Privacy Policy

1. Who we are and what this policy covers

“Lot”, “we”, “us” and “our” mean the Lot business presented at lot.net.au. Contact the Lot team through Talk to Lot and mark privacy matters “Privacy request” or “Privacy complaint”.

This policy covers the public website, its enquiry forms, and correspondence arising from those enquiries. It describes the website’s current collection process. It does not imply that browsing the site creates a strata-management appointment or gives us access to your building’s records.

If an enquiry leads to management services, due diligence or another ongoing relationship, additional information may be necessary. The responsible entity, purposes, recipients and any additional collection requirements should be identified when that relationship is established. A separate collection notice may add detail but does not remove protections required by law.

We use the Australian Privacy Principles as a guide to responsible information handling. Statutory rights and obligations under the Privacy Act 1988 (Cth) apply where that Act covers the organisation and activity concerned. You can use the request and complaint process below regardless of whether you know which legal provision applies.

2. Before you send an enquiry

Lot collects the details you submit to respond to your enquiry and arrange the next steps you request. Fields marked as required enable the form and reply process; phone and location fields are optional. If you do not provide required information, the form cannot be submitted. You can use a preferred name for a general enquiry, although we may need to confirm identity or authority for a specific request.

Enquiries pass through Propeller’s website infrastructure, Vercel hosting and Resend email delivery to the Lot enquiry inbox. These services involve overseas processing, including in the United States. Technical and delivery data is also processed to operate the service and limit misuse.

Send only enough information to start the conversation. Please do not include identity documents, passwords, payment-card details, health information, resident lists or confidential business records. An enquiry does not subscribe you to a marketing list. The sections below explain the recipients, your choices, and how to seek access, correction or a complaint review.

3. Information we collect and where it comes from

• Enquiry details: your name or preferred name, email, enquiry topic and message; optional phone number and suburb or location; and business name on the business enquiry form. Campaign forms may also identify which offer you are asking about.
• Follow-up correspondence: information you choose to share when discussing your building, your role, a business or a potential engagement, together with our replies and agreed next steps.
• Form and delivery information: the form used, submission time, IP address, delivery status and information needed to filter spam or troubleshoot a failed submission.
• Website activity: pages viewed, referring website, browser and device information, and analytics identifiers described in section 7. Hosting providers also process request and security logs.

We usually collect enquiry information directly from you. Someone authorised to act for you may provide it on your behalf. If another person refers a matter to us, we should explain the source and purpose when we contact you, unless a lawful exception applies.

Only share another person’s information when you have an appropriate basis to do so, and make them aware of this policy where appropriate. We do not ask for sensitive information in website forms. If it is genuinely necessary later, we will explain why and seek consent where required, or identify another lawful basis.

If we receive unnecessary or unsolicited personal information, we will assess whether it is appropriate and lawful to retain it. Where it is not, we will take reasonable steps to delete or de-identify it when lawful and reasonable.

4. Why we use personal information

We use information for the purpose for which you provide it and related purposes you would reasonably expect, including:

• Responding to enquiries, discussing a building or business, preparing a requested proposal and arranging follow-up.
• Sending an enquiry acknowledgement and keeping a record of correspondence.
• Identifying the relevant contact and checking authority before discussing private information or acting on instructions.
• Operating and improving the website, understanding aggregate visitor activity, preventing spam and resolving technical issues.
• Responding to access requests, complaints and disputes, and complying with applicable legal obligations.

The website uses automated spam checks and enquiry acknowledgements. Those features do not themselves appoint a manager or make decisions for your building.

Submitting an enquiry is not permission for unrelated marketing. If we send marketing communications, we will do so only where permitted by law and provide a way to opt out. You may also ask us to stop through Talk to Lot. Opting out of marketing does not prevent necessary replies about your enquiry or an agreed service.

We will seek consent where required before using information for a new, unrelated purpose. Publishing an updated privacy policy is not, by itself, your consent to that use.

5. Who receives personal information

Information is shared according to the purpose of the enquiry and the services needed to handle it. Usual recipients include:

• The Lot team: people handling your enquiry and authorised people supporting the associated correspondence.
• Website and communications providers: Propeller for the website infrastructure, Vercel for hosting, Resend for sending enquiry notifications and acknowledgements, and the email providers used to receive and reply to messages.
• Google: website activity through Google Analytics, as explained below. Enquiry form contents are not sent to Google Analytics by our form code.
• Professional advisers and authorities: where reasonably necessary for advice, a dispute, a legal obligation or a disclosure required or authorised by law.

Sharing an enquiry with us does not authorise unrestricted disclosure to a building’s residents, committee, prospective purchaser or another business. Where a discussion needs another recipient, we will consider the purpose, your authority, confidentiality and applicable law. Sensitive business due diligence should use separately agreed arrangements, with information limited or redacted where appropriate.

6. Overseas processing

Website information and enquiries are not confined to Australian systems. Our hosting, email-delivery and analytics providers operate internationally, including in the United States. Resend processes email content and delivery information in the United States. Vercel and Google also use international infrastructure and support arrangements.

