iFund Real Estate Privacy Policy
Operated by IFUND TECHNOLOGIES PTY LTD (ACN 699 020 883)
Effective Date:
12 September 2026
Last Updated:
12 September 2026
This Privacy Policy applies to the iFund Real Estate website, applications, platform, communications, integrations and related services. It should be read with the iFund Real Estate Terms and Conditions and any collection notice, consent, cookie notice or feature-specific privacy notice presented to you.
1. About this Privacy Policy
iFund Real Estate ("iFund", "we", "us" or "our") is a business operated by IFUND TECHNOLOGIES PTY LTD (ACN 699 020 883), an Australian proprietary company registered in Queensland, Australia.
iFund operates a technology platform designed to connect property developers, borrowers, capital seekers, lenders, banks, credit unions, brokers, funding specialists, investors, advisers and other commercial participants in relation to real-estate funding opportunities. iFund is a technology marketplace and facilitation platform. Unless expressly agreed otherwise in writing, iFund does not itself provide lending, credit, investment, legal, taxation or financial advice and does not make lending, credit or investment approval decisions for independent Platform participants.
This Policy explains how we may collect, hold, use, disclose, process and protect personal information in connection with the Platform. We intend to comply with privacy and data-protection laws that apply to our activities, including where applicable the Privacy Act 1988 (Cth) and Australian Privacy Principles, the EU General Data Protection Regulation (GDPR), UK GDPR and other applicable laws.
Nothing in this Policy limits, excludes or modifies a right or obligation that cannot lawfully be limited, excluded or modified. Conversely, this Policy is not intended to create contractual warranties, guarantees or obligations beyond those imposed by applicable law or expressly agreed by us in writing.
1.1 Worldwide availability and applicable laws
The Platform is designed to permit participation from users in many countries and jurisdictions worldwide, including by allowing users to select a country or jurisdiction through the Platform. Availability of the Platform in a country, the inclusion of a country in a drop-down list, or a user’s ability to access the Platform from a country does not by itself mean that iFund is established, licensed or regulated in that country, that every feature is offered there, or that every privacy or data-protection law of that country applies to iFund. The laws that apply depend on the relevant facts, including the nature of the processing, the location and activities of the parties, and the territorial scope of the relevant law.
Where a privacy or data-protection law applies to iFund’s processing, we will comply with its mandatory requirements. Where a local law does not apply, this Policy does not voluntarily extend that law, its remedies or its jurisdiction to iFund. We may restrict, modify or discontinue access to particular features, processing activities or jurisdictions where reasonably necessary for legal, regulatory, security or operational reasons.
2. Information We May Collect and Hold
The information we collect and hold depends on how a person interacts with iFund and may include the following categories.
2.1 Account, identity, business and professional information
· name, email address, telephone number and other contact details;
· country, jurisdiction and location information;
· business, employer, company, role and professional information;
· account credentials, identifiers, profile information and profile photographs;
· professional licences, registrations, qualifications, memberships, regulatory status and verification information;
· business-registration details, professional or commercial credentials and information supplied to establish, administer, authenticate or verify an account or profile;
· business contact information obtained in connection with commercial introductions, partnerships, enquiries, referrals, prospective Platform participation or publicly available professional sources.
2.2 Funding, property, project and transaction information
· funding requirements, amounts, purposes, structures and timeframes;
· finance, loan, investment or funding type;
· property, development, project and asset information;
· location, valuation, costs, loan-to-value ratios and other transaction metrics;
· lending, investment, borrower, capital-seeker or provider criteria;
· documents, files, data and supporting materials submitted or made available through the Platform;
· communications, enquiries, expressions of interest and information relating to proposed or potential transactions.
Information submitted through the Platform may include personal, financial, commercial, confidential or third-party information. A person submitting information is responsible for ensuring that they are authorised to provide it and, where required, have given any necessary notice or obtained any necessary consent. Users should avoid uploading information that is not reasonably necessary for the relevant Platform purpose and should redact unnecessary third-party personal information where appropriate.
