PURPOSE

Each member of the Cornerstone Group of Companies from time to time, including Cornerstone Properties Pty Ltd (ABN 53 084 212 831), Cornerstone Property Services (ABN 28 160 767 519), Cornerstone Parking Pty Ltd (ABN 52 143 564 836) and certain of their respective associated bodies corporate (as those terms are defined in the Corporations Act 2001 (Cth)) from time to time (referred to as “Cornerstone”, “we”, “us” or “our”) and each of the agents who act on our behalf are committed to protecting your privacy and complying with our obligations under the Privacy Act 1988 (Cth) and Australian Privacy Principles (collectively, “Australian Privacy Law”), in respect of the collection, storage, use and disclosure of personal information.

This Privacy Policy sets out the principles that we adopt to manage the personal information of our visitors and potential visitors to our properties, landlords / tenants and their employees, service providers, agents, contractors, investors, and employees and potential employees (“you”).

This Privacy Policy outlines the following:

why we collect personal information;
the types of personal information we collect and how we use that information;
who may collect personal information;
how we collect and hold personal information;
how we keep personal information secure;
the circumstances in which we may disclose personal information;
how you may access personal information held by us and seek correction; and
how you may complain about a breach of privacy, and how we will deal with such a complaint.

This Privacy Policy applies to information provided to us whether at one of our properties, via our websites, portals, mobile apps, Wi-Fi landing pages, web forms, feedback and surveys, interactive digital devices or any other means (hereafter “channels”). By accessing and/or using our channels, products and services, you consent to the use, collection, storage and disclosure of your personal information in accordance with this Privacy Policy and Australian Privacy Law.

Although we will comply with this Privacy Policy in respect of information provided to us by persons under the age of 18 years, persons under the age of 18 years must obtain the consent of a parent or guardian prior to accessing and/or using our channels, products and services and the parent or guardian will be responsible for appropriately supervising that person’s access to and/or use of our channels, products and services.

1. PERSONAL INFORMATION

We collect and use personal information about you for the primary purpose of providing you access to and use of our channels, products and services, managing our relationship with you, or other purposes for which you would reasonably expect us to use that information. Examples of why we may collect your personal information include:

to enter into contracts with goods or service providers in connection with our business;
to facilitate the use of our products and services;
for internal administrative purposes, such as procedural assessments, risk management, accounting, billing, customer service and product and service reviews;
in connection with the management of access and security at our properties;
to participate in marketing promotions, surveys, competitions and other engagement activities;
for marketing and promotional purposes;
to provide you with personalised communications;
to measure and analyse customer or visitor behaviour in order to improve our properties and otherwise in connection with our business;
to better understand your needs and deliver improved services and an enhanced experience before, during and after your visit to our properties and to comply with our legal obligations.

We may also use information we collect about you to obtain further details from available sources via our trusted data service providers, where it may help us to improve our communications and customer service to you and to deliver an enhanced, personalised experience.

Additionally, analytics may be conducted on personal information provided directly by you, as well as third party sources and third-party social-networking sites (including but not limited to Facebook, Instagram, LinkedIn and/or Twitter) for the purpose of marketing, preferred customer products/ services and to better understand your needs in order to deliver improved services and an enhanced experience before, during and after your visit to our properties and we may share information we collect about you with our affiliates, agents and business partners for this purpose.

2. WHAT PERSONAL INFORMATION DO WE COLLECT AND HOW DO WE USE IT?

We may collect the following types of personal information:

your name;
your commercial, residential and/or postal address;
your email address;
your telephone number;
your age or date of birth;
your credit card, bank or cheque payment details;
when you accessed our Wi-Fi and the domain name used to access our Wi-Fi;
details of the products and services you have purchased from us or which you have enquired about, together with any additional information necessary to deliver those products and services and to respond to your enquiries;
if you sign on via a third-party social-networking site (including but not limited to Facebook, Instagram, LinkedIn and/or Twitter), publicly accessible social media posts and any personal information we may obtain from those sites; and
any additional information relating to you that you provide to us directly through our websites or indirectly through use of our websites or online presence, through our representatives or otherwise.

