Privacy Policy

This Privacy Policy explains how Colma [insert full legal entity name and ABN] (Colma, we, us or our) manages personal information in connection with its website, mobile application, memberships, registered properties, repair requests, appointments and maintenance services.

Colma intends to follow the Australian Privacy Principles (APPs) and the Privacy Act 1988 (Cth) to the extent they apply. Where Colma is exempt from a particular requirement, this policy still records the privacy practices Colma has chosen to adopt unless a different lawful position is clearly stated.

This policy should be read with Colma's Membership Terms and Conditions, Plan Summary, collection notices, cookie notice and any service-specific privacy notice.

This policy applies to personal information about:

• members, applicants and prospective members;
• property owners, tenants, occupants, authorised representatives, property managers and body-corporate representatives;
• people who contact Colma, use the Colma Platform, submit a repair request, attend a property or make a complaint; and
• other individuals whose information is reasonably required for a Colma service or legal obligation.

It does not apply to de-identified information that cannot reasonably identify an individual, or to employee records to the extent a lawful employee-record exemption applies.

Colma does not ordinarily require sensitive information. It may arise incidentally or be reasonably necessary for accessibility, health and safety, incident management or legal compliance. Colma will obtain consent where required unless another lawful exception applies.

Do not upload medical records, identity documents or other sensitive information unless Colma has specifically requested it for a stated lawful purpose or it is reasonably necessary to address an immediate safety issue.

Colma may collect information:

• directly through the website, app, application and checkout forms, telephone, email, messaging, surveys, appointments, inspections and service delivery;
• from an authorised representative, owner, tenant, property manager, body corporate or person at the property;
• from painters, plasterers and other service providers performing or assessing authorised work;
• from payment, hosting, communications, mapping, analytics, customer-support and software providers; and
• from professional advisers, regulators, courts, public registers or other lawful sources where reasonably necessary.

If Colma receives unsolicited personal information, it will assess whether the information could lawfully have been collected and will retain, use, de-identify or destroy it as required or permitted by law.

A member may provide details about an owner, tenant, occupant, authorised representative, emergency contact or person who will provide access. The member should have a reasonable and lawful basis to provide that information and, where practicable, tell the person that it will be provided to Colma.

Colma will seek to collect only information necessary for that person's role, such as their name, contact details, access availability and relevant safety or communication information.

• assess eligibility, create and administer accounts and memberships, and register properties;
• process membership fees and authorised payments, issue invoices and manage refunds or credits;
• assess repair requests, verify measurements and annual repair allocations, prepare quotes and schedule appointments;
• provide, document and quality-check painting, plastering and related maintenance services;
• verify authority and property access, coordinate people at the property, and manage keys or access codes;
• allocate and manage service providers, materials, safety and property-damage matters;
• provide customer support, investigate complaints and disputes, prevent fraud or misuse, and enforce lawful rights;
• operate, secure, analyse and improve the Colma Platform and forecast service demand; and
• comply with accounting, taxation, consumer, work health and safety, privacy, court and regulatory requirements.

Colma and authorised service providers may take or receive photographs and video reasonably necessary to assess, quote, schedule, perform, verify and document a repair, record property condition, address safety or investigate a complaint.

Images should focus on the relevant surface, work area or access condition and avoid unnecessary capture of people, personal documents, family photographs, security information and unrelated private areas. Images that identify a person are personal information.

Operational images are not automatically approved for advertising, social media or promotional use. Colma will obtain any separate marketing consent required by law and its Terms.

Alarm codes, lock-box codes, gate codes, key records and other property-security details are collected only where reasonably necessary for authorised access. Access is restricted to people with a current operational need.

Colma may retain limited evidence that access was authorised or completed, but active codes and access instructions will be deleted, disabled, returned or securely restricted when they are no longer reasonably required, subject to lawful dispute or recordkeeping needs.

Colma may disclose relevant information to:

• assigned painters, plasterers, assessors and other service providers;
• payment processors, accounting systems, cloud hosting, communications, scheduling, mapping, analytics, identity, fraud-prevention, customer-support and software providers;
• property owners, authorised representatives, property managers or people at the property where necessary for the service;
• professional advisers, insurers and auditors; and
• emergency services, regulators, courts, tribunals and law-enforcement bodies where lawful or required.

Colma limits disclosure to information reasonably necessary for the recipient's role and requires service providers and contractors to comply with applicable confidentiality, privacy, security, photography and record-handling obligations.

Colma does not sell customer contact lists or exchange personal information for an unrelated commercial advantage.

Some technology, communications, analytics, support or storage providers may process or store personal information outside Australia. The likely countries are: [insert verified countries, or state how an individual may obtain the current list].

Where APP 8 applies, Colma will take the steps required before disclosing personal information to an overseas recipient unless an exception applies. Colma will review providers, contractual protections, access controls and data locations in a manner proportionate to the information and risk.

The website and app may use cookies, software development kits, pixels, local storage and logs for authentication, security, preferences, diagnostics, performance, analytics and lawful marketing. A separate cookie notice or platform setting may identify providers, purposes and available choices.

Where consent is required, Colma will seek it before using the relevant non-essential technology.

Colma may send operational communications required to administer a membership or service, including payment, renewal, appointment, safety, access, repair-request and platform notices.

Direct marketing will be sent only where consent exists or law otherwise permits it. Marketing messages will provide an accessible opt-out where required. Opting out of marketing does not prevent necessary non-promotional communications.

Colma may use software to assist with postcode eligibility, measurement calculations, scheduling, fraud detection, allocation tracking, service triage and administrative decisions.

Colma will not represent software output as a final professional inspection where onsite or specialist assessment is reasonably required. A reasonable review channel will be available where a materially adverse automated result may be inaccurate or requires human consideration.

From 10 December 2026, additional APP Privacy Policy disclosures may apply where a computer program uses personal information to make decisions that could reasonably be expected to significantly affect an individual's rights or interests. Before that date, Colma must verify whether any production process meets that threshold and add the required description of the kinds of information used and decisions made.

Colma takes reasonable steps to keep personal information accurate, current, complete and relevant and to protect it from misuse, interference, loss and unauthorised access, modification or disclosure.

Measures may include role-based access, multi-factor authentication, secure configuration, encryption where appropriate, logging, backups, staff and contractor training, confidentiality requirements, provider review, incident procedures and periodic access reviews.

No electronic system is completely secure. This does not reduce Colma's obligation to take reasonable protective steps. Members should keep credentials confidential, avoid sharing one-time codes and promptly report suspected unauthorised access.

Colma maintains a process to contain, assess, notify and review suspected data breaches. Where the Notifiable Data Breaches scheme or another notification requirement applies, Colma will assess the incident and notify affected individuals and the relevant regulator when legally required.

Colma retains personal information only for as long as reasonably necessary for lawful purposes, including service history, accounting, taxation, legal compliance, safety, complaints, disputes, security and enforcement.

Retention differs by record type and considers statutory requirements, limitation periods, sensitivity and operational need. When information is no longer required, Colma will take reasonable steps to destroy or de-identify it where required. Secure backups may retain information for a limited cycle after deletion from active systems.

An individual may request access to personal information Colma holds about them or ask Colma to correct information believed to be inaccurate, out of date, incomplete, irrelevant or misleading.

Colma may verify identity and authority before responding and may refuse or limit access only where permitted by law. Colma will respond within the legally required period or otherwise within a reasonable time and will give reasons and available complaint options if a request is refused.

Contact Colma's Privacy Officer:

• Email: hello@colma.example
• Postal address: [insert postal address]
• Telephone: [insert telephone number]

Colma will acknowledge and investigate a privacy complaint within a reasonable time, communicate the outcome and identify available review or external complaint options. Where the Privacy Act applies, an individual may complain to the Office of the Australian Information Commissioner after giving Colma a reasonable opportunity to respond.

Memberships are not intended to be purchased by children. Colma will take reasonable care not to collect unnecessary information or identifiable images of children, vulnerable individuals or unrelated occupants when documenting a property.

Colma may update this policy to reflect changes in law, technology, providers, security practices or services. The current version will be made available through the website or Colma Platform. Reasonable notice of a material change will be given where required or where it materially affects existing information-handling practices.