2.3 Identity documents, government-related identifiers and verification data
Where reasonably required for verification, security, marketplace integrity, fraud prevention or legal compliance, we or a service provider acting for us may collect or review identity documents, business-registration information, professional credentials or government-related identifiers. Where Australian privacy law applies, we will handle government-related identifiers in accordance with applicable legal restrictions and will not adopt such identifiers as our own identifier except where permitted by law.
2.4 Sensitive information
We do not generally require users to provide sensitive information as defined by applicable Australian privacy law. Users should not submit sensitive information unless it is reasonably necessary for a legitimate Platform purpose and they are lawfully entitled to do so. Where we collect sensitive information, we will handle it in accordance with applicable law.
2.5 Payment and subscription information
Where paid services are offered, payments may be processed by third-party payment providers. We may receive transaction identifiers, subscription status, billing status, payment dates and limited payment-related information. We do not ordinarily receive or store complete payment-card details where those details are collected directly by a payment provider.
2.6 Technical, device and usage information
· IP address, device identifiers and approximate location derived from technical information;
· browser, device and operating-system information;
· login, authentication and security information;
· Platform activity, searches, pages, features and interactions;
· timestamps, referral information, logs, diagnostics, errors and performance data;
· cookie, analytics and similar-technology data.
2.7 Communications and information from other sources
We may collect information contained in communications with us or other Platform participants and, where lawful, information from service providers, professional or commercial referral sources, integrated services, APIs, embedded services, business partners, publicly available sources and other persons.
3. How We Collect and Hold Information
We may collect information directly from you, automatically through use of the Platform, from other Platform participants, from third parties acting for or dealing with us, from integrated services or APIs, from referral or commercial partners, and from publicly available or lawfully accessible sources.
Information may be held electronically using our systems and those of contracted technology, cloud, database and infrastructure providers. We may combine, link, index, classify or otherwise process information collected through different interactions where permitted by law and reasonably necessary to operate, secure, improve or provide the Platform.
Where applicable law requires a specific collection notice, we may provide a separate notice at or before the relevant collection, or as soon as practicable afterwards.
4. Purposes of Collection, Use, Holding and Disclosure
Subject to applicable law, we may collect, hold, use, process and disclose personal information for purposes connected with the operation, administration, security, improvement and development of iFund and our business, including to:
· establish, administer, authenticate, verify and manage accounts and profiles;
· operate, maintain, secure, test, troubleshoot, analyse, improve and develop the Platform;
· facilitate introductions, communications and potential transactions among Platform participants;
· search, filter, rank, recommend, compare or match users, opportunities, providers, products, services or criteria;
· process funding requests, enquiries, expressions of interest and Platform activity;
· provide support, notices, administrative communications and service messages;
· process subscriptions, billing and payments;
· perform identity, business, professional, fraud, sanctions, security or other screening where reasonably considered appropriate for verification, security, marketplace integrity or legal compliance;
· prevent, detect, investigate and respond to fraud, misuse, unlawful conduct, suspicious activity, security threats and breaches of our terms;
· perform analytics, research, modelling, product development and business planning, including through aggregated or de-identified information where appropriate;
· comply with legal, regulatory, taxation, accounting, audit and law-enforcement requirements;
· establish, exercise or defend legal rights or claims and preserve evidence relevant to disputes, investigations or enforcement;
· protect our business, systems, property, personnel, users and third parties;
· manage an actual or proposed investment, financing, restructure, merger, acquisition, insolvency, sale or transfer involving all or part of our business or assets;
· carry out another purpose notified at collection, consented to where consent is required, reasonably expected or related where permitted by law, or otherwise authorised or required by law.
5. Matching, Algorithms and AI-Assisted Functionality
The Platform may use software, algorithms, rules, data analysis, machine-assisted processes and artificial-intelligence-assisted technologies to organise, analyse, extract, classify, summarise, search, rank, compare, explain or match information and Platform participants.
This functionality may use information such as jurisdiction, funding type, amount, property or project type, transaction characteristics, profile information, provider criteria, verification information and Platform activity. We may use third-party artificial-intelligence, machine-learning or software service providers to support these functions, subject to contractual, technical and organisational safeguards considered appropriate in the circumstances and applicable law.
Platform matches, rankings, suggestions, summaries, explanations and similar outputs are informational and facilitative only. They do not constitute financial, credit, investment, legal, taxation or other professional advice, do not constitute an endorsement by iFund, and do not guarantee suitability, availability, accuracy, approval, completion or funding.
Unless expressly agreed otherwise in writing, iFund does not make lending, credit or investment approval decisions for independent Platform participants. Independent lenders and other participants remain responsible for their own assessment, verification, due diligence, regulatory obligations and decisions.
Where we use personal information in an automated or computer-assisted process that is subject to specific transparency or rights requirements under applicable law, including requirements relating to decisions that could reasonably be expected to significantly affect an individual's rights or interests, we will provide the information and mechanisms required by that law. Where relevant, this may include information about the kinds of personal information used, the kinds of decisions involved and the role of automated processing.
Users should not include unnecessary sensitive, confidential or third-party personal information in free-text fields or other Platform inputs, including inputs that may be processed using AI-assisted functionality.
6. Verification and Verified Profiles
iFund may offer identity, business, professional, licence, registration or credential verification features and may display a badge, label or other indicator reflecting that certain verification steps have been completed.
Verification may rely on information supplied by the user, public registers, third-party verification services or other sources. Except where required by law or expressly agreed by us in writing, a verification status does not constitute an endorsement, recommendation, guarantee, warranty or certification by iFund of a participant's identity beyond the verification performed, financial capacity, creditworthiness, solvency, current regulatory compliance, conduct, suitability, reliability or ability to complete a transaction.
Verification reflects the information and checks available at a particular time and may become outdated, incomplete or inaccurate. iFund may change, suspend, remove or re-check a verification status where reasonably considered appropriate.
7. Disclosure to Platform Participants and Service Providers
The Platform is designed to facilitate commercial connections. Information may therefore be made available to or disclosed to other Platform participants where relevant to a profile, funding request, match, enquiry, expression of interest or proposed transaction.
Subject to applicable law, we may also disclose or provide access to personal information to:
· borrowers, capital seekers, lenders, banks, credit unions, brokers, funding specialists, investors, advisers and counterparties;
· hosting, cloud, database, software, artificial-intelligence, security, analytics, communications, authentication, identity-verification, payment and other technology or service providers;
· contractors, consultants, professional advisers, insurers and auditors;
· integration partners, API partners, referral partners and operators of embedded or connected services where relevant to the service requested;
· government bodies, regulators, courts, law-enforcement agencies and other persons where disclosure is authorised or required by law;
· actual or prospective investors, financiers, purchasers, successors and their advisers in connection with a corporate or business transaction.
We may maintain an online list or notice identifying material categories of service providers, subprocessors, hosting regions or international processing locations and may update that information from time to time as our technology and operations change.
Independent Platform participants and third-party providers may have their own privacy, confidentiality, regulatory and legal obligations. Where information is lawfully provided to an independent Platform participant, that participant may become independently responsible for its subsequent handling of the information. To the maximum extent permitted by law, iFund does not control and is not responsible for independent processing undertaken by such a participant outside the Platform or outside iFund's instructions. Nothing in this paragraph excludes liability that applicable law imposes on iFund for its own acts or omissions.
iFund does not disclose personal information to third parties in exchange for monetary payment as a standalone data-broker business model. Certain privacy laws use terms such as “sale”, “share” or “targeted advertising” more broadly than ordinary commercial usage. If a law that applies to iFund treats a particular activity as a sale, sharing or targeted advertising activity and requires a notice, opt-out mechanism or other right, we will provide the mechanism required by that law.
8. Global Platform and Overseas Disclosure
iFund is operated from Australia as a global technology marketplace. The Platform may permit users to select or nominate countries and jurisdictions relevant to their funding requirements, lending activities, professional services, matching criteria or proposed transactions. Depending on the feature used and the choices made by a user, personal information may therefore be disclosed to, made available to or accessed by independent Platform participants located in any country or jurisdiction selected, nominated or otherwise involved in that user’s use of the Platform.
Separately, iFund’s technology, cloud, database, communications, analytics, identity-verification, payment, security, artificial-intelligence and other service providers may process, store or access personal information in Australia and overseas. Because our provider arrangements and technical infrastructure may change, we may identify likely overseas recipient countries or regions in this Policy or through a linked and regularly updated International Processing and Service Providers notice. Where Australian privacy law requires likely overseas recipient countries to be specified and it is practicable to do so, we will make that information available in the manner required by law.
Where Australian Privacy Principle 8 applies to a disclosure by iFund to an overseas recipient, we will take such steps as are required by applicable Australian law, subject to any lawful exception. Depending on the circumstances, those steps may include contractual protections, due diligence, security requirements or other reasonable measures. We will not rely on a consent-based exception to APP 8.1 unless the individual has first been expressly informed of the consequences required by law and has then given valid consent. Where the GDPR, UK GDPR or another applicable cross-border transfer regime applies, we may rely on an adequacy decision, standard contractual clauses, the UK International Data Transfer Agreement or Addendum, another approved safeguard, a permitted derogation, or another lawful transfer mechanism.
Privacy, confidentiality, banking, secrecy and information-security laws differ between jurisdictions. An independent Platform participant that receives information may be subject to different laws and may process that information for its own purposes as an independent controller or equivalent responsible entity. Users should consider the recipient’s own privacy practices and legal obligations before providing additional information directly to that recipient. iFund does not represent that privacy protections in every country are equivalent to those in Australia.
9. User Responsibility for Information Submitted
You are responsible for information and materials you submit, upload, transmit or otherwise make available through the Platform. You must not provide information unless you have the lawful right and authority to do so.
If you provide personal information about another person, you are responsible for giving any notice and obtaining any authority or consent required from you by applicable law. You should take reasonable steps to ensure information you provide is accurate, current and not misleading and should not upload unnecessary personal information about third parties.
iFund may undertake verification, moderation or review activities but, except where required by law or expressly agreed by us in writing, is not obliged to independently verify the accuracy, completeness, authenticity or currency of user-supplied information.
10. Processing of Uploaded Documents and Platform Content
To provide the Platform, iFund and its service providers may technically receive, copy, transmit, store, index, extract, classify, convert, analyse, back up, reproduce or otherwise process documents, files, communications and other content submitted to or generated through the Platform, but only for purposes permitted by this Policy, the Terms and Conditions, another applicable notice or agreement, or applicable law.
This Privacy Policy does not transfer ownership of user content to iFund. Any licence or permission required for iFund to host, process, display or transmit user content is governed by the Terms and Conditions or another applicable agreement.
11. Cookies, Analytics and Similar Technologies
We may use cookies, pixels, local storage, software development kits, analytics tools and similar technologies for authentication, security, session management, preferences, measurement, analytics, diagnostics, performance, fraud prevention, product improvement and other Platform functions.
Where applicable law requires consent for particular non-essential technologies, we will seek consent as required. Browser, device or platform controls may allow certain technologies to be restricted, but doing so may affect Platform functionality.
12. Communications and Direct Marketing
Where permitted by applicable law, we may send service, operational, transactional, security, product and marketing communications. Marketing communications may be opted out of using an available unsubscribe mechanism or by contacting us.
Opting out of marketing does not prevent us from sending communications reasonably necessary to administer an account, transaction, security matter or Platform service. We will comply with applicable requirements governing electronic marketing communications.
13. Security
We take reasonable technical and organisational steps, having regard to the circumstances and applicable legal requirements, to protect personal information we hold from misuse, interference, loss and unauthorised access, modification or disclosure. Measures may include access controls, authentication, encryption or secure transmission where appropriate, technical safeguards, monitoring, logging, secure infrastructure, restricted administrative access and vendor-management measures.
