This is the privacy policy of Centurion Student Services Pty Ltd (ACN 086 692 051), dwell Adelaide Student Living Pty Ltd (ACN 628 451 990), dwell Village Melbourne City (registered under Centurion Student Services Pty Ltd, ABN 90 086 692 051), its related businesses, referred to as “we”, “us” or “our” (“dwell“). The purpose of this privacy policy is to provide information about how we deal with and manage your Personal Information (see the definition below).

We provide products and services including student accommodation, and associated apps and platforms which facilitate our provision of our student accommodation to you and enhance your experience while staying with us.

Your privacy and protection of your Personal Information is important to us. This privacy policy outlines how we manage the Personal Information we collect, hold, use and disclose in the course of our business operations in Australia and applies to all of our departments and business units.

Our primary privacy obligations are derived from Australian law, including the Privacy Act 1988 (Cth)(“Privacy Act”) which includes the APPs (see the definition below).

Sometimes, we also handle the information of European Union (“EU”) and United Kingdom (“UK”) citizens or share data with other organisations which do so. To the extent that we do so for individuals:
A. based in the EU or who are citizens of the EU where the EU General Data Protection Regulation applies (“EU GDPR”) applies to our processing of your Personal Information;
B. based in the UK or who are citizens of the UK, where the UK General Data Protection Regulation applies (“UK GDPR”) applies to our processing of your Personal Information,

section 12 of this privacy policy sets out the additional requirements that apply where we process the Personal Information of these individuals.

Definitions
In this privacy policy, all capitalised terms have the following meaning:
A. “APPs” means the Australian Privacy Principles set out in the Privacy Act 1988 (Cth);
B. “DPO” means the Data Protection Officer of dwell Student Living as listed at Section 13 of this privacy policy; and
C. “Personal Information” means information or an opinion about an identified individual, or an individual that is reasonably identifiable whether: (a) the information or opinion is true or not; and (b) the information or opinion is recorded in a material form or not, and throughout this privacy policy references to ‘Personal Information’ include where applicable ‘personal data’ under the EU GDPR and UK GDPR.

a) By providing your Personal Information to us, you consent to us collecting, using, storing and disclosing your Personal Information in accordance with this privacy policy or as required or permitted by the relevant law.

b) If you continue using our products and services, then we will treat your use as your consent to us handling your Personal Information in accordance with this privacy policy.

a) The type of Personal Information we collect about you depends on the circumstances of its collection and the nature of your dealings with us.

b) Examples of Personal Information which you may provide us include, but are not limited to (depending on the nature of your interaction with us):

i) your full name and date of birth;
ii) your gender;
iii) passport number, drivers license, or other identification documents;
iv) your student number provided to you by your school, college or university;
v) your contact details including telephone number(s), mailing address, email addresses;
vi) details of your next of kin or emergency contacts,
vii) any other information relating to you which you have provided us in any form you may have submitted to us (i.e. student accommodation application forms, job application forms, etc.), or in our other forms of interaction with you;
viii) information contained in any communications between you and us;
ix) information about your use of our websites, applications and services, including cookies, IP addresses, device ID, email subscription and membership details (if applicable);
x) your Curriculum Vitae, employment history, testimonials and referrals, previous drawn income, education background, and legal and bankruptcy history (if applicable); and
xi) your payment-related information, such as your bank account details (where applicable).

c) Certain types of Personal Information are regarded as sensitive information. Examples of sensitive information include information about an individual’s:

i) health;
ii) racial or ethnic origin;
iii) political opinions;
iv) membership of a political association, professional or trade association or trade union;
v) religious beliefs or affiliations;
vi) philosophical beliefs;
vii) sexual orientation or practices; and
viii) criminal record (for Australian individuals only).

d) We may collect some sensitive information about you if you are a prospective tenant, a tenant, commercial tenant, or a job applicant. We will collect this sensitive information with your consent or as permitted by law.

e) This includes health information, such as any disabilities, mental or physical health conditions, racial or ethnic origin, religious beliefs or affiliations and criminal record. If you consent to providing us with this information, we will only use it for the purposes in this privacy policy relating to our provision of our services to you.

