K2X Auto Pty Ltd - Privacy Policy

K2X Auto Pty Ltd (ABN 64 690 052 834, ACN 690 052 834) ("K2X Auto", "we", "us", "our") provides AI-powered outbound calling and lead-generation services to real estate agencies. We use automated AI technology to make calls on behalf of our agency clients, transcribe those calls, qualify potential leads, and pass qualified leads back to the agency.

We take privacy seriously. This policy explains what personal information we collect, how we collect, use, store, disclose, and protect it, and the rights you have in relation to it.

This policy covers personal information about:

• people we call on behalf of our agency clients (prospective vendors, buyers and other contacts);
• our agency clients and their authorised users who use our platform and dashboard; and
• visitors to our website.

We operate in Australia and New Zealand, and this policy is designed to meet our obligations under the privacy laws of both countries. Where this policy refers to the APPs, the equivalent New Zealand IPPs apply to personal information of New Zealand individuals.

We act on behalf of our agency clients when we make calls, but we also collect, hold and handle personal information in our own right. That means we are responsible for the personal information we hold and have our own obligations under the Privacy Act 1988 (Cth) and the Privacy Act 2020 (NZ), independently of our agency clients, who have their own obligations as well.

Depending on how you interact with us, we may collect:

About people we call on behalf of an agency:

• name;
• phone number;
• residential or property address, suburb, postcode and state;
• email address (where you provide it during a call, or consent to receive marketing);
• your stated property plans, including any intention to buy or sell, timing, and budget;
• preferences and other details you choose to share during the call;
• a transcript of the call generated by our AI technology; and
• call metadata (such as the date, time and outcome of the call).

About our agency clients and platform users:

• name, business name, position, and contact details;
• account login and usage information; and
• billing and payment information.

About website visitors:

• information collected through cookies and analytics tools (see section 13).

Sensitive information. We do not seek to collect sensitive information (such as information about health, or personal circumstances like bereavement, illness or relationship breakdown). However, a person may volunteer such information during a call - for example, when explaining why they are considering selling. Where this occurs, the information may be retained within the call transcript. We do not use it for any purpose other than providing our services, and we apply the same protections described in this policy. We do not knowingly collect personal information from children.

We collect personal information:

• directly from you - for example, when you speak with our AI caller, complete a form on our website, or use our platform;
• from our agency clients - who provide us with contact lists (such as their CRM data or contacts gathered at open homes) so we can make calls on their behalf; and
• automatically - through cookies and similar technologies when you use our website (see section 13).

Where we collect personal information about you from an agency client rather than directly from you, we rely on that client to have a lawful basis to provide it to us. At the start of each call, our AI system notifies the recipient that the call is being recorded and transcribed.

We use personal information to:

• provide our lead-generation and calling services on behalf of our agency clients;
• conduct and transcribe calls using AI technology;
• assess and qualify whether a person may be a potential lead, and schedule appointments between leads and the relevant agency;
• provide qualified leads and related details to the engaging agency;
• monitor, test and improve the quality, accuracy and compliance of our AI technology, including by reviewing call transcripts that may contain personal information;
• operate, secure, administer and bill for our platform;
• send direct marketing where permitted (see section 8); and
• comply with our legal obligations and protect our legal rights.

We will only use personal information for a purpose for which it was collected, a directly related purpose you would reasonably expect, or as otherwise permitted by law or with your consent.

We use AI technology to conduct and transcribe calls, generate summaries of conversations, and classify contacts - for example, whether a person may be a potential lead and how an agency should follow up. This automated processing helps us and our agency clients decide whether and how to pursue a contact as a prospect.

This processing does not make decisions that produce legal or similarly significant effects on you; it informs whether an agency follows up, not any outcome affecting your legal rights or material circumstances. If you would like more information about how our automated processing works, or to discuss a decision that affected you, you can contact us using the details in section 14.

We may disclose personal information to:

• the engaging real estate agency on whose behalf the call was made;
• service providers and sub-processors who help us deliver our services, including providers of speech recognition, language processing, speech synthesis, telephony, and cloud hosting. A current list of our named service providers is available on request;
• professional advisers, and regulators or authorities, where required or permitted by law.

We do not sell personal information, and we do not disclose it for any other organisation's own marketing purposes.