Examples of personal information which may be collected and how that information may be used

From visitors to our properties

We may collect your personal information when you are visiting our properties. This may include:

in connection with competitions or email communications (either while in our properties or online);
video and camera surveillance information including, images of visitors, their vehicles and car park licence plates, and other data which users consent to us collecting from time to time when entering our properties and car parks and/or from third parties. When you park in our properties or car parks with a ticketless parking system or car locator functionality, you consent to provide us with their car licence plate details and, in some circumstances, other information including name, email address and telephone number;
where devices are enabled to connect to, or are identifiable by, in-centre infrastructure, we and our third party providers may automatically collect data from those devices including usage, type of device and location and proximity of your wireless device in our properties, arrival and departure time from our properties, and other data which users consent to us collecting from time to time; and
audience measurement information collected using in-centre technologies such as SmartScreen Advertising Units which utilise image processing software to aggregate data such as visitor numbers and demographics. These technologies do not identify individual visitors, or record or retain images of individual visitors.

From our tenants and their staff

We may collect the following types of personal information from you during negotiations for, and during the term of, the lease/licence for premises, kiosks and other activities at its properties:

name, address and date of birth;
contact and insurance details;
next of kin or emergency contact details;
ABN(s); and
financial and trading information (including your financial standing and retailing experience).

We may use this information to:

evaluate whether we should enter into a lease, licence or other agreement with a tenant;
to assist us in the preparation documentation to formalise the lease, licence or other agreement; and
to manage our relationship with tenants in connection with the management and security of our properties.

When entering one of our properties, the personal information and images of tenants and their staff may be collected. This information may be used by us in connection with the management and security of our properties and may be provided to law enforcement and government bodies, insurers, and other third parties from time to time.

Where tenants or their employees sign up to use or access our products, services or channels, we may also collect information for the purposes of maintaining our relationship with you and to provide services offered through that channel.

From our agents, contractors and suppliers

If you, or a company you work for, supplies goods or services to us, we may collect personal information about you in connection with the provision of those goods or services, either directly from you or from that company. This information may include your name, date of birth, contact information, emergency contacts, and any other information you provide, or is provided on your behalf, as part of our induction and compliance processes, such as licences to use certain equipment on our premises.

From employees or potential employees

If you are seeking employment with us, we may collection personal information about you in connection with your employment. This information may include your name, date of birth, contact information, and any other information you provide, or provided on your behalf, as part of our induction and compliance processes.

From users of our website

When you use, access or become a registered user of https://www.cpltd.com.au/ or any associated site or other site operated or maintained by us from time to time (website(s)), including when you use services offered by a website, we may ask for information including:

your name;
your email address;
your date of birth; and
your telephone number or residential address.

The website is an Australian-based website, and it is not intended to provide services to EU residents, and its terms may not be fully consistent with the General Data Protection Regulation. If you are an EU resident and you choose to use the Website then you do so at your own risk, and subject to the terms and conditionals applicable to our website.

We may also collect the following information from you when you access our website or use services offered by our website:

the domain name or IP address used to access our websites;
the date and time you accessed each page on our websites;
the URL of any webpage from which you accessed our websites; and
publicly accessible social media content and any personal information you allow us to collect by linking your account on our website with a third-party social-networking site (including but not limited to Facebook, Instagram, LinkedIn and/or Twitter).

We may collect, use or hold this information for the following purposes:

to improve our website or functionality provided by the website or in-centre experience;
to measure and analyse visitor numbers, characteristics and demographics, in order to continuously improve our properties and for use otherwise in connection with our business; and
for other purposes to which you, either expressly or impliedly, consent to, and for the purposes set out in this Privacy Policy, we may transfer your personal information to third parties in countries outside Australia (including to our data hosting and other IT service providers, and other third parties outside of Australia, including the United States of America).

From users of our Wi-Fi services and mobile applications

When you log on to Wi-Fi services or download any mobile apps made available in connection with our properties, use mobile applications developed by us or third party applications utilising our infrastructure, you may be required to provide certain personal information, including your contact details, to access the service.

We collect this information (and may use or hold this information) for the following purposes:

to improve our Wi-Fi network and your in-centre experience;
for the purposes of and incidental to your use of the in-centre Wi-Fi services; and
to enable users to be informed about upcoming events, activities and promotions, both in our properties and as part of our other activities.

In addition to the purposes set out above, this information may be used by us in connection with the management and security of our properties generally and to obtain feedback about your experiences at a property.

General

We may use anonymised data for the purposes set out above and to inform our promotional and marketing strategies, as well as for research and profiling purposes. This research may be compiled and analysed on an aggregate basis, and we may share this aggregate data with our affiliates, agents and business partners. We may also disclose aggregated information in order to describe our services to current and prospective business partners, and to other third parties for other lawful purposes.