a) Generally, we collect your Personal Information in the following ways:

i) when you submit soft or hard copy forms relating to any of our products or services;
ii) when you register for or use any of our services on websites owned or operated by dwell, or when you register as a member of websites owned or operated by us;
iii) when you interact with our employees and staff, including during face-to-face meetings or by telephone;
iv) when you enter into a contract with us or use or purchase our services or products;
v) when you create any online accounts with us;
vi) when you submit a request for us to contact you through our website;
vii) when you respond to our request to submit additional Personal Information;
viii) when you subscribe or ask to be included in an email or other mailing list;
ix) when you respond to our promotions and other marketing and publicity initiatives;
x) when you respond to our market surveys;
xi) when you submit a job application or a scholarship application;
xii) when we receive references from business partners and third parties;
xiii) when you submit your Personal Information to us for any other reason; and
xiv) when you browse our website. Please refer to the Cookie Policy at Section 15 for more information

b) We endeavour to only ask for your Personal Information if it is reasonably necessary for us to carry out our business activities and will generally obtain consent from the owner of the Personal Information to collect their Personal Information. Consent will usually be provided in writing; however, sometimes it may be provided orally or may be implied through a person’s conduct. We endeavour to only ask for your Personal Information if it is reasonably necessary for the activities that you are seeking to be involved in.

c) You may choose to not identify yourself or use a pseudonym when you contact us, such as if you lodge a complaint. However, if you choose not to provide information as requested, we may not be able to service your needs. For example, it will not be possible for us to provide you with our products or services if you want to remain anonymous or use a pseudonym.

d) We sometimes receive unsolicited Personal Information. In circumstances where we receive unsolicited Personal Information we will usually destroy or de-identify the information as soon as practicable if it is lawful and reasonable to do so unless the unsolicited Personal Information is reasonably necessary for, or directly related to, our functions or activities.

a) If you provide Personal Information about another person to us (e.g. information about your dependant, spouse, children, parents and/or guardians) to us, you promise that you have their consent for providing the information to us, and for our collection, use and disclosure of their Personal Information as set out in this privacy policy.

b) If you are a parent or guardian who has provided Personal Information about your dependant or child to us, then you promise that you have read:

i) this privacy policy to your dependant or child and ensured that they understood its contents; and
ii) and understood this privacy policy yourself; and
iii) that you have the responsibility and legal capacity to consent on behalf of your dependant or child to us handling their Personal Information as set out in this privacy policy.

a) We primarily collect your Personal Information to provide you with our accommodation and associated products and services.

b) Some ways we use your Personal Information are:

i) to provide you with our products or services;
ii) to identify and interact with you;
iii) to manage our relationship with you;
iv) to help manage the delivery of and enhance our products and services, including analysing current customer needs and identifying potential future needs;
v) to update your records in our databases;
vi) to monitor and maintain a copy of your record of previous transactions with dwell;
vii) to communicate and respond to your queries, requests and complaints;
viii) to provide ongoing marketing and publicity information about our products and services and upcoming events which may be of interest to you;
ix) to ascertain security clearances and access controls at our facilities;
x) for security, surveillance and employee monitoring purposes;
xi) to handle disputes and complaints and conduct and facilitate investigations and proceedings when required;
xii) to protect and enforce our contractual and legal rights and obligations;
xiii) to prevent, detect and investigate crime, and to analyse and manage our other commercial risks;
xiv) to manage our administrative and operational functions and to comply with our internal policies and procedures;
xv) to facilitate business asset transactions (which may extend to any merger, acquisition or asset sale) involving us;
xvi) to comply with any legal requirements, including any purpose authorised or required by any applicable rules, laws and regulations, codes of practice or guidelines or to assist in law enforcement and investigations; and
xvii) for any other purpose for which you give your consent.

