Have any other questions? Just give our team a call or send us an email on the details below. 

PO Box 409

Alexandria NSW 2015

Support@theagencyportal.com.au

Version 3: 01 July 2026

1. ABOUT THIS POLICY

This Privacy Policy explains how the Riverstone Partners Operations group (we, us, our, the Group), trading as Riverstone Partners, collects, holds, uses and discloses personal information in connection with the Agency Portal and the products delivered through it: AgencySettlements, Agency AML, Salefunder, CommissionFunder, SupplierPay and AgencySign (together, the Agency Portal Services).

This policy is issued on behalf of:

• Riverstone Partners Operations Pty Ltd (ACN 646 741 826, ABN 76 646 741 826), formerly Salefunder Operations Pty Ltd, the platform operating entity trading as Riverstone Partners;
• Loan Funder Pty Ltd (ACN 605 823 694, ABN 39 605 823 694, Australian Credit Licence 526858, AFCA Member 88204), trading as SaleFunder – the entity through which the Salefunder, Commission Funder and related funding products are provided;
• Agency Settlements Pty Ltd (ACN 686 630 688, ABN 68 686 630 688), a legal practice within the Riverstone Partners group providing property settlement and conveyancing services through the AgencySettlements product; and

together with any related body corporate that operates an Agency Portal product (the Group). Because the Agency Portal Services are delivered as a single integrated platform and personal information is shared across them to provide that integrated service, this policy applies to all six products on a consistent basis rather than product-by-product.

Note on entity names: Loan Funder Pty Ltd is the legal name of the entity that holds ACL 526858 and provides the Salefunder and Commission Funder products. It trades as SaleFunder. To avoid confusion, this policy uses ‘Loan Funder Pty Ltd’ when referring to the credit licensee entity and ‘Salefunder’ when referring to the product.

This policy is written to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), as amended by the Privacy and Other Legislation Amendment Act 2024 (Cth). Personal information held by Agency Settlements Pty Ltd in the course of providing legal services may also be subject to legal professional privilege and the obligations applicable to legal practitioners under the Legal Profession Uniform Law 2014 (NSW), which operate alongside this policy.

1.1 Definitions

• You / Your means our current and future customers, agencies, agents, vendors, buyers and other visitors to or users of our website and the Agency Portal.
• Personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable.
• Sensitive information means a subset of personal information requiring a higher level of protection, including (without limitation) biometric information used for identity verification purposes, information about an individual’s political opinions, religious beliefs, sexual orientation, or criminal record. Where we collect sensitive information (such as biometric data during identity verification), we do so only with your express consent and as described in this policy.

2. WHAT PERSONAL INFORMATION WE COLLECT

Because the Agency Portal Services operate as one connected platform, the categories below can be shared between products as needed to deliver the service – see section 4 for how and why.

2.1  Agencies and agents

• Agency name, business address and ABN/ACN;
• Agent name, email address, phone number and role; and
• Account, billing and product usage information across AgencySettlements, Agency AML, Salefunder, Commission Funder, Supplier Pay and Agency Sign.

2.2  Vendors

• Vendor name, email address and phone number, collected through the agency’s referral into the Agency Portal in connection with a property listing.

2.3  Buyers

Buyer name, email address and phone number, collected once a property is sold.

2.4  Identity and AML verification information

• Information submitted for identity and Know Your Business checks, including name, date of birth, address and identity document details;
• The results of those checks, received from Equifax (IDMatrix) and IDVerse (see section 5); and
• Biometric information collected during facial verification, including a live facial image and biometric face-match data (see section 5 and the separate Biometric Consent Notice).

2.5  Credit information (Loan Funder Pty Ltd trading as SaleFunder)

Information used by Loan Funder Pty Ltd to assess applications for the SaleFunder and AgencySettlements funding products, under its internal credit assessment policy;

• For Commission Funder applications, Loan Funder Pty Ltd may (but will not always) obtain a credit report about an applicant from a credit reporting body; and
• If a customer defaults, Loan Funder Pty Ltd may disclose default information about that customer to a credit reporting body.

Agency AML does not involve any credit file checks. Our handling of credit information and credit eligibility information is set out in more detail in the Loan Funder Pty Ltd (trading as SaleFunder) Credit Reporting Policy, available online or on request from the Privacy Officer.

2.6  Device and location data (identity verification)

When a buyer or vendor completes identity verification through the Agency Portal link, IDVerse automatically collects certain information from their mobile device. This may include:

• General geographic location (city or state level – not precise GPS location);
• IP address;
• Device type and identifier; and
• Connection information.

