1. Introduction

1.1 This Privacy Policy explains how Lustia.com.au ("Lustia", "we", "us", "our") collects, uses, stores, and protects personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1.2 This policy applies to your use of the website lustia.com.au and any related services we provide.

1.3 By using lustia.com.au, you agree to the practices described in this policy. If you do not agree, please do not use the website.

2. What Personal Information We Collect

2.1 We collect personal information that is reasonably necessary for our functions and activities. The categories below describe what we may collect.

2.2 Information You Provide Directly

• Name and display name
• Email address
• Phone number
• Suburb and address (where provided for advertising purposes)
• Business and listing details submitted by Advertisers
• Listing descriptions, photographs, and rates
• Payment details processed via our payment provider (we do not store full card numbers)
• Communications you send us, including support enquiries and email correspondence

2.3 Information Collected Automatically

• IP address
• Device type, operating system, and browser information
• Pages visited and time spent on the site
• Referral sources
• Cookies and similar tracking technologies (see Section 7)

2.4 Information from Third Parties

• Information from social media platforms where you choose to log in or share content
• Information from advertising and analytics providers (see Section 7)

2.5 Sensitive Information

2.5.1 We do not knowingly collect sensitive information (as defined in the Privacy Act) unless you voluntarily provide it as part of your listing. Where you do, you consent to its publication on the platform.

3. How We Collect Personal Information

3.1 We collect personal information:

• Directly from you when you register an account, submit a listing, contact us, leave a review, or send a message via the platform
• Automatically through cookies, server logs, and analytics tools when you visit the website
• From third parties where you have consented to them sharing your data with us, or where the third party is permitted to share it under applicable law

3.2 Where it is reasonable and practicable to do so, we collect personal information directly from you.

4. Verification Images

4.1 To maintain platform integrity and reduce fraudulent listings, Advertisers may be required to submit a verification selfie. This typically involves a photograph of the Advertiser holding a handwritten sign displaying "Lustia", the current date, and matching their profile images.

4.2 Verification images are used solely to:

• Confirm the authenticity of the listing
• Confirm the Advertiser is the person depicted in their profile photographs
• Confirm the Advertiser is over 18 years of age where required

4.3 Verification images are not displayed publicly and are accessed only by authorised Lustia staff for the purposes described above.

4.4 Verification images are stored securely (see Section 8) and retained according to the schedule in Section 9.

5. How We Use Personal Information

5.1 We use the personal information we collect for the following purposes:

• Operating, managing, and developing the Lustia platform
• Reviewing, publishing, and moderating Advertiser listings
• Conducting verification and age-assurance checks
• Facilitating communications between Users and Advertisers (including the in-platform messaging system)
• Processing payments and managing subscriptions
• Sending account, billing, and operational notifications
• Sending marketing and promotional communications where you have consented (you may opt out at any time)
• Investigating complaints, resolving disputes, and enforcing our Terms and Conditions
• Improving website performance and user experience
• Preventing fraud, abuse, and unauthorised activity
• Complying with legal obligations, including the Privacy Act 1988 (Cth), the Spam Act 2003 (Cth), and the Online Safety Act 2021 (Cth)

6. Disclosure of Personal Information

6.1 We do not sell personal information to anyone.

6.2 We may disclose personal information in the following circumstances:

6.2.1 Service Providers

To trusted service providers who assist us with operating the platform, including:

• Web hosting and infrastructure providers
• Email and SMS delivery services
• Payment processors
• Analytics and advertising platforms (see Section 7)
• IT support, security, and fraud-prevention services

These providers are contractually required to protect personal information and use it only for the purposes for which it was disclosed.

6.2.2 Legal and Regulatory Requirements

Where required or permitted by law, regulation, or a binding legal request, including:

• Compliance with court orders, subpoenas, or warrants
• Cooperation with law-enforcement investigations
• Reporting to regulatory authorities (including the eSafety Commissioner) where required
• Investigation of suspected fraud, harm, or breach of our Terms

6.2.3 Business Restructuring

In the event of a sale, merger, restructure, or transfer of all or part of our business. In such cases, the recipient will be required to honour the commitments in this Privacy Policy.

6.2.4 Overseas Disclosure

6.3 Some of our service providers (such as Google for analytics, or email-delivery services) may process personal information outside Australia, including in the United States and the European Union. Where this occurs, we take reasonable steps to ensure the recipient handles the information in accordance with the Australian Privacy Principles.

7. Cookies and Website Analytics

7.1 We use cookies and similar tracking technologies to:

• Maintain your logged-in session
• Remember preferences such as favourite advertisers
• Understand how Users interact with the website
• Improve performance and user experience
• Provide relevant advertising content

7.2 We may use third-party tools that collect anonymised information about how visitors interact with the website. These tools may include:

• Google Analytics
• Microsoft Clarity
• Google Search Console
• Meta (Facebook) Pixel, where used for advertising

7.3 You can disable cookies through your browser settings. Disabling cookies may affect some features of the website (for example, you may not stay logged in between visits).

8. Data Storage and Security

8.1 All personal information is stored on secure servers. Where possible, our primary servers are located in Australia.

8.2 We protect personal information using measures including:

• Encrypted connections (HTTPS / TLS) for all data transmission
• Encrypted storage for sensitive data, including verification images
• Restricted access controls — only authorised personnel can access personal information, and only where necessary for their role
• Regular monitoring of systems for vulnerabilities, intrusions, and unauthorised access
• Industry-standard authentication and password requirements

8.3 While we take reasonable steps to protect personal information, no method of internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security.

8.4 If we become aware of a data breach that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.

9. Data Retention

9.1 We retain personal information only for as long as it is reasonably necessary for the purposes outlined in this policy, or as required by law.

9.2 Retention Schedule

• Active accounts: Personal information is retained while the account is active.
• Closed accounts: When an account is closed, verification images and most personal information are retained for 30 days, after which they are permanently deleted unless retention is required by law.
• Listings and reviews: May be retained in anonymised form to maintain the integrity of past communications and reviews on the platform.
• Financial records: Tax invoices and payment records are retained for at least 7 years as required by Australian taxation law.
• Communications: Email correspondence and support tickets are retained for up to 24 months unless legal obligations require longer retention.

9.3 Deletion

Once data is no longer required, we take reasonable steps to securely delete or anonymise it.

10. Your Rights — Access, Correction, and Deletion

10.1 Under the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to:

• Access the personal information we hold about you
• Request correction if your information is inaccurate, out of date, incomplete, irrelevant, or misleading
• Request deletion of your personal information, subject to legal retention requirements
• Withdraw consent for marketing communications at any time
• Lodge a complaint about how we have handled your information (see Section 12)

10.2 To exercise any of these rights, please contact us at [email protected] with sufficient detail to identify yourself and the information you are requesting access to.

10.3 We will respond to requests within a reasonable timeframe, typically within 30 days.

10.4 We may need to verify your identity before responding, to protect your information from unauthorised access. There is no fee for accessing your information, although we may charge a reasonable fee for providing copies of large amounts of information.

11. Links to Third-Party Sites

11.1 The Lustia website may contain links to external websites operated by third parties.

11.2 We are not responsible for the privacy practices or content of those external sites. We encourage you to review the privacy policy of any third-party site before providing any personal information.

12. Privacy Complaints

12.1 If you believe Lustia has breached the Australian Privacy Principles or has otherwise mishandled your personal information, you may submit a complaint by emailing [email protected].

12.2 Please include:

• Your name and contact details
• A description of the complaint
• Any supporting documents or relevant information

12.3 We will investigate your complaint and respond within a reasonable timeframe, generally within 30 days.

12.4 If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

13. Changes to This Privacy Policy

13.1 We may update this Privacy Policy periodically to reflect operational, legal, or regulatory changes.

13.2 Material changes will be communicated to active Advertisers by email and noted on this page.

13.3 Continued use of the website after updates take effect constitutes acceptance of the revised policy.

14. Contact

14.1 For questions about this Privacy Policy, or to exercise any of the rights set out above, please contact:

• Email: [email protected]
• Web: lustia.com.au/contact