submit applications or register interest for employment with GFM. If the application is unsuccessful, at the conclusion of the interview process correspondence created during the recruitment process including resumes relating to the unsuccessful candidates will be destroyed. However, with a candidate’s consent, GFM may retain the information for a period of 6 months to contact them should a future employment opportunity become available.

7. Security of Personal Information

GFM takes reasonable steps to prevent the personal information it holds in either electronic or hard copy form from being misused or lost and from unauthorised access, modification or disclosure. GFM maintains physical security measures over its physical premises and a range of computer and network security measures over its electronic systems. GFM internal policies require its employees to maintain the confidentiality of any personal information held and to undertake training with regards to the management of personal information.

Where service providers are engaged by GFM to administer personal information GFM will take appropriate steps to ensure that similar measures are in place to secure personal information.

8. Access to or Correction of Personal Information

Individuals have rights to access and correct personal information held about them under the Australian Privacy Principles and GFM must respond to requests within a reasonable time period and without unreasonable expense. These rights are subject to exceptions under the Privacy Act.

If an individual needs to access or correct any personal information GFM holds, they may contact a People & Culture Manager (for staff requests) or in other cases, the Company Secretary using the contact information below. GFM will need to verify the identity of the requestor prior to giving access to or correcting the personal information to which the request relates. Individuals should provide as much detail as possible about the particular information sought in order to help GFM retrieve it.

GFM may charge the requestor a fee to cover the reasonable costs of identifying, collating and providing the information. GFM will inform the requestor of any costs to process the request prior to commencing processing. GFM does not charge for making corrections.

In the event GFM is either unable or not prepared to provide access or make corrections to the personal information involved in a request written reasons will be provided to explain this.

Individuals also have a right under the Privacy Act to request that a statement be associated with their personal information to explain their disagreement with its accuracy.

9. Changes to this Policy

GFM will review this Privacy Policy regularly and may update it from time to time.  Any changes will be notified by posting an updated version on the GFM website at www.gfmgroup.com.au.

10. Complaints, Queries and Other Feedback

GFM welcomes all queries and feedback about its management of personal information as a means to drive continuous improvement in its privacy management.

If an Individual wishes to complain about how GFM has managed the personal information it holds about them (a ‘privacy complaint’) they can contact GFM using the contact details below. Staff may ask for the complaint be conveyed in writing to enable GFM to fully understand and investigate the issues raised. GFM will acknowledge any written privacy complaint within five business days.  Unless the privacy complaint is particularly complex, GFM will respond to it within 30 days of its receipt.

If a privacy complaint remains unresolved the complainant can lodge it with the Office of the Australian Information Commissioner for further investigation and determination via the contact details below.

Phone: 1300 363 992

Web: www.oaic.gov.au

Address: GPO Box 5218, Sydney, NSW 2001

11. Contacting GFM

The Company Secretary can be contacted about any privacy-related matters as follows:

Email: companysecretary@gfmgroup.com.au

Address:  Company Secretary, GFM Group Compliance

103/271 Bridge Road, Richmond VIC 3121

12. Approval

Approved by the GFM Board on 2 October 2025.