This data is collection by IDVerse for fraud prevention and security purposes and is governed by IDVerse’s own privacy policy (see section 5). We do not receive or hold this device and location data directly

3. HOW WE COLLECT PERSONAL INFORMATION 

• Directly from agencies and agents when they register for or use an Agency Portal product;
• From agents, on behalf of vendors and buyers, when a property is listed or sold through the Agency Portal;
• From Equifax Pty Ltd (via IDMatrix), as the result of an identity data matching check we request;
• From OCR Labs Pty Ltd (trading as IDVerse), as the result of a biometric liveness and face-match check conducted during identity verification; and
• Automatically, through use of the Agency Portal (for example, log-in and usage data).

For vendors and buyers specifically, information is collected through a direct verification link sent to their mobile phone by their real estate agent – vendors receive this link at the time the agency agreement is signed, and buyers receive it at the time they are required to pay their deposit. At that point, the vendor or buyer submits their personal information (and, if they choose facial verification, their biometric data) directly to Riverstone Partners via Agency AML, not through the agent. This means Riverstone Partners is the direct collector of that information, not merely a recipient of it from the agent.

Where an agent provides us with a vendor’s or buyer’s personal information through the Agency Portal (outside the direct verification link), the agent is responsible for telling that person this policy applies and for obtaining any consents required to do so.

Where it is lawful and practicable to do so, you may interact with us anonymously or using a pseudonym – for example, when browsing our website. This is not availablwhy we e where identity verification is required, including AML/KYC checks or to assess a funding application.

4. WHY WE COLLECT, HOLD, USE AND DISCLOSE PERSONAL INFORMATION 

• To provide, operate and improve the Agency Portal Services, including settlement, AML/KYC, funding, supplier payment and e-signing functions;
• To assist real estate agencies and agents to meet their identity verification obligations as reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (AML/CTF Act) – it is the agent’s agency, not Riverstone Partners, that is the AML/CTF reporting entity. Agency AML is the platform through which that verification is conducted on behalf of the agency;
• To collect express consent from vendors and buyers for the voluntary biometric verification method (liveness check and face match via IDVerse), separately from and in addition to the mandatory identity verification requirement above – see section 5;
• To assess applications for Salefunder, Commission Funder and related funding products;
• To communicate with agencies and agents about their account and the products they use;
• To send direct marketing communications, where permitted (see section 9);
• To meet our own legal, regulatory and contractual obligations, including under the Corporations Act 2001 (Cth) and the National Consumer Credit Protection Act 2009 (Cth); and
• Because the six Agency Portal products operate as a single platform, to share relevant information between products where needed to deliver the service a customer has signed up for (for example, using verified identity information from Agency AML in connection with a Salefunder application).

5. IDENTITY VERIFICATION 

When a vendor or buyer completes identity verification through Agency AML, two separate third-party providers are involved, each performing a distinct function. The verification is conducted on behalf of the real estate agent, who is the AML/CTF reporting entity under the AML/CTF Act 2006 (Cth). Riverstone Partners operates Agency AML as the platform through which the agent’s AML/CTF identity verification obligations are fulfilled. We receive only the result of the checks – not the underlying data submitted to each provider.

5.1  Equifax IDMatrix – identity data matching

Equifax Pty Ltd (ABN 26 000 401 601) operates the IDMatrix platform, which matches identity details (name, date of birth, address, identity document information) against government databases and other authoritative data sources, including the Attorney-General’s Document Verification Service (DVS). We receive the match result from Equifax and retain it for seven years in accordance with the AML/CTF Act record-keeping obligations that apply to agencies as reporting entities, after which it is securely destroyed.

Equifax’s handling of personal information is governed by its privacy policy at equifax.com.au/privacy.

5.2  IDVerse – biometric liveness and face match 

OCR Labs Pty Ltd (ABN 20 603 823 276), trading as IDVerse and operating as part of LexisNexis Risk Solutions, provides the biometric verification component. IDVerse conducts a liveness check (selfie video) and compares the individual’s live facial image to the photo on their identity document. This involves the collection of biometric information, which is sensitive information under the Privacy Act 1988 (Cth).

Biometric verification through IDVerse is not mandatory – it is one method of satisfying the identity verification requirement. Before the link is sent, the agent verbally explains the facial verification process to the vendor or buyer and confirms they are willing to proceed with this method. The vendor or buyer then provides express written consent through the Agency AML Biometric Consent Notice delivered via the verification link. If they prefer not to use facial verification, an alternative method (certified identity documents) is available.

IDVerse stores the biometric information it collects. Our account is configured so that IDVerse deletes biometric data within seven days of the verification being completed. IDVerse does not process Australian users’ data outside Australia.

IDVerse’s handling of personal information, including biometric and device data, is governed by its Australian Privacy Policy, available at risk.lexisnexis.com/idverse-processing-notice

6. HOW WE STORE AND SECURE PERSONAL INFORMATION 

We take steps that are reasonable in the circumstances to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure, in line with APP 11. The results of identity and AML checks are stored within the Agency Portal.

