PRIVACY POLICY AND PERSONAL DATA PROTECTION STATEMENT

OPERATED BY: ASETRAX LIMITED

TRADING AS: ASETRAX (Assets Property Hub)™ (Trade Mark No. 1319049)

COMPANY NUMBER: 9450631

NZBN: 9429053876591

GST NUMBER: 149-421-033

REGISTERED ADDRESS: Suite 16015, Level 1, 6 Johnsonville Road, Johnsonville, Wellington 6037, New Zealand

AUSTRALIAN BUSINESS NUMBER (ABN): [Pending – To be inserted upon issue by ATO]

AUSTRALIAN TAX FILE NUMBER (TFN): [Pending – To be inserted upon issue by ATO]

LAST REVISED: 04 September 2026

1. SCOPE AND GOVERNANCE FRAMEWORK

1.1 Statutory Scope

This Privacy Policy and Personal Data Protection Statement (“Privacy Policy”) governs the collection, storage, processing, transfer, and disclosure of Personal Information by ASETRAX LIMITED (“AsetraX”, “we”, “us”, or “our”) in operating the cross-border digital property marketplace at https://assetspropertyhub.com (“Platform”).

1.2 Legal Frameworks

This Privacy Policy is executed in accordance with:

(a) The Privacy Act 2020 (NZ) (“NZ Privacy Act”) and the Information Privacy Principles (IPPs) contained therein;
(b) The Privacy Act 1988 (Cth) (“AU Privacy Act”) and the Australian Privacy Principles (APPs); and
(c) To the extent applicable, international data privacy statutes, including Regulation (EU) 2016/679 (General Data Protection Regulation or “GDPR”).

1.3 Covered Data Subjects

This Privacy Policy applies to registered members, unregistered visitors, real estate professionals, commercial developers, private listers, and any natural persons who interact with AsetraX across any communication channel.

2. INTERPRETATION AND DEFINITIONS

In this Privacy Policy, unless the context requires otherwise:

“Data Subject” means an identified or identifiable natural person whose Personal Information is processed by AsetraX.
“Member” means any individual or legal entity that registers an account profile on the Platform.
“Personal Information” means any information or opinion about an identified individual, or an individual who is reasonably identifiable, whether true or not and whether recorded in a material form or not, pursuant to the NZ Privacy Act and AU Privacy Act.
“Processing” means any operation or set of operations performed upon Personal Information, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, erasure, or destruction.
“Third Party” means any natural or legal person, public authority, agency, or body other than the Data Subject or AsetraX.

3. CATEGORIES OF PERSONAL INFORMATION COLLECTED

3.1 Information Directly Provided by Data Subjects

(a) Account Registration: Full legal name, residential or business address, primary contact telephone numbers, email address, hashed/encrypted password credentials, professional licensing numbers (e.g., REA or state licensing details), and legal entity details.
(b) Listing Media and Content: Property descriptions, boundary specifications, architectural plans, visual media (photographs, drone footage, video tours), financial yields, pricing metrics, and contact details published within property listings.
(c) Communications Data: Transcripts of enquiries, direct messages hosted on the Platform, customer support tickets, email records, and telecommunications meta-data.
(d) Financial and Transaction Data: Billing identities, corporate address details, GST/tax identification numbers, and transactional logs. Full credit card numbers and Card Verification Values (CVV) are processed directly by PCI-DSS compliant third-party payment gateways (Stripe, Inc. and PayPal Holdings, Inc.) and are never stored on AsetraX infrastructure.

3.2 Information Collected Automatically

(a) Technical Specifications: Internet Protocol (IP) addresses, device hardware identifiers, operating system versions, browser types, language preferences, and network connection parameters.
(b) Interaction Metrics: Universal Resource Locators (URLs) visited, clickstream activity, search queries, session duration, referral paths, and feature usage parameters.
(c) Geolocation Data: General geographical location derived from IP telemetry, or precise geolocation metrics where explicitly consented to on mobile hardware.
(d) Tracking Technologies: Persistent and session cookies, web beacons, and pixel tags, as detailed in our Cookie Policy.

3.3 Third-Party Sourced Information

AsetraX may receive information from payment gateways, verification platforms, social single-sign-on (SSO) providers (e.g., Google or Meta), real estate licensing registries (e.g., Real Estate Authority NZ), and public property record repositories.