No website, application, transmission, network, database, storage system or security measure can be guaranteed to be completely secure. Nothing in this Policy is a representation or warranty that a security incident can never occur.
Users are responsible for protecting their credentials, devices and accounts and should promptly notify us of suspected unauthorised access or misuse.
14. Data Breaches and Security Incidents
We may investigate suspected or actual security incidents and take steps appropriate to the circumstances. Where the Australian Notifiable Data Breaches scheme or another applicable law requires notification of a data breach or security incident, we will make the notifications required by that law.
15. Retention, Destruction and De-identification
We may retain personal information for so long as it is reasonably required for the purposes for which it was collected or for legitimate operational, security, record-keeping, dispute-resolution, fraud-prevention, backup, recovery, enforcement and legal-compliance purposes, subject to applicable law.
Closing or deleting an account does not necessarily result in immediate deletion of every copy of information. Information may remain for a period in backups, archives, transaction records, security records or other systems and may be retained where authorised or required by law.
We may also retain records reasonably necessary to evidence agreements, consents, notices, transactions, communications, complaints, disputes, suspicious activity, fraud-prevention steps, verification activities, regulatory matters or enforcement of rights for applicable limitation or record-retention periods.
When personal information is no longer required for a permitted purpose and applicable law requires destruction or de-identification, we will take reasonable steps to destroy or de-identify it, subject to lawful retention requirements.
16. Access, Correction and Other Privacy Rights
Where applicable privacy law gives you a right to access personal information we hold about you, seek its correction or exercise another privacy right, you may submit a request using the contact details in section 25.
We may require reasonable evidence of identity or authority before processing a request. A request may be refused, limited or subject to conditions in circumstances permitted by law. Where required, we will provide reasons and information about available complaint mechanisms.
Nothing in this Policy grants access, deletion, correction, portability or other rights beyond those provided by applicable law.
Privacy rights are subject to the conditions, exemptions, limitations and verification requirements of the law that grants them. We may decline, restrict, defer or charge for a request where and to the extent permitted by applicable law, including where a request is manifestly unfounded or excessive, conflicts with another person’s rights, would reveal protected confidential information, or where retention is required or permitted by law.
17. Additional Rights for EEA, United Kingdom and Other International Users
Where the GDPR, UK GDPR or another applicable data-protection law applies to particular processing, you may have additional rights, subject to statutory conditions and exceptions. These may include rights of access, rectification, erasure, restriction, objection, portability, withdrawal of consent and rights relating to certain automated decisions.
Where the GDPR or UK GDPR applies, the lawful basis for processing may include performance of a contract, compliance with a legal obligation, legitimate interests, consent, or establishment, exercise or defence of legal claims, depending on the processing activity.
Our legitimate interests may include operating, administering, securing, improving and developing the Platform and business; facilitating commercial connections; verification and marketplace integrity; preventing fraud and misuse; and protecting legal and commercial interests, subject to applicable law and required balancing of interests.
Where applicable law requires us to provide a jurisdiction-specific privacy notice, supplementary information, representative details or additional rights information, we may provide that information through a jurisdiction-specific supplement or other notice. Such a supplement forms part of this Policy for users to whom it applies.
The fact that the Platform is accessible from, or permits selection of, a country does not alone determine whether the GDPR, UK GDPR or another foreign privacy law applies. Where iFund intentionally offers services to individuals in a jurisdiction, monitors behaviour there, establishes operations there, or otherwise meets the territorial scope of an applicable law, we will implement the additional notices, rights processes, contractual safeguards and governance measures required by that law.
Where applicable EU or UK data-protection law requires iFund to appoint a representative, data protection officer or other local privacy contact, the relevant contact details will be published in the applicable jurisdiction-specific supplement or privacy notice. We do not represent that such an appointment is required merely because the Platform can be accessed from that jurisdiction.
18. Controller and Processor Roles
Unless otherwise stated in a written agreement or applicable notice, IFUND TECHNOLOGIES PTY LTD acts as the entity responsible for determining the purposes and means of processing personal information collected for iFund's own Platform and business purposes.
In some enterprise, integration or service arrangements, iFund may process personal information solely on behalf of another organisation under a written agreement. In those circumstances, the respective privacy responsibilities of the parties may be governed by that agreement and applicable law.
19. Third-Party Websites, Services and Independent Participants
The Platform may link to, integrate with or facilitate interaction with third-party websites, applications, APIs, portals, service providers and independent Platform participants. Unless a third party acts as our agent or processor, its handling of information is governed by its own terms, privacy notices and legal obligations.
To the extent permitted by law, iFund is not responsible for the content, availability, acts, omissions or independent privacy practices of third-party websites, services or Platform participants. This does not exclude responsibility that applicable law imposes on iFund for its own selection, instruction or use of a service provider.
20. Children
The Platform is intended for adults and commercial or professional use and is not directed to persons under 18 years of age. Persons under 18 must not create an account or submit funding information through the Platform.
If we become aware that personal information has been collected from a child in circumstances requiring action under applicable law, we will take the action required by that law.
21. Anonymity and Pseudonymity
Where applicable Australian privacy law requires us to provide an option to deal anonymously or by pseudonym, that option will be available to the extent required. Many Platform functions inherently require identification or contact information, including account administration, verification, subscriptions, funding enquiries and participant communications.
22. Corporate Transactions and Successors
Subject to applicable law, personal information may be disclosed, transferred or made available in connection with an actual or proposed investment, financing, merger, acquisition, restructure, insolvency, sale of assets, sale of business or similar corporate transaction. Any successor or transferee will be subject to applicable privacy law in its handling of personal information.
23. Privacy Complaints
If you believe we have breached an applicable privacy obligation, you may make a written complaint using the contact details in section 25. Please identify the privacy issue and provide sufficient information for us to investigate it.
We will acknowledge, investigate and respond to privacy complaints within the period required by applicable law. For complaints governed by the Australian Privacy Act, we should generally be given a reasonable opportunity to respond before a complaint is escalated.
If you are not satisfied with our response and Australian privacy law applies, you may be entitled to complain to the Office of the Australian Information Commissioner (OAIC). Users in other jurisdictions may have a right to contact an applicable supervisory, privacy or data-protection authority.
24. Changes to this Policy
We may amend this Privacy Policy from time to time to reflect changes to the Platform, our business, technology, integrations, service providers, legal requirements or information-handling practices.
The current version will be made available through the Platform and will state its effective or last-updated date. Where applicable law requires additional notice or consent for a material change, we will provide that notice or seek that consent as required.
An updated Policy applies from its stated effective date. Nothing in this section permits us to retrospectively use personal information in a manner prohibited by applicable law.
25. Relationship with Other Terms, Notices and Jurisdiction-Specific Supplements
This Privacy Policy should be read together with the iFund Real Estate Terms and Conditions and any collection notice, consent, cookie notice, service-provider or international-processing notice, product-specific notice, jurisdiction-specific supplement or other privacy information presented when particular information is collected or a particular feature is used.
A Privacy Policy is not a substitute for a collection notice where applicable law requires notice at the point of collection. Jurisdiction-specific supplements may apply only to users or processing activities within the scope stated in the relevant supplement.
If a mandatory provision of applicable law conflicts with this Policy, the mandatory provision prevails to the extent of the conflict. Otherwise, this Policy is to be interpreted so as to preserve its validity and effect to the maximum extent permitted by law.
26. Contact
Privacy Officer
iFund Real Estate
Operated by IFUND TECHNOLOGIES PTY LTD (ACN 699 020 883)
Queensland, Australia
Email: support@ifund.realestate
Privacy access, correction, deletion, rights and complaint requests should include sufficient information to identify the requester and the matter concerned. We may request additional information where reasonably necessary to verify identity, authority or the scope of a request.
Last Updated: 12 September 2026