Full detail of our technical and organisational security measures is set out in our internal Cyber Security Policy, available on request to regulators and as required by law.

We retain personal information only for as long as necessary for the purpose for which it was collected, or as required by law. Identity and AML/KYC check results held are retained for seven years from the date of the relevant check, consistent with record-keeping obligations under the AML/CTF Act 2006 (Cth), and are then securely destroyed. This retention period is also reflected in our Cyber Security Policy.

7. WHO WE DISCLOSE PERSONAL INFORMATION TO

• Equifax Pty Ltd (via IDMatrix), for identity data matching against government and other verification sources;
• OCR Labs Pty Ltd (trading as IDVerse, part of LexisNexis Risk Solutions), for biometric liveness and face-match verification, where express consent has been given – IDVerse is provided with the individual’s live facial image and identity document photo for this purpose;
• The Attorney-General’s Document Verification Service (DVS), via IDMatrix, to verify identity document authenticity against issuing authority records;
• Credit reporting bodies and collection agencies, where Loan Funder Pty Ltd obtains a credit report in connection with a Commission Funder application, or discloses default information following a customer default – see section 2.5 and the Loan Funder Pty Ltd (trading as SaleFunder) Credit Reporting Policy;
• Our professional advisers, including lawyers (noting that Agency Settlements Pty Ltd is itself a legal practice and subject to legal professional privilege) and auditors;
• Regulators and government bodies, including ASIC, AUSTRAC, NSW Fair Trading and the Australian Taxation Office, where required by law; and
• A buyer of all or part of our business, subject to confidentiality obligations.

We do not disclose personal information to overseas recipients except as set out in section 8.

8. OVERSEAS DISCLOSURE

We do not disclose personal information to overseas recipients. The Agency Portal is hosted on Australian regions of Amazon Web Services (AWS) and Google Workspace. Equifax IDMatrix processes identity matching data onshore in Australia. IDVerse processes biometric verification data for Australian users within Australia only, and does not transfer that data to Singapore or any other overseas location.

If this position changes in future, we will update this section to name the relevant countries and take the steps required under APP 8 before any overseas transfer occurs.

9. DIRECT MARKETING

We may, from time to time, send marketing communications about our products and services, or those of our Partners, to anyone who has provided us with personal information, across all six Agency Portal products. You may opt out at any time using the unsubscribe link on any marketing email, or by contacting us using the details in section 13.

Please allow us a reasonable period to action your request – unless otherwise required by law, this may take 5 to 10 business days for email or SMS opt-outs, and up to 30 days for other marketing-related requests.

Even after you opt out of marketing, we may still contact you for transactional or service-related purposes – for example, customer service issues, product or payment enquiries, surveys, or questions about a specific transaction.

10. AUTOMATED DECISION-MAKING

From 10 December 2026, this policy must describe any computer programs we use to make decisions, using personal information, that could reasonably be expected to significantly affect an individual’s rights or interests – for example, automated credit decisions.

The assessment of Salefunder loan applications involves human review and is not a fully or substantially automated decision under the amended Act. On that basis, no automated decision-making disclosure is currently required. We’ll revisit this if that process changes, or if the Commission Funder credit checks described in section 2.5 become automated, ahead of the December 2026 deadline.

11. DATA QUALITY

We take reasonable steps to ensure the personal information we collect, use and disclose is accurate, up to date and complete. You can help us by letting your agency contact know if your details change

12. ACCESS, CORRECTION AND COMPLAINTS

You may ask us to access or correct the personal information we hold about you. We will respond within a reasonable period and will not charge you for making a request. We may need to verify your identity before responding. All requests must be in writing and addressed to the Privacy Officer using the details in section 13.

12.1  Step 1: Resolution by us

If you have a complaint about how we have handled your personal information – including a complaint relating to the credit reporting provisions of the Privacy Act or the Privacy (Credit Reporting) Code, if applicable – please contact us using the details in section 13. We will provide written acknowledgement of your complaint within seven (7) days of receipt, investigate, and advise you of the outcome within 30 days of receipt.

12.2  Step 2: Resolution by the OAIC

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:

• Address: GPO Box 5218, Sydney NSW 2001;
• Telephone: 02 9284 9666; and
• Email: enquiries@oaic.gov.au, or visit www.oaic.gov.au.

12. CONTACT US 

If you have any questions about this policy or how we handle personal information, please contact our Privacy Officer:

• Email: support@theagencyportal.com.au; and
• Post: Privacy Officer, PO Box 409, Alexandria NSW 2015

12. CHANGES TO THIS POLICY

We may update this policy from time to time. The current version will always be available on our website, together with the date it was last updated. This policy replaces the previous SaleFunder Privacy Policy (Version 2, June 2023).

Last updated:01 July 2026.

13.  INTERPRETATION

Unless otherwise stated, terms defined in the Privacy Act 1988 (Cth) have the same meaning when used in this policy