Tabiya Services Pty Ltd

Privacy Policy

1. About this policy

Tabiya Services Pty Ltd, ABN 33 659 802 089 (“Tabiya”, “we”, “us”, “our”), advises on and facilitates the buying and selling of businesses. We act for business owners preparing for and executing a sale, and we deal with prospective buyers throughout that process.

This policy explains how we collect, hold, use, disclose and protect personal information when you visit www.tabiya.com.au, enquire about a business we are selling, engage us to sell your business, register as a buyer, take part in a transaction, or otherwise deal with us.

Tabiya is a small business operator and is not currently bound by the Privacy Act 1988 (Cth). We have chosen to handle personal information in accordance with the Act and the Australian Privacy Principles (APPs) as a matter of policy, and we will continue to do so if our obligations change. Where they apply, we also meet our obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (the AML/CTF Act).

Selling a business is a confidential process. For most of it, the most sensitive fact we hold is not a name or an address. It is that a particular business is for sale at all. Section 4 sets out how we protect that.

2. Our two sides of a transaction

We collect personal information from, and about, two groups of people, and we handle each differently.

Vendors and their advisers. Business owners who engage us to prepare, market and sell a business, together with their accountants, lawyers, brokers and financiers.

Buyers and enquirers. People who register interest in a business we are selling, sign a confidentiality agreement, receive information, inspect, make an offer or complete a purchase.

We also hold personal information about people connected to a business being sold who are not our clients, including its employees, key customers, suppliers, landlords and guarantors. Section 6 explains how we treat that information, and it is the part of this policy most often overlooked in our industry.

3. Anti-money laundering obligations

From 1 July 2026, assisting in the planning or execution of a transaction to sell, buy or transfer a body corporate or legal arrangement is a designated service under the AML/CTF Act (table 6 of subsection 6(5B)). Much of what we do falls within it.

Where we provide a designated service, we are a reporting entity and we must:

• verify your identity, and the identity of the beneficial owners of any company, trust or partnership involved, before we provide the service
• determine whether you are a politically exposed person, and screen against sanctions lists
• ask about and verify the source of the funds and, in some cases, the source of the wealth used in a transaction
• monitor the transaction on an ongoing basis
• keep records for at least 7 years
• report certain matters to AUSTRAC

What this means for you in practice.

We cannot act for you, release confidential information or complete a transaction until this process is finished. We are required to collect this information by law. You can decline to provide it, but we will not be able to provide the service.

Some of what we must collect is sensitive information under the Privacy Act, including information about political affiliations