We, or our agency clients, may use personal information to contact you about real estate services. You can opt out of receiving these communications at any time:

• you can tell our AI caller during a call that you do not wish to be contacted again, and we will record and honour that request;
• you can use the unsubscribe facility in any electronic message; or
• you can contact us using the details in section 14.

When you opt out, we suppress your details so you are not contacted again on behalf of that agency, and we keep a minimal record of your request so that the opt-out can be honoured.

Our production platform stores personal information in Australia, using cloud infrastructure hosted in the AWS Sydney (ap-southeast-2) region.

Some of the artificial intelligence technology we use, including for call transcription, summarisation and qualification, is configured to process and store personal information within Australia. Where any of our internal tools or systems are not configured this way, personal information may be processed overseas, as described in section 10.

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification or disclosure, including:

• encryption of data in transit across our systems (TLS);
• role-based access controls, so personal information is accessible only to authorised personnel;
• audit logging of access and system activity;
• network isolation (databases held in private network segments not exposed to the public internet) and secure secrets management.

K2X Auto does not currently hold formal security certifications such as SOC 2 or ISO 27001. We rely on service providers who maintain their own recognised certifications (for example, SOC 2 Type II) and we bind those providers to data protection obligations by contract.

Data breaches. Despite these measures, no system can be guaranteed completely secure. We maintain procedures to detect, assess and respond to data breaches. If a breach occurs that is likely to result in serious harm, we will notify the affected individuals and the relevant regulator - the Office of the Australian Information Commissioner and/or the Office of the New Zealand Privacy Commissioner - in accordance with the notifiable data breach requirements in Australia and New Zealand, and we will take reasonable steps to contain and remediate the breach.

Personal information is principally stored in Australia. However, some of our service providers process personal information overseas - principally in the United States - during the course of a call (for example, speech recognition, language processing and speech synthesis are performed by overseas providers, even where the telephony connection is anchored in Australia).

This also applies to artificial intelligence tools used internally by our staff for tasks such as system development, testing and quality review, which may process personal information overseas where they are not configured to process and store data within Australia.

Before disclosing personal information to an overseas recipient, we take reasonable steps to ensure the recipient handles it consistently with the APPs and, for New Zealand individuals, that the recipient is subject to comparable safeguards as required by IPP 12. We do this principally through contractual data protection terms (including a data processing agreement and standard contractual protections) with those providers.

We keep personal information only for as long as it is needed:

• Contact and call data (including transcripts) collected to provide services to an agency client is retained while that agency remains an active client, and is securely and permanently deleted within 90 days after that client relationship ends.
• Opt-out / do-not-contact records are retained for as long as necessary to honour the request - including the contact's number, name, the relevant agency, and the date and method of the request - so we can continue to suppress contact.
• Records we are required to keep for legal or evidentiary reasons (such as consent records and do-not-call checking records) are retained for the period required by law, generally up to six years.
• Our voice platform provider stores call data for up to 90 days, with key identifiers (such as name, address and email) automatically redacted, after which it is deleted.

When personal information is no longer needed for any lawful purpose, we destroy or de-identify it.

You can ask us for access to the personal information we hold about you, and ask us to correct it if it is inaccurate, out of date, incomplete or misleading. Please contact us using the details in section 14. We may need to verify your identity first. We will respond within a reasonable time. In limited circumstances we may be unable to provide access or make a correction, in which case we will explain why.

Our marketing website is built on a third-party website platform and uses only essential cookies needed for the site to function. Our separate client platform and dashboard use essential cookies and similar technologies to keep signed-in users authenticated. We do not use Google Analytics or any other third-party analytics or advertising tracking on our website or platform. You can disable cookies through your browser settings, although some features may not work as a result.

If your complaint relates to a call we made on behalf of an agency, please raise it with that agency in the first instance. You may also, or alternatively, contact us directly at any time using the details below.

We will investigate your complaint and respond within a reasonable time. If you are not satisfied with our response, you can escalate your complaint to:

• Australia - the Office of the Australian Information Commissioner (OAIC), www.oaic.gov.au; or
• New Zealand - the Office of the Privacy Commissioner, www.privacy.org.nz.

We may update this policy from time to time. The current version will be posted on our website, with the "last updated" date shown above. We encourage you to review it periodically.

For any questions about this policy, or to access or correct your information or make a complaint: