CORNERSTONE COMMERCIAL

Last updated: July 2026

1. Introduction

Cornerstone Commercial (“we”, “us”, “our”) is a commercial real estate agency. Our website address is https://cornerstonecommercial.com.au.

We are committed to protecting your personal information and handling it in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

This Privacy Policy explains how we collect, use, store, disclose, and protect personal information, including information used to verify your identity and information we are required to collect under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act).

A current version of this Policy is always available at https://cornerstonecommercial.com.au/privacy-policy/.

2. Information We Collect

2.1 Information You Provide Directly

We collect your first name, last name, and email address when you voluntarily submit this information through forms on our Site — for example, if you fill out a contact form, subscribe to a newsletter, or request information about our services.

2.2 Information Collected Automatically

We use Google Analytics to collect information about your interactions with our Site. This may include your IP address, browser type, operating system, referring URLs, pages visited, and the dates/times of your visits.

You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on.

2.3 Comments

When visitors leave comments on the Site, we collect the data shown in the comments form, along with the visitor’s IP address and browser user agent string, to help with spam detection.

An anonymised string created from your email address (a “hash”) may be provided to the Gravatar service to check whether you are using it. The Gravatar service privacy policy is available at automattic.com/privacy/. After a comment is approved, your profile picture is visible to the public alongside your comment.

2.4 Media

If you upload images to the website, avoid uploading images with embedded location data (EXIF GPS). Visitors to the website can download and extract any location data from images on the website.

2.5 Information We Collect for Property Sales, Purchases, and AML/CTF Compliance

Cornerstone Commercial’s obligations under the AML/CTF Act apply to brokering the sale, purchase, or transfer of real property, including certain leasehold interests with a term of more than 30 years. Ordinary commercial leasing and property management are generally not “designated services” under the AML/CTF Act, and are treated separately in this Policy (see Section 2.7).

Where we are involved in a sale, purchase, or qualifying long-term lease, both parties to the transaction — for example, the seller and the buyer — are generally our AML/CTF customers and subject to Customer Due Diligence, even though we are typically formally appointed by only one of them (usually the seller). In these circumstances, we may collect, from whichever party is relevant:

Full name, date and place of birth, and residential or business address;
Government-issued identification details, such as a driver licence, passport, or other ID document;
For companies and trusts: registration details, director information, beneficial ownership information (individuals who own or control 25% or more), and trustee/beneficiary information;
Information about the source of funds or source of wealth involved in the transaction, and whether the person (or someone associated with them) is a Politically Exposed Person (PEP);
Biometric information, such as a facial image or short verification video, in the circumstances described in Section 2.8; and
Records connected with the transaction and the services we provide.

We only collect personal information that is reasonably necessary for our business activities and to meet our legal obligations. Where this information is required for a sale, purchase, or qualifying lease that is a designated service under the AML/CTF Act, we are not able to complete the transaction without it from all relevant parties.

2.6 Information We Collect From Other Sources

In addition to information collected directly from you, we may also collect personal information about you from:

The other party to a transaction (for example, the buyer, seller, landlord, or tenant), or their representatives;
Solicitors, conveyancers, and other professional advisers involved in a transaction;
Referees provided by you or another party;
Publicly available sources, such as title searches, land registry records, and ASIC company searches; and
AML/CTF screening databases used to check for politically exposed persons, sanctions, or adverse media, as part of our compliance obligations.

2.7 How We Verify Your Identity

How we verify your identity depends on the type of transaction:

Sales, purchases, and qualifying long-term leases requiring AML/CTF Customer Due Diligence: we use an electronic identity verification process, which may include the Australian Government’s Document Verification Service (DVS). Before this check is carried out, we ask for your express consent (see Section 4). Once given, your name, date of birth, and identity document details are securely sent to the relevant Commonwealth or State authority that issued the document (for example, a passport office, driver licence authority, the Department of Home Affairs, or Births Deaths and Marriages). That authority checks whether the details you provided match the records it holds, and returns a match result only (yes or no) — we do not receive a copy of your government records. This process is carried out through our AML/CTF compliance platform (AML Hub) and its accredited identity verification providers, including APLYiD (APLYiD Pty Ltd, ABN 36 632 866 794) and its sub-providers. More information about the DVS is available at idmatch.gov.au.
Ordinary leasing and property management: identification is generally provided to us by email, or physically for us to copy, and is stored and handled as described in Sections 8 and 9 of this Policy.