c) In addition, we may collect, hold, use and disclose your Personal Information for the following purposes, depending on the nature of our relationship with you:

i) If you are a prospective retail tenant or a retail tenant:
A. to process your application for a dwell account;
B. to maintain and administer your dwell account;
C. to verify your personal particulars and process payment requests in relation to provision of products and services, which you may be entitled to, or which you may have requested for;
D. to provide you with the products and services that you have purchased from dwell;
E. to communicate changes and developments to our policies, terms and conditions and other administrative information, including for the purposes of providing you with information about the products and services we offer you;
F. to send marketing and publicity emails which may of interest to you;
G. to resolve complaints and handle requests and enquiries;
H. to conduct market research for statistical, profiling, statistical analysis and planning for the improvement of our products and services; and
I. any other purpose related to any of the above.

ii) If you sign up to and use any of our mobile applications (“apps”):
A. to process your application for subscription services through our app;
B. to administer and maintain your account with us;
C. to verify and process your personal particulars and process payment requests in relation to provision of products and services connected to the app;
D. to provide you with the goods and services which you have purchased or signed up for via the app;
E. to communicate changes and developments to our policies, terms and conditions and other administrative information, including for the purposes of providing our products and services to you;
F. to resolve complaints and handle requests and enquiries;
G. to conduct market research for statistical, profiling, statistical analysis and planning for the improvement of our products and services provided to you; and
H. any other purpose related to any of the above.

iii) If you are a prospective tenant/resident or a tenant/resident of our accommodation:
A. to administer and conduct appropriate due diligence checks;
B. to prepare the relevant lease and/or licence documentation and any other documents that may be required between you and us;
C. to administer the relevant leases or licences;
D. to administer and perform financial transactions such as rental payments;
E. to resolve complaints and handling requests and enquiries;
F. to communicate changes and developments to our policies, terms and conditions and other administrative information; and
G. any other purpose related to any of the above.

iv) If you are the next of kin of a prospective tenant/resident or a tenant/resident of our accommodation:
A. to record your details in the event the tenant/resident is unwell or is subject to an emergency where we need to contact you;
B. to prepare the relevant lease and/or licence documentation and any other documents that may be required between the tenant/resident and us; and
C. any other purpose related to any of the above.

v) If you are a prospective vendor/contractor or a vendor/contractor:
A. to evaluate your proposals for working with us and to conduct relevant background checks on you;
B. to communicate with your staff who are in our properties to carry out work or services, and for any emergency or security concerns; and
C. any other purpose relating to any of the above.

vi) If you submit a job application to us as a candidate for employment:
A. to evaluate your suitability for employment with us, including pre- recruitment checks and checking on provided references for more detailed background screening/vetting;
B. to communicate our policies and processes, codes of conduct and standard operating procedures, including for business continuity purposes; and
C. any other purposes relating to any of the above.

vii) If you are any employee of dwell:
A. to maintain and manage employee relations with you, including annual performance assessments/appraisals;
B. for HR purposes including administering and managing benefits and payroll processing;
C. to provide you with the relevant/correct tools as required for you to do carry out your job responsibilities;
D. to resolve complaints and handling requests and enquiries;
E. to communicate our policies and processes, codes of conduct and standard operating procedures, including for business continuity purposes; and
F. any other purposes relating to any of the above.

d) We may also notify or have specifically notified you of other purposes that we collect, hold, use or disclose your Personal Information. If so, we will collect, hold, use and disclose your Personal Information for these additional purposes as well.

a) Your Personal Information will be protected and kept confidential, but subject to the provisions of any applicable law, your Personal Information may, depending on the products or services concerned, be disclosed to the following third parties:

i) other divisions, business units or entities within dwell;ii) our joint venture/alliance partners;
iii) our agents, contractors, sub-contractors, third party service providers and specialist advisers that provide their services to us, such as administrative, financial, research, operational or other services, such as telecommunications, information technology, payment, payroll, processing, training, market research, storage and archival;
iv) any third party business partners who offer goods and services or sponsor contests or other promotional programmes, whether in conjunction with dwell or not;
v) insurers or insurance investigators and credit providers;
vi) in the event of default or disputes, any debt collection agencies or dispute resolution centres;
vii) any business partner, investor, assignee or transferee (actual or prospective) to facilitate business asset transactions (which may extend to any merger, acquisition or asset sale);
viii) our professional advisors such as our auditors and lawyers;
ix) relevant government regulators or authority or law enforcement agency to comply with any laws or rules and regulations imposed by any governmental authority;
x) anyone to whom we may transfer our rights and obligations;
xi) banks, credit card companies and their respective service providers; and
xii) any other party that you agree to us sharing your Personal Information with.