4. LEGAL BASES FOR DATA PROCESSING

AsetraX processes Personal Information under the following recognized legal bases:

4.1 Express Consent: Where the Data Subject has provided explicit, informed consent for specified processing activities, including promotional communications and optional tracking deployment.
4.2 Contractual Necessity: Where processing is required to execute, perform, or deliver services under our Terms and Conditions, including account hosting, listing publication, and payment administration.
4.3 Legitimate Business Interests: Where processing is reasonably necessary for operational security, system optimization, fraud prevention, enforcement of legal rights, platform analytics, and corporate administration, provided such interests are not overridden by the fundamental privacy rights of the Data Subject.
4.4 Statutory and Legal Obligations: Where processing or record retention is mandated by law, including the GST Act 1985 (NZ), the Tax Administration Act 1994 (NZ), the Income Tax Assessment Act 1997 (Cth) (AU), the Overseas Investment Act 2005 (NZ), or lawful regulatory notices.

5. PURPOSES OF PROCESSING

AsetraX processes Personal Information exclusively for the following operational and statutory purposes:

(a) Operating, maintaining, and providing the digital marketplace functionality;
(b) Authenticating user identities, verifying professional licenses, and processing financial transactions;
(c) Facilitating direct communications between Users and Listers;
(d) Delivering system notifications, platform updates, administrative alerts, and promotional communications;
(e) Auditing usage, detecting security threats, preventing fraudulent transactions, and safeguarding infrastructure;
(f) Complying with tax, accounting, anti-money laundering, and regulatory reporting requirements in New Zealand and Australia; and
(g) Establishing, exercising, or defending formal legal claims.

6. DISCLOSURE AND TRANSFER OF PERSONAL INFORMATION

6.1 Absolute Commercial Prohibition

AsetraX does not sell, rent, trade, or lease Personal Information to third parties for commercial gain or independent monetary exploitation.

6.2 Authorized Disclosures

Personal Information may be disclosed to third parties strictly under the following operational circumstances:

(a) Contracted Service Providers: Enterprise hosting infrastructure providers (Hostinger), secure payment processing services (Stripe, Inc., PayPal Holdings, Inc.), analytics engines (Google Analytics), and automated email applications. Service providers are bound by strict contractual obligations to handle data solely as instructed by AsetraX and maintain enterprise-grade security controls.
(b) Legal and Regulatory Enforcement: Statutory law enforcement agencies, tax authorities (Inland Revenue Department NZ, Australian Taxation Office), real estate licensing authorities (REA NZ, state real estate boards), and foreign investment oversight bodies (LINZ OIO, FIRB AU) where compulsory by court order, statutory demand, or binding administrative regulation.
(c) Platform Counterparties: Public agent profiles, agency directory entries, developer credentials, and listing contact details are made accessible to prospective buyers and platform visitors as designed by the platform functionality.
(d) Corporate Transactions: In the event of a merger, acquisition, corporate restructuring, insolvency proceeding, or sale of company assets, Personal Information may be transferred to the acquiring entity subject to confidentiality commitments.

7. INTERNATIONAL DATA TRANSFERS

7.1 Cross-Border Infrastructure

AsetraX is organized under the laws of New Zealand. Personal Information collected by AsetraX may be hosted, processed, or transferred across server nodes and service providers located in New Zealand, Australia, the United States, and European Union member states.

7.2 Safeguards for International Transfers

Where Personal Information is transferred outside New Zealand or Australia:

(a) New Zealand Transfers: AsetraX ensures compliance with IPP 12 of the NZ Privacy Act, verifying that external recipients are subject to comparable privacy safeguards or binding standard contractual clauses.
(b) Australian Transfers: AsetraX complies with APP 8 of the AU Privacy Act, taking reasonable steps to ensure foreign recipients do not breach Australian Privacy Principles.
(c) European Union Transfers: Cross-border transfers rely upon Standard Contractual Clauses (SCCs) or formal adequacy decisions recognized by the European Commission.

8. DATA SECURITY AND RISK ALLOCATION

8.1 Technical and Organizational Safeguards

AsetraX maintains appropriate technical and organizational controls to safeguard Personal Information against loss, unauthorized access, destruction, modification, or unlawful disclosure. These measures include:

(a) End-to-end Transport Layer Security (TLS/SSL) encryption for data in transit;
(b) Robust cryptographic hashing standards for stored credentials;
(c) Role-based access controls and identity authorization mechanisms; and
(d) Intrusion detection protocols, firewalls, and regular vulnerability assessments.

8.2 Account Credential Obligations

Data Subjects remain solely responsible for preserving the confidentiality of their personal account credentials, passwords, and security factors. AsetraX disclaims liability for unauthorized access resulting from user negligence or credential compromise.

8.3 Data Breach Protocol

In the event of a confirmed or suspected privacy breach involving Personal Information that poses a risk of serious harm, AsetraX will promptly investigate, implement containment strategies, and notify the Office of the Privacy Commissioner (NZ) and/or the Office of the Australian Information Commissioner (OAIC), as well as affected Data Subjects, in accordance with applicable statutory reporting frameworks.