We may connect information you provide to us for one purpose with other information for use for one or more of the above purposes. If you access our Wi-Fi service, and we already hold other information (both personal or non-personal) that can be associated to you or the device on which you are accessing the Wi-Fi service, then that information may be linked with personal information we hold about you as set out in this Privacy Policy, and will be treated in the same manner as the personal information to which it has been linked.

3. WHO COLLECTS THE PERSONAL INFORMATION?

Personal information may be collected directly by us, our agents or by our trusted business partners acting on our behalf. This can include:

property management companies;
technology providers; and
trusted data service providers.

Information may also be collected by us on behalf of other people as set out in notices given to individuals, or consents given by individuals, at or prior to the time the personal information is collected.

4. HOW DO WE COLLECT PERSONAL INFORMATION?

We will only collect personal information by lawful and fair means.

If it is reasonable and practical to do so, we will collect personal information directly from the individual. We may also collect personal information from other companies that are able to disclose it to us, if it’s not practical to collect it from you.

Personal information gathered by our agents and business partners acting on our behalf will be treated in a manner consistent with this Privacy Policy. Our properties use CCTV and other surveillance techniques in connection with the management and security of our properties and to measure visitor numbers, characteristics and demographics, and analyse visitor behaviour in order to continuously improve our properties and for use otherwise in connection with our business. By entering our properties you consent to this surveillance and to our use and disclosure of the information captured by surveillance as set out in this Privacy Policy.

Cookies

When you visit our websites, the server may attach a ‘cookie’ to your computer or other device’s memory. A cookie assists us to store information on how visitors to our website use it and the pages that may be of most interest.

We may use cookies to identify you between multiple visits, better understand how our websites are used, provide information which may be of interest to you based on your previous visits to our websites and to provide targeted advertising to you when you visit our website and certain other websites where advertising is found from time to time.

We may provide the information we gather from cookies to third parties for the above purposes and for other purposes connected with our websites. If cookie information is linked with personal information we hold about you as set out above, this cookie information becomes personal information and will be treated in the same manner as the personal information to which it has been linked.

If our website uses cookies, you do not have to accept such cookies. Also, you may set up your browser to notify you when you receive cookies. This will give you the opportunity to decide whether or not to accept the cookies. If you choose to disable cookies, you may not be able to access certain features of the website.

Links to third party websites

Our websites may link directly to external websites (“Linked Websites”) operated by third parties. You acknowledge that these sites are not operated by us. We encourage you to always read the applicable privacy policy of any Linked Website prior to entering the Linked Website. We are not responsible for the content or practices of the Linked Websites nor their privacy policies regarding the collection, storage, use and disclosure of your personal information.

Automated decision-making

If you reside in the European Union or EFTA States, you shall have the right not to be subject to a decision based solely on automated processing, which produces legal effects concerning you, or similarly significantly affects you, as long as the decision is not necessary for entering into, or the performance of, a contract between us, or is not authorised by Union or Member State law to which we are subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests, or is not based on your explicit consent. If you wish to exercise your rights please contact us.

Assignment, change of control or transfer

All of our rights and obligations under this Privacy Policy are freely assignable by us to any of our affiliates, in connection with a merger, acquisition, restructuring, or sale of assets, or by operation of law or otherwise, and we may transfer your information to any of our affiliates, successor entities, or new owner.

5. HOW IS YOUR PERSONAL INFORMATION STORED, KEPT SECURE AND MAINTAINED?

We will take all reasonable steps to protect personal information held from misuse or loss and from unauthorised access, modification or disclosure. This includes restricting access to hardcopy and electronic records via physical and logical security methods.

Personal information may be held securely on our electronic databases (which may be on a database maintained by a cloud hosting service provider or other third party database storage), or otherwise in hard copy form in secure storage facilities. Your personal information may be transmitted over the Internet once it has been stored in a database and may also be transferred to recipients in foreign countries other than Australia, and may be stored on servers, using databases or via cloud technology in a number of countries other than Australia (including regions such as the United States of America, the European Union and Asia), where doing so is part of Cornerstone’s ordinary business practices relating to the storage of data and where permitted by law.

Where personal information is held with a third party, we will ensure that appropriate technical and organisational measures are in place to protect the security of that information and to ensure that it is managed in accordance with Australian Privacy Law.