b) For the purposes of compliance with the APPs, we require third party organisations which handle or obtain Personal Information, such as our service providers, to acknowledge the confidentiality and sensitivity of Personal Information that we disclose to them, undertake to respect any individual’s right to privacy and comply with the relevant law. We also require these organisations to use your Personal Information only for limited purposes which have been agreed upon and follow our reasonable directions with respect to this information.

a) For individuals who are not residents or citizens of the EU or UK, from time to time, and in support of our future development and growth, we may use your Personal Information to contact you to promote and market our products and services. We may also share your Personal Information with our commercial and business partners for marketing purposes.

b) You can opt-out from being contacted for direct marketing purposes by emailing our DPO, through the appropriate account settings on our platform or website, or by using the unsubscribe facility included in each direct marketing communication we send. Once we receive a request to opt out from receiving marketing information, we will stop sending such information within a reasonable amount of time.

a) We endeavour to ensure that Personal Information stored by us is accurate and up-to-date. We also understand that Personal Information may change frequently, such as changes of address and other personal circumstances. As such, we encourage you to contact our DPO to update your Personal Information. Incomplete or outdated Personal Information may result in our inability to provide you with products and services you have requested.

a) Cookies are small files containing a string of characters that is sent to your computer when you visit any website owned or operated by dwell (“Websites”). Depending on the type of cookies, they may store user preferences and other information.

b) If you do not agree to our use of cookies as set out in this privacy policy, you may either:

i) give express refusal of your consent via our Websites ‘opt-in’ cookie pop-up interface; or
ii) disable the cookies associated with our Websites by changing your browser settings accordingly.

c) However, if you do not agree to the use of cookies, you may not be able to enter certain part(s) of the Websites, and some of the functions and services may not be able to function without cookies. This may also impact your user experience while on our Websites.

d) We use cookies for a number of purposes, such as:

i) to track information such as the number of users and their frequency of use, profiles of users and their preferred sites;
ii) to make the Websites easier to use and to better tailor our products and services to your interests and needs;
iii) to help speed up your future activities and experience on our Websites; and
iv) to collect statistical information for the purposes of analysis, such as number of users, their frequency of use, the number of page views (or page impressions) that occur on the Websites and common entry and exit points into and out of the Websites, in order to understand how people use our Websites and to help us improve their structure and contents.

b) We protect the Personal Information we hold by implementing the appropriate physical, electronic, and organisational measures, including all electronic storage and transmission of Personal Information is secured and encrypted with appropriate security technologies, and encryption of data transmitted through the internet to protect against eavesdropping and tampering, employee access restriction, periodic penetration testing, and updates of our systems, systems and network monitoring for suspicious or irregular behaviour or use of our service, staff education and training in strong security practices, physical security measures and cyber security measures which we regularly review and update.

c) We have appointed our DPO to oversee our management of your Personal Information in accordance with this privacy policy, the APPs, the EU GDPR and UK GDPR. We also train our employees who handle Personal Information to respect the confidentiality and sensitivity of your Personal Information and views breaches of privacy very seriously.

d) Although every reasonable effort has been made to ensure that all Personal Information will be protected, we cannot be responsible for any unauthorised use or misuse of such information, as there are always risks with security measures over the internet.

e) We encourage you to play an important role in keeping your Personal Information secure, by maintaining the confidentiality of any passwords and account details used to access our products and services.

a) We may disclose your Personal Information to other dwell entities and our service providers that are located outside of Australia, such as in the United Kingdom, United States of America and Singapore. For the purposes of compliance with the applicable privacy law, we use arrangements to ensure that the other dwell entities and our service providers have protections in place to ensure an adequate level of protection for your rights based on the adequacy of the receiving country’s data protection laws, such as approved contractual clauses.

b) Your email should identify yourself and state which Personal Information you would like to access. If you withdraw your consent to any or all purposes and depending on the nature of your request, we may not be in a position to continue to provide our products or services to you.

c) We try to ensure any Personal Information we hold about you is accurate, up-to-date, complete and relevant. If you believe the Personal Information we hold about you should be updated, please contact our DPO and we will take reasonable steps to ensure it is corrected if appropriate.