9. RETENTION AND DESTRUCTION POLICIES

9.1 Retention Periods

AsetraX retains Personal Information only for as long as required to fulfill the operational purposes for which it was collected, or as required by governing statutes:

(a) Account Identifiers: Retained for the duration of an active membership and securely destroyed within 30 days of account termination, unless statutory compliance mandates extended retention.
(b) Listing Assets: Retained while the property display remains active, with backup purge schedules executing within 90 days of listing removal.
(c) Accounting and Financial Records: Financial transactions, tax receipts, and billing registers are retained for a mandatory minimum period of seven (7) years under New Zealand and Australian tax legislation.
(d) Communications Logs: Support communications and inquiry records are retained for up to two (2) years from the last active interaction.

9.2 Secure Disposal

Upon the expiry of applicable retention periods, Personal Information is permanently overwritten, anonymized, or destroyed using enterprise-grade digital sanitization methodologies.

10. STATUTORY RIGHTS OF DATA SUBJECTS

10.1 Rights under the New Zealand Privacy Act 2020

Data Subjects situated in New Zealand hold the right to:

(a) Access: Confirmation of whether Personal Information is held and request formal access under IPP 6;
(b) Correction: Request the correction of inaccurate, out-of-date, or incomplete data under IPP 7; and
(c) Regulatory Complaint: Lodge a complaint regarding data handling with the Privacy Commissioner.

10.2 Rights under the Australian Privacy Act 1988

Data Subjects situated in Australia hold the right to:

(a) Access: Access Personal Information held by AsetraX under APP 12;
(b) Correction: Request correction of inaccurate, out-of-date, incomplete, irrelevant, or misleading data under APP 13; and
(c) Regulatory Complaint: Lodge a formal grievance with the Office of the Australian Information Commissioner (OAIC).

10.3 Rights under the General Data Protection Regulation (GDPR)

To the extent GDPR applies, Data Subjects hold the right to request Data Access, Data Erasure (“Right to be Forgotten”), Processing Restriction, Data Portability, Rectification, and to object to processing based on legitimate interests.

10.4 Exercise Protocol

Data Subjects may exercise their statutory rights by submitting a written request to the Privacy Officer at aphadmin@assetspropertyhub.com. Requisite proof of identity must accompany all privacy requests to prevent unauthorized disclosure. AsetraX will evaluate and respond to requests within twenty (20) business days of receipt.

11. MARKETING PREFERENCES AND UN-SUBSCRIPTION

11.1 Electronic Marketing Consent: AsetraX conducts electronic direct marketing strictly pursuant to the Unsolicited Electronic Messages Act 2007 (NZ) and the Spam Act 2003 (Cth) (AU).
11.2 Opt-Out Mechanism: Data Subjects may withdraw consent for promotional emails at any time by clicking the “Unsubscribe” control present in commercial messages or by contacting aphadmin@assetspropertyhub.com. Opt-out choices do not affect compulsory transactional, legal, or administrative account communications.

12. THIRD-PARTY HYPERLINKS

The Platform contains outbound links to external websites, software tools, and service providers. AsetraX exercises no operational authority over third-party platforms and assumes no legal responsibility for their independent privacy policies, data handling practices, or security standards. Data Subjects access external portals at their own risk.

13. PROTECTION OF MINORS

The Platform is intended exclusively for legal entities and individuals who have reached the age of majority (18 years). AsetraX does not knowingly collect or solicit Personal Information from minors. If AsetraX discovers that Personal Information of a minor has been collected without verified parental or legal guardian consent, that data will be purged immediately.

14. POLICY REVISIONS AND AMENDMENTS

AsetraX reserves the right to amend or update this Privacy Policy at its sole discretion. Revisions become effective immediately upon publication to the Platform. Material amendments will be notified via registered email or prominent administrative notices displayed on the Platform. Continued access or use of the Platform following published updates constitutes formal acceptance of the revised Privacy Policy.

15. CORPORATE CONTACT DETAILS AND PRIVACY ENQUIRIES

15.1 Internal Privacy Officer

Enquiries, access requests, or complaints regarding the processing of Personal Information must be directed to:

ASETRAX LIMITED

Attention: Privacy & Compliance Department

Suite 16015, Level 1, 6 Johnsonville Road

Johnsonville, Wellington 6037, New Zealand

Email: aphadmin@assetspropertyhub.com

Telephone: +64 27 338 4107

15.2 External Privacy Authorities

New Zealand:

Office of the Privacy Commissioner

PO Box 10094, Wellington 6143, New Zealand

Website: https://www.privacy.org.nz

Australia:

Office of the Australian Information Commissioner (OAIC)

GPO Box 5218, Sydney NSW 2001, Australia

Website: https://www.oaic.gov.au

Privacy Statement