The location of a particular provider’s processing can depend on its infrastructure and subprocessors. See the Resend privacy policy, Vercel privacy notice and Google privacy policy for further information. Contact us before submitting confidential material if you need details about the handling of a particular enquiry.

Where Australian Privacy Principle 8 applies, we must take the reasonable steps it requires before disclosing personal information to an overseas recipient, unless a lawful exception applies. This policy does not ask you to waive that protection merely by browsing or submitting a form.

7. Cookies, analytics and your choices

Google Analytics is used on this website to understand visits and improve the site. It can use cookies and similar identifiers to measure activity such as pages viewed, referral sources and browser or device information. Data may be processed overseas. Our page-view configuration removes URL query strings and fragments from the page address and referrer sent in that event.

You can browse without submitting an enquiry. To limit analytics, restrict or delete cookies in your browser or use the Google Analytics opt-out browser add-on where supported. Browser controls may need to be set on each device and browser; deleting cookies does not automatically erase information already processed.

Read how Google uses information from sites that use its services. Technical request logs may still be needed to deliver and protect the site even when cookies are restricted. External sites have their own privacy practices.

8. Storage, security and data incidents

Enquiries are transmitted over HTTPS and delivered to the Lot enquiry inbox. Information can be held in correspondence records, hosting and email-delivery systems, technical logs and backups. The relevant providers process information to deliver and maintain these services.

We will take reasonable technical and organisational steps appropriate to the information and risk to protect it against misuse, loss and unauthorised access, alteration or disclosure. No internet transmission or storage system is completely secure. The public form is intended for an initial conversation, not confidential document transfer.

If you suspect that information has been sent to the wrong person or accessed improperly, contact us promptly and describe what happened without forwarding further sensitive material. We will assess the incident and take appropriate containment and remedial steps. Where the Notifiable Data Breaches scheme or another notification law applies, we will notify the relevant regulator and affected people as required.

9. How long information is kept

Retention depends on the record and its purpose. An enquiry that does not proceed, correspondence forming part of an ongoing relationship, technical logs and legally required records can have different retention needs. Relevant factors include follow-up, the duration of the relationship, legal recordkeeping duties and resolving complaints or disputes.

We will take reasonable steps to delete or de-identify personal information when it is no longer needed for a permitted purpose, unless retention is required by law or another lawful exception applies. Copies in backups may remain until the relevant backup cycle permits removal; they should continue to be protected.

You may ask us to delete information or stop an optional use. We will consider the request and explain any reason we need to retain it. Australian privacy law does not create an unrestricted right to erase every record, particularly where statutory strata records or other retention obligations apply.

10. Strata records and other people’s information

If information becomes part of a body corporate or owners corporation record under an actual appointment, the applicable strata law and the responsible organisation’s recordkeeping duties matter. Some records must be retained or made available to people legally entitled to inspect them.

For example, Queensland law provides rights to access certain body corporate records, subject to the relevant requirements and exceptions. A privacy request does not necessarily prevent a disclosure that the law requires. See the Queensland Government’s body corporate records access guidance.

A request for your own personal information is different from a request to inspect all of a building’s records. We may need to check identity, authority, the applicable access procedure and other people’s privacy before providing information. Please avoid putting unnecessary information about residents or disputes into an initial website enquiry.

11. Accessing and correcting your information

Use Talk to Lot and put “Privacy request” in your message. Explain what information or correspondence the request concerns and whether you seek access, correction or deletion. You can request this policy in another accessible format too.

We may ask for proportionate information to verify your identity or your authority to act for someone else. Do not upload identity documents through the initial form; we will discuss an appropriate verification method if necessary.

We aim to respond to access and correction requests within 30 calendar days. If a request is complex, we will explain the delay and expected timeframe. There is no charge to make a request or seek a correction. If a reasonable, lawful charge for providing access is proposed, we will explain it before proceeding.

If access or correction is refused, we will explain the reasons in writing, except where the law prevents that, and explain complaint options. We will consider whether partial access or another way of providing the information is possible. If a correction is disputed, you may ask for a statement of your position to be associated with the record and, where applicable, for relevant recipients to be notified of a correction.

12. Privacy complaints and contact

To raise a concern, use Talk to Lot and start your message with “Privacy complaint”. Include a brief description, relevant dates, the outcome you would like and a way to contact you. The Lot team will route the matter for review.

We will acknowledge the complaint, consider the relevant records and any information needed from you, and provide a written response explaining the outcome and any steps we propose. We aim to respond within 30 calendar days and will update you if more time is needed.

If you are not satisfied, or have not received a response within 30 days, you can contact the Office of the Australian Information Commissioner (OAIC), where the matter falls within its jurisdiction. See how to lodge a privacy complaint with the OAIC. The OAIC generally asks you to raise the matter with the organisation first. This process does not remove other rights or complaint avenues available under law.

13. Changes to this policy

We will review this policy as the website, services or information-handling practices change. The date at the top identifies the current version. Material changes will be brought to your attention where appropriate, including through a website notice or direct communication where the change affects an ongoing relationship.

An update does not retrospectively authorise a use of information that requires consent or another legal basis. Contact us if you need to understand which practices applied to an earlier enquiry.