2.8 Biometric Information

Where we use electronic identity verification for a sale, purchase, or qualifying long-term lease (Section 2.7), we may collect biometric information, such as a facial image or a short video of you holding your ID, to:

Confirm that you are a real person and physically present;
Match your image to the photograph on your identification document; and
Reduce the risk of fraud and identity theft.

Biometric information is sensitive information under the Privacy Act. We only collect and use it for identity verification and related compliance purposes, and only with your express consent (see Section 4). We do not collect biometric information for ordinary leasing or property management transactions.

3. Why We Collect, Use, and Disclose Your Information

We collect, use, and disclose your personal information to:

Verify your identity;
Provide and manage our real estate services to you, and communicate with you about them;
Meet our legal and regulatory obligations, including Customer Due Diligence, ongoing transaction monitoring, and reporting to AUSTRAC under the AML/CTF Act;
Detect and prevent fraud, and keep our systems and records secure;
Operate, maintain, and improve our website and services, including analysing traffic and usage; and
Detect and prevent spam on our Site.

4. Consent to Identity Verification

Where we use electronic identity verification for a sale, purchase, or qualifying long-term lease (Section 2.7), we ask for your express consent before the check is carried out — for example, by an active step such as ticking an unticked checkbox, or providing recorded verbal consent. This Policy explains what that consent covers and how your information is used, but reading this Policy is not, by itself, your consent. Your consent covers:

The collection, use, and disclosure of your personal information for identity verification, AML/CTF, and related compliance purposes;
The collection and use of biometric information, such as a facial image or video, for identity verification;
Your information being checked against records held by Commonwealth and State authorities through the DVS; and
Your information being shared with our authorised identity verification providers, including APLYiD, for this purpose.

Your consent is voluntary. You can withdraw it at any time, for any future processing, by contacting us using the details in Section 13 — but withdrawing consent cannot undo a check that has already been completed, and does not override our legal obligation to retain AML/CTF records for the periods described in Section 8. If you do not consent, or do not provide the information we need, we may not be able to verify your identity electronically — we may need to verify your identity another way, or we may not be able to provide our services to you for a transaction that legally requires this verification.

5. Cookies

If you leave a comment on our Site, you may opt in to saving your name, email address, and website in cookies. These are for your convenience, so you do not have to fill in your details again when you leave another comment. These cookies last for one year.

If you visit our login page, we set a temporary cookie to determine whether your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.

When you log in, we also set cookies to save your login information and screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me,” your login persists for two weeks. Logging out removes your login cookies.

If you edit or publish an article, an additional cookie is saved in your browser. This cookie includes no personal data and simply indicates the post ID of the article you just edited. It expires after one day.

6. Embedded Content

Articles on this site may include embedded content (e.g. videos, images, articles). Embedded content from other websites behaves in exactly the same way as if the visitor had visited that other website directly, and these websites may collect data about you, use cookies, and monitor your interaction with that content.

7. Disclosure of Your Information

We do not sell your personal information. We may disclose it to:

Our identity verification providers, including APLYiD and its authorised sub-providers, and Commonwealth/State authorities and official record holders through the DVS (Section 2.7);
Our employees and authorised representatives, on a need-to-know basis;
Our professional advisers, such as lawyers, accountants, and auditors;
Trusted technology and service providers that help us operate our business and website, such as Google Analytics and the Gravatar service;
An automated spam detection service, for comments submitted on the Site;
The Australian Transaction Reports and Analysis Centre (AUSTRAC), where we are required to lodge a Suspicious Matter Report, Threshold Transaction Report, or other report under the AML/CTF Act; and
Regulators, law enforcement, or other third parties where otherwise required or authorised by law.

