Scope
We are EPIISOD. We provide student accommodation services and related products, including apps and platforms, and we collect your Personal Information in order to provide you with our accommodation services and products, improve these services and products, and manage our internal business operations.

Collection of Personal Information
Personal Information is information or an opinion that identifies you or could reasonably identify you.
We generally collect your:

• name and contact details, including your date of birth and address;
• ID such as your passport or driver's licence;
• student number and details of your school, college or university and course of study;
• details of your next of kin or emergency contacts;
• CV, employment history and education background, if you are a job applicant or staff member;
• information about your use of our websites, applications and services, including cookies, IP addresses and device ID;
• information contained in any communications between us; and
• payment information.

Collection of Sensitive Information
Sometimes we also collect sensitive information from you to provide our products and services to you or for a job application with us. We only collect this information with your consent or as permitted by law.
This information includes health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation or your criminal record (for Australian individuals only).
To comply with the National Higher Education Code to Prevent and Respond to Gender-based Violence, we may also collect demographic information, such as your gender identity, Indigenous status, disability status and language used at home, and information relating to disclosures and reports of gender-based violence.

Parent or guardian consent
If you're the parent or guardian of a tenant/resident with us, you agree that you have the responsibility and legal capacity to consent on behalf of your dependant or child, and that you have read this privacy policy to them and ensured they understand it.

Disclosure
We may disclose your Personal Information to our related entities, joint venture partners, service providers, property operators or managers, business partners, insurers, professional advisors, banks, and relevant government authorities, including the Secretary of the Department of Education (amongst others).

Disclosure overseas
Some of the entities we disclose your Personal Information to are based overseas, such as in the United Kingdom, the United States of America or Singapore. We use arrangements, such as approved contractual clauses, to make sure these entities and service providers have adequate protections in place for your Personal Information.

Your rights and choices
You have the right to:

• request access to the Personal Information we hold about you;
• request correction of the Personal Information we hold about you; and
• withdraw consent to us processing your Personal Information.
• You can contact us to exercise these rights.

Complaints
You have the right to complain to us by contacting our DPO using the contact details below if you think your privacy has been breached or if you have a complaint about how we have handled your Personal Information.
We will acknowledge your complaint within 10 business days and will try to resolve it within 30 days.
If you're not happy with how we've responded to your complaint, you can also complain to the Australian privacy regulator, the Office of the Australian Information Commissioner, by phone on 1300 363 992 or online at [www.oaic.gov.au](https://www.oaic.gov.au).

Contact details
If you would like to contact us with any questions about this privacy policy or make a complaint, please contact our DPO by email at [dpo@epiisod.com](mailto:dpo@epiisod.com) or by phone on +61 (0) 4179 77706.

EU or UK residents or citizens
Our primary obligations are under the Australian privacy law, however, we may collect, use and disclose the Personal Information of EU or UK residents or citizens in providing our products and accommodation services to them.

If you are an EU or UK resident or citizen, we will handle your Personal Information in accordance with the EU GDPR or UK GDPR as applicable to you. This includes additional rights such as the right to be informed, erasure, restriction of processing, data portability, objection, and the right not to be subject to automated decision-making. You can also complain to your local supervisory authority if you are based in the EU, or to the Information Commissioner's Office if you are based in the UK.