Cornerstone maintains responsibility for your information at all times. As such, we ensure by all reasonable means, any third parties we use are subject to controls which protect your information from unauthorised use and disclosure and limit access and limit their use or disclosure of your personal information to the agreed purpose only.

We will keep your personal information for only as long as is reasonably necessary to achieve the purpose for which we collected it. Where we no longer require the personal information for a permitted purpose, we will take reasonable steps to destroy or de-identify it.

Whilst we will use all reasonable endeavours to keep your personal information in a secure environment, this security cannot be guaranteed due to the nature of the Internet. If you reasonably believe that there has been unauthorised use or disclosure of your personal information please contact us via the details below.

We have also taken steps to ensure that, if you tell us you are located in the European Union, and advise us that you wish to exercise the additional rights available to you under the General Data Protection Regulation, we will endeavour to meet those requests subject to the terms of this Privacy Policy.

Right to anonymity

At the point of collection, and when dealing with us, you may have the opportunity to remain anonymous where it is reasonable and practical to do so. It must still be practicable for us to perform the required services. Some exceptions do apply where it is a legal requirement for our business to deal with accurately identified individuals.

6. DISCLOSURE OF YOUR PERSONAL INFORMATION

We will only disclose the personal information we have about you in limited specific circumstances, such as:

when you agree to the disclosure;
in relation to or for the purposes we collected it; or
when disclosure is required or authorised by law.

To the extent permitted by law, we may also disclose information about you to:

our associated entities and related bodies corporate;
trusted business partners for marketing purposes;
third parties who we engage to provide related services from time to time;
our staff, agents and subcontractors in connection with the management and security of our properties;
government agencies as part of our statutory obligations; or
as otherwise permitted by law.

Direct marketing

By accessing and using our channels and services, you consent to the use and disclosure of your personal information by and to our business partners for the purpose of allowing them to directly market products and services.

We aim to use your personal information to send advertising that is customised or more relevant to your interests, characteristics or general location. This doesn’t necessarily mean you’ll get more advertising. It just means that the advertising that you see will hopefully be more relevant to you. For example, we may use your contact details to provide you with information about promotions at our properties or those of our tenants.

You may request to not receive such material by following the unsubscribe instructions that will be contained on any such material. Upon request, we will arrange for your details to be removed from our databases as soon as reasonably practicable. You agree and acknowledge that even if you opt out of receiving marketing material, we may still send you essential information that we are required to send you relating to the services we provide.

Unsolicited personal information

If we receive personal information about you that we did not ask for either directly from you, from someone on your behalf, or through someone on our behalf, and we determine that we could have collected this information from you had we asked for it, we will take reasonable steps to notify you, as soon as practicable, that we have collected your personal information. If we could not have collected this personal information from you (or if you do not agree to us collecting information in this way), we will lawfully de-identify or destroy that personal information.

7. ACCESS TO YOUR INFORMATION

We will take all reasonable steps to ensure that personal information held by us is accurate, complete and up to date. If you wish to access your information, or you believe that any of your personal information is inaccurate, please contact the Cornerstone Privacy Officer via the contact details below. We will respond to you and take all reasonable steps to correct it within a reasonable timeframe.

8. CHANGES AND UPDATES TO OUR PRIVACY POLICY

We may update this Privacy Policy from time to time. We will notify you of any changes by publishing the updated version at this location. You should check this Privacy Policy regularly so that you are aware of any variations. You will be deemed to have consented to such variations by your continued access and use of our website or other channels, products and services following such changes being made.

9. CONTACT DETAILS

For further information about our Privacy Policy or practices, please contact our Privacy Officer using the details set out below:
Attention: Privacy Officer
Address: Level 10, 300 Ann Street, Brisbane Qld 4000
Email: [email protected]
Telephone: 07 3034 0511

10. COMPLAINTS

If you believe we have breached our privacy obligations or your privacy rights in any way, please contact the Privacy Officer. We will respond to your complaint as soon as possible, and within a reasonable timeframe. If you think we have not resolved a complaint satisfactorily, we will provide you with information about the further steps you can take.

You can also contact the Officer of the Australian Information Commissioner using the following details:
Address: GPO Box 5218, Sydney NSW 2001
Phone: 1300 363 992
Email: [email protected]
Online Enquiries: oaic.gov.au

DISCLAIMER