Our lawful bases for processing your Personal Information

b) Under the EU GDPR and UK GDPR, we must rely on lawful bases to process your Personal Information. The lawful bases we rely on for processing your Personal Information as set out in this privacy policy are:

i) your consent;
ii) the processing is necessary for a contract between you and us;
iii) we have a legal obligation to process your Personal Information;
iv) we have a vital interest; and
v) we have a legitimate interest in processing your Personal Information, such as to provide our products and services to you, to improve our products and services, and to identify you.

c) Where we rely on your consent as the lawful basis to process your data under the GDPR regime applicable to you we will always ask for you to positively confirm your acceptance. By clicking to accept this privacy policy, you acknowledge and agree to be bound by this privacy policy.

d) We note that all contact or other data forms where consent is required to be given by you include no pre-checked checkboxes so that you are able to freely, affirmatively opt-in. We will also provide you with notice on our products and services such as our app and our website which specifically detail what it is that you are consenting to in clear and plain language as well ensuring that each matter that requires consent is clearly distinguishable.

e) Where we rely on your consent as the lawful basis, it is just as easily able to be withdrawn by contacting our DPO or through the appropriate account settings on our platform or website.

Your rights to your Personal Information

f) The EU GDPR and UK GDPR provide you with eight key rights, being the right to:

i) Be informed: anyone processing your data must make clear what they are processing, why and who else the data may be passed to.
ii) Access: the right to access what data is held about you.
iii) Rectification: the right to have your data corrected or amended if what is held is incorrect.
iv) Erasure: the right to ask for your personal data to be deleted, also known as the right to be forgotten, if permitted under applicable laws.
v)Restrict processing: the right to require a temporary halt to the processing of personal data.
vi)Data portability: the right to request for any data supplied by you to us to be provided in a structured, commonly used and machine-readable format.
vii)Object: the right to object to further processing of your data which is inconsistent with the primary purpose for which it was collected.
viii)Consider automated decision making and profiling: the right not to be subject to a decision based solely on automated processing.

g) This section sets out, among other things, how you can exercise these rights when dealing with us.

Exercising your rights under the EU GDPR or UK GDPR with us

h) Accessing or rectifying your Personal Information: we may, if required, provide you with tools and account settings on our app or website to access, correct, delete, or modify the Personal Information you provided to us. You can find out more about how to do this by contacting our DPO. You can also submit a request to us to correct, delete or modify your Personal Information and download the data for you by contacting our DPO.

i) Deletion: we keep data for as long as it is needed for our operations or for our legal obligations. If you wish to have us delete your data, please contact our DPO.
j) Object, restrict or withdraw consent: you may submit a request to our DPO if you object to us storing any of your Personal Information, or if you wish to restrict or withdraw your consent for the collection of your Personal Information. You may withdraw your consent to the processing of all your Personal Information at any time. If you wish to exercise this right, you may do so by contacting our DPO. In some circumstances, you can also withdraw your consent or manage your opt-ins by clicking the unsubscribe link at the bottom of any marketing communications we send you.
k) Portability: we may, if required and possible, provide you with the means to download the information you have shared or generated through our products and services. Please contact our DPO for further information on how this can be arranged.
l) Automated individual decision making, including profiling: you have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you, or similarly significantly affects you, as long as the decision is not necessary for entering into, or the performance of, a contract between us, or is not authorised by an applicable law that we must comply with that also has sufficient protections for your rights and freedoms, or is not based on your explicit consent. If you wish to exercise your rights, please contact our DPO.
m) In certain instances, we may not be required or able to provide you with access to your Personal Information. If this occurs, we will give you reasons for our decision not to provide you with such access to your Personal Information in accordance with the requirements of the EU GDPR or UK GDPR.
n) There is no application fee for making a request to us to access your Personal Information. However, we may charge an administrative fee for the provision of information in certain circumstances, such as if you make repeated requests for information or where the information is held by a third-party provider.