7.1 A Note on AML/CTF Reporting

If we form a suspicion about a transaction and lodge, or consider lodging, a Suspicious Matter Report, the law restricts us from disclosing that fact, or related information, where doing so would or could reasonably be expected to prejudice an investigation. This is a criminal offence known as “tipping off.” It is not an absolute ban on ever mentioning a report — but we treat this area with caution, and will only share information about a report, or a possible report, to the extent the law allows (see Section 10).

7.2 Overseas Disclosure

Some of our service providers may store or process personal information outside Australia. Google Analytics and the Gravatar service are provided by companies based in the United States, and information may be processed or stored on servers located in the United States or other countries where their infrastructure operates. Our AML/CTF identity verification providers, including APLYiD, are Australian-based, and we understand identity verification data is generally processed onshore in Australia — we are confirming this directly with AML Hub/APLYiD to ensure this Policy stays accurate (see drafting note below). Where personal information is handled overseas, we take reasonable steps to ensure it continues to be protected in line with the Australian Privacy Principles, including through contractual protections with our providers.

8. How Long We Keep Your Information

Comments and their metadata are retained indefinitely, so we can recognise and automatically approve any follow-up comments rather than holding them in a moderation queue;
If you register on our website, we store the personal information in your user profile for as long as your account exists. You can see, edit, or delete this information at any time (except your username);
Identification provided to us for ordinary leasing or property management (Section 2.7) is retained only for as long as reasonably necessary for that purpose, or as required by law; and
Information collected for AML/CTF compliance purposes (Sections 2.5–2.8) is generally retained for at least 7 years — but the exact starting point depends on the type of record: Customer Due Diligence records (identity, verification, beneficial ownership) are generally kept for 7 years after our business relationship with you ends, or 7 years after a one-off transaction; records demonstrating our compliance with our AML/CTF Program (such as risk assessments) are generally kept for 7 years after they stop being relevant to demonstrating that compliance. This is the general approach under the AML/CTF Act and Rules rather than a single fixed rule, and these periods apply even where you have asked us to erase your information (see Section 10).

9. Data Security and Storage

We take reasonable steps to protect your personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. These steps include secure systems, restricting access to authorised personnel, and encryption in transit and at rest where appropriate.

We retain personal information only for as long as we need it for the purposes set out in this Policy, or as required by law (see Section 8). When we no longer need your information, we securely delete or de-identify it.

10. Access and Correction

You have the right to ask for access to the personal information we hold about you, and to ask us to correct it if it is inaccurate, incomplete, or out of date. To make a request, please contact us using the details in Section 13; we will respond within a reasonable time.

Our legal obligation to retain AML/CTF records for the periods described in Section 8 mainly affects our ability to delete that information — it does not, by itself, prevent you from accessing or correcting it, and we will still consider requests relating to it. However, we may decline or limit a request where a specific exemption under the Privacy Act applies, or where providing the information would breach the “tipping off” restriction described in Section 7.1. Where we limit access on this basis, we will tell you that a limitation applies, to the extent we are legally able to do so.

11. Direct Marketing

From time to time, we may use your contact details to send you information about our services that we think may be of interest to you. You can opt out of marketing communications at any time by using the unsubscribe link in our messages, or by contacting us using the details in Section 13.

12. Privacy Complaints

If you have a concern about how we have handled your personal information, please contact us first using the details in Section 13. We will acknowledge your complaint, investigate it, and respond to you within a reasonable time.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

13. Contact Us

For any questions about this Policy, or to exercise any of your privacy rights, please contact:

Kristy McMillan

Director, Cornerstone Commercial — Privacy & AML/CTF Compliance Officer

kristy@cornerstonecommercial.com.au | 0435 260 173 | 1/16 Aerodrome Road Caboolture, Qld 4510.

14. Updates to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. The latest version will always be available on our website, at the URL in Section 1. Where changes are significant, we will let you know.