Bayleys Privacy Policy

We take our privacy responsibilities very seriously. This privacy policy explains how we collect, store, use, disclose, process and protect your personal information. We are committed to complying with the Privacy Act 2020 and good practice standards.

Please take the time to read this policy and contact us if you have any questions or requests relating to your personal information.

Last reviewed: April 2026

Definitions used in this policy

“Agreement” means an agency agreement or any other agreement that you have entered into with us.

“Bayleys”, “we”, “us” and “our” refers to the Bayleys entity with which you have entered into an Agreement, which has provided you with services (Services) or to whom you have otherwise provided your personal information, being:

• Bayleys Corporation Limited (BCL), or a subsidiary or related company of BCL; or
• a franchisee, licensee or authorised representative of a party listed above.

“Personal information” means information about an identifiable individual, as defined in the Privacy Act.

“Privacy Act” means the Privacy Act 2020 and includes regulations and other instruments under it, and any consolidations, amendments, re-enactments or replacements.

“You”, “your” includes any authorised representative who represents you (such as a solicitor, trustee or director), or where you are the authorised representative, the individual you are representing. If you provide us with personal information about another individual, you confirm that you are authorised to do so and that you have taken reasonable steps to ensure the individual has been informed of the collection and intended use of their information, including where information is collected indirectly (where applicable).

Application of this policy

This privacy policy applies to the collection and handling of your personal information by us and should be read together with the terms of any Agreement you have entered into with us. In the

event of a conflict between this policy and an Agreement, the terms of the Agreement take precedence.

We collect, use, disclose and otherwise handle personal information in accordance with the Privacy Act and this policy. Where we rely on your consent for specific activities (for example, certain marketing preferences or cookies), this will be made clear at the relevant time.

We may update this privacy policy from time to time to reflect changes in law and our business practices.

Why we collect your personal information

We may collect personal information about you (and anyone who represents you) where reasonably necessary for the following purposes:

• providing real estate services, including the sale and purchase of residential, rural and commercial property, recording attendance at properties, interest in listings, facilitating agreements, valuations, itemised chattels, and records of interactions with individuals or properties;
• marketing and promoting current and future properties and services, including advertising, direct marketing, promotions and social media engagement, and maintaining relationships through market information, news and events (you may opt out of marketing communications at any time by using the unsubscribe link included in our messages or by contacting us using the details set out below.);
• conducting market research and surveys where you opt in;
• analysing website usage and sales data to improve our services;
• internal business operations, including training, quality assurance and service improvement;
• complying with legal and regulatory obligations, including under the AML/CFT Act and responding to lawful requests from regulators;
• credit assessment, invoicing and debt recovery; and
• any other lawful purpose connected with our business that we tell you about or you authorise.

If you do not provide personal information that we reasonably require, or if the information provided is incomplete or inaccurate, we may be unable to provide some services or may be limited in how we can assist you.

How we collect your personal information

Direct collection

We collect personal information directly from you and from your authorised representatives when you interact with us, including when you enquire about property, request services, attend open homes or enter into an Agreement.

Indirect collection

From 1 May 2026, if we collect personal information about you from someone other than you (for example, through referrals, third-party platforms, other Bayleys entities, authorised representatives or service providers), we will take reasonable steps to ensure you are informed of:

• the fact that your personal information has been collected and the purpose of collection;
• the source of the information;
• the agencies or categories of agencies who will hold, access or receive the information (unless acting solely as our agent); and
• your rights to access and request correction of your personal information.

Notification will occur before collection or as soon as reasonably practicable after collection, unless an exception under the Privacy Act applies.

As part of delivering our services, we may obtain personal information about you from other people or organisations to meet our obligations under the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 and associated regulations. This may include information from parties involved in a transaction (such as agents, lawyers, or advisers), public registers and other publicly available sources (such as the Companies Office or media reporting), and trusted third parties who assist with identity verification and compliance processes. We use First AML or AML Hub to support these requirements. As part of this, third-party sources and specialist providers (such as identity verification, screening, and secure data storage providers) may be used. Read Privacy Policy | First AML and Privacy Policy | AMLHUB here.

We may provide information to individuals through a combination of this Privacy Policy, website notices, automated or standardised communications (such as responses to enquiries), and direct communications at first contact where required.

Where individuals have already been informed about the collection, source, purpose and use of their personal information in this way, additional notification may not be required, provided the use of the information is consistent with what has been explained and no exception under the Privacy Act applies.

Other sources and verification Where permitted by law, we may also collect personal information from other Bayleys entities, credit reporting agencies, identity verification agencies, and other third parties to fulfil our purposes, including AML/CFT compliance.

Cookies and online technologies We collect information through cookies and similar technologies to assess how our websites are used, personalise your experience and deliver relevant content. You can manage cookies through your browser or settings tools (where available), noting that disabling cookies may affect site functionality.

Email communications If you subscribe to our emails, we may measure engagement with those communications (for example, whether an email is opened or a link is clicked) to help improve the information we provide. You can unsubscribe at any time using the link in our emails or by contacting us using the details below.

Third-party analytics and plug-ins We may use third-party analytics services (such as Google Analytics) and plug-ins or widgets (such as embedded video or social sharing tools). These providers may collect information directly from you via automated means, and their handling of personal information is governed by their own privacy policies.

Advertising and remarketing (where used) We may use cookies or similar technologies, including through third-party service providers, to display Bayleys advertising on other websites and to measure the effectiveness of our campaigns. Where this occurs, those providers may use cookies or device identifiers to show advertising based on visits to our website. You can manage cookie settings through your browser or relevant provider opt-out tools.

Retention and storage of your personal information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and to meet our legal obligations. We use reasonable safeguards to protect personal information against loss, misuse and unauthorised access or disclosure.

Accessing and correcting your personal information

You have the right to access and request correction of your personal information. You may do so by contacting us using the details below. We may charge a reasonable fee for providing access where permitted by law, but we will not charge for requesting corrections.

In some circumstances we may refuse access (for example, where providing access would unreasonably impact the privacy of others). If this occurs, we will explain our reasons.

Deletion of personal information

You may request deletion of your personal information where we are not required to retain it for legal or operational reasons. In some cases, we must retain information to meet our legal obligations (for example, under the Anti-Money Laundering and Countering Financing of Terrorism Act). Requests can be made using the contact details below.

Disclosing personal information

We may disclose personal information (only where necessary and permitted by law) to:

• other Bayleys entities;
• third-party service providers;
• your professional advisers;
• credit reporting agencies;
• debt collection agencies;
• regulators and government agencies where legally required or authorised; and
• other third parties you authorise or that we tell you about.

Agents and independent third parties

Some service providers process personal information solely on our behalf and only on our instructions (for example, IT hosting, secure storage or verification services). Where a provider acts solely as our agent and does not use information for its own purposes, its handling of information is treated as being undertaken by us.

Where personal information is disclosed to a third party for that party’s own independent purposes, that third party may have its own obligations under the Privacy Act and its own privacy policy will apply.

Disclosing personal information outside New Zealand

If required for our purposes, we may transfer personal information outside New Zealand, including where service providers or sub-processors are located offshore. Where this occurs, we take reasonable steps to ensure personal information is protected in a manner consistent with the Privacy Act.

Security

Information transmitted to us online is transmitted at your own risk. While we take reasonable steps to protect personal information, we cannot guarantee the security of information transmitted over the internet.

Links to other websites and apps

Our website may link to third-party websites and apps for your convenience. These operate independently from us and may have their own privacy policies. We are not responsible for the content or privacy practices of external sites.

Complaints

If you believe your privacy has been breached, please contact us so we can investigate and respond in accordance with our complaints handling procedure. If you are not satisfied with our response, you may also make a complaint to the Office of the Privacy Commissioner.

Contact details:

Bayleys Privacy Contact: Duncan Ross

Email: Duncan.ross@bayleys.co.nz

Post: Bayleys House, 30 Gaunt Street, Auckland Central 1010, New Zealand