1. Our commitment to privacy

Haben Property Fund Ltd ABN 89 139 914 775 and Haben Management Pty Ltd as trustee for The Haben Retail Management Unit Trust ABN 91 873 552 898 and their affiliates (collectively known as "Haben" and also referred to in this Policy as "us" "we" and "our") are committed to protecting your privacy and handling your personal information in a transparent and responsible manner.

This Privacy Policy explains how we collect, use, disclose and protect personal information.

We handle personal information in accordance with the Privacy Act 1988 (Cth) (including the Australian Privacy Principles) and any other applicable laws.

 

2. Who is Haben?

Haben manages and invests in real estate assets, including our Shopping Centres, and offers investment products relating to those assets.

 

3. What is personal information?

“Personal information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable.

Examples include:

  • name and contact details;

  • date of birth;

  • identification details (e.g. driver’s licence);

  • financial information (e.g. income, assets and liabilities);

  • employment and investment information.

We generally do not collect sensitive information (e.g. health, religion, political opinions) unless required or authorised by law or with your consent.

 

4. Why we collect your personal information

We collect and use personal information where it is reasonably necessary for our business activities or where otherwise permitted by law, including:

  • providing products and services;

  • managing investments and business operations;

  • communicating with you, including marketing (where permitted);

  • assessing applications (e.g. employment, investment, suppliers);

  • managing risk, compliance and security;

  • responding to enquiries and complaints;

  • complying with legal and regulatory obligations, including anti-money laundering and counter-terrorism financing (AML/CTF) and know-your-customer (KYC) requirements (such as verifying identity and conducting due diligence).

If you do not provide requested information, we may be unable to provide certain services.

 

5. How we use personal information

We use personal information:

  • for the primary purpose of collection;

  • for related secondary purposes reasonably expected;

  • with your consent; or

  • where otherwise permitted or required by law.

 

6. How we collect and use your personal information

We may collect personal information when you:

  • visit our Shopping Centres and car parks;

  • contact us (e.g. email, phone, website enquiry);

  • invest in our products;

  • attend events;

  • use our services;

  • apply for employment; or

  • provide goods/services to us.

 

We may also collect information from third parties, including:

  • contractors and service providers;

  • professional advisers and referrers;

  • publicly available sources; or

  • other parties authorised by you.

Where practicable, we collect personal information directly from you.

 

7. Specific collection scenarios

a. Customers and Visitors

We may collect information when you:

  • visit our Shopping Centres or car parks;

  • enter competitions, sign up to newsletters, complete surveys or attend events; or

  • hire equipment (e.g. mobility scooters).

 

b. CCTV and Surveillance

Our Shopping Centres and car parks use CCTV and other surveillance systems, including body-worn cameras.

We may collect:

  • images and video footage;

  • vehicle licence plate details.

We conduct surveillance where it is reasonably necessary for legitimate interests such as crime prevention, safety, asset protection, and incident investigation. Body-worn cameras are used by authorised personnel (e.g. security staff) and are activated in accordance with defined procedures for incident recording, safety, and evidentiary purposes.

This information is used for security, safety and operational purposes and may be shared with law enforcement, service providers and insurers. CCTV footage is retained for a limited period unless required for investigation, legal or enforcement purposes. Access to surveillance information is restricted to authorised personnel and service providers.

 

c. Ticketless Parking Systems

Where applicable, we collect licence plate data and, in some cases, contact details to administer parking, enforce conditions, and conduct operational analysis.

 

d. Suppliers and Contractors

We collect information necessary to manage supplier relationships, including compliance and onboarding.

 

e. Employees and Investors

We collect personal information to manage recruitment processes, employment relationships and investment contracts, in accordance with applicable law. In relation to investors, we may collect and use personal information to comply with applicable legal and regulatory obligations, including anti-money laundering and counter-terrorism financing (AML/CTF) and know-your-customer (KYC) requirements. This may include verifying your identity, conducting due diligence (such as beneficial ownership or source of funds checks), and disclosing information to regulators, service providers or other third parties where required or permitted by law. If you do not provide requested information, we may be unable to process or accept an investment.

 

8. Website, cookies and online collection

When you use our website or online services, we may collect:

- IP address, device and browser data;

  • usage and interaction data;

  • general location data;

  • information submitted through forms.

We use cookies and similar technologies to:

  • operate and secure our website;

  • analyse usage;

  • improve user experience;

  • support marketing activities.

Where required by law, we will seek your consent before using non-essential cookies or similar technologies.

You can manage cookies through your browser settings.

Your use of our websites is also subject to our Website Terms and Conditions.

 

9. Automated decision-making and artificial intelligence

We may use automated processes, including artificial intelligence (AI) and machine learning, in connection with our business activities.

a. Use of automated processes

 

We may use these technologies to:

  • assess applications (e.g. investment, employment, suppliers);

  • support security, fraud detection and risk management;

  • analyse use of our websites, Shopping Centres and services;

  • improve operations, services and customer experience;

  • support marketing and communication activities.

 

b. Personal information used

These processes may involve personal information we collect about you, including:

  • information you provide directly;

  • information generated through your interactions with us; and

  • information obtained from third parties (where permitted by law).

 

c. Decision-making

Automated processes may:

  • assist our personnel in making decisions; or

  • in some cases, be used to make decisions without human involvement.

The level of human involvement will depend on the nature of the decision and the circumstances.

 

d. Potential impacts

Automated decisions or outputs may affect you, for example by:

  • informing whether we provide products or services;

  • contributing to risk or compliance assessments; or

  • influencing communications or marketing.

 

e. Safeguards

We take reasonable steps to ensure that automated processes are used appropriately, including by:

  • monitoring their performance;

  • taking steps to maintain data quality; and

  • applying human oversight where appropriate.

 

f. Further information

You may contact us using the details below if you would like more information about our use of automated decision-making or AI.

 

10. Disclosure of personal information

We may disclose personal information to:

  • service providers (e.g. IT, marketing, legal, accounting, insurers and insurance brokers);

  • investment-related parties (e.g. custodians, trustees);

  • authorised registry provider(s);- advisers, financiers, or referees (where relevant);

  • purchasers of our business or assets;

  • regulators, courts, or law enforcement agencies;

  • other parties authorised by you.

Where practicable, we take reasonable steps to ensure recipients handle personal information appropriately.

 

11. Overseas disclosure

We may disclose personal information to overseas service providers (e.g. cloud storage providers).

Where we do so, we take reasonable steps to ensure compliance with Australian privacy law, unless an exception applies.

 

12. Direct Marketing

We may send you marketing communications where permitted by law.

You may opt out at any time by:

  • using unsubscribe links; or

  • contacting our Privacy Officer.

We will action requests within a reasonable time and at no cost.

 

13. Filming and photography

From time to time, we or our authorised service providers may carry out filming or photography in our Shopping Centres for operational, reporting, marketing, promotional and publicity purposes connected with our centres and business activities. Where practicable, signage or other notice may be displayed in the relevant area to inform visitors that filming or photography is taking place.

If you enter an area where filming or photography is taking place, your image, likeness, voice or other personal information may be incidentally or directly captured in audio, visual or audio‑visual recordings or photographs. By entering such an area, you acknowledge that this collection may occur.

In some cases, including promotions, competitions and community or seasonal events such as Santa photography or Christmas parades, filming or photography may intentionally capture images or recordings of individuals as part of the activity. This may include capturing images of children.

Where an individual, including a child, is featured or identifiable as a primary subject in filming or photography, we will generally seek consent from a parent or legal guardian, which may be obtained through specific consents, entry forms, waivers or similar mechanisms. Where individuals, including children, are only incidentally captured in the background of general photography or filming, this will be managed in accordance with the general terms set out above.

We take reasonable steps, where practicable, to reduce the identification of individuals who appear incidentally in background footage or images. We also take reasonable steps to ensure that images, particularly of children, are used appropriately and in accordance with applicable laws and community expectations.

Recordings and photographs taken by us or on our behalf may be used and disclosed, to the extent permitted by law, for the purposes outlined above.

Any personal information collected through filming or photography will be handled in accordance with this Privacy Policy and applicable law.

Please refer to our Website Terms and Conditions for more information regarding how we:

  • restrict or prohibit filming or photography;

  • require prior approval for commercial or media use.

 

14. Data and retention

We retain personal information only as long as necessary for:

  • the purposes for which it was collected;

  • legal, regulatory and compliance obligations.

Retention periods vary depending on the type of information.

When no longer required, we will take reasonable steps to destroy or de-identify the information.

 

15. Security of personal information

We take reasonable steps to protect personal information from misuse, loss and unauthorised access, modification or disclosure.

If we experience a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner in accordance with the Notifiable Data Breaches scheme.

 

16. Access and correction

You may request access to, or correction of, personal information we hold about you.

We may:

  • require identity verification;

  • charge reasonable administrative fees (for access requests, if permitted).

We may refuse access in limited circumstances permitted by law (e.g. legal proceedings), and will provide reasons where required.

 

17. Anonymity and pseudonymity

Where lawful and practicable, you may interact with us anonymously or using a pseudonym (e.g. general enquiries).

 

18. Complaints

If you have a complaint, please contact our Privacy Officer.

We will:

  • investigate the complaint;

  • respond within a reasonable timeframe (generally within 15 business days).

If unresolved, you may contact the Office of the Australian Information Commissioner (OAIC):

Phone: 1300 363 992

Website: www.oaic.gov.au

 

19. Contact details

 

Privacy Officer

Haben Property Fund Ltd

Level 4, 36 Cross Street

Double Bay NSW 2028

Phone: +61 2 9302 5900

Email: privacy@haben.com.au

 

20. Changes to this policy

We may change this Privacy Policy from time to time.

The updated Privacy Policy will be effective upon publication on our website.

This Privacy Policy was last updated on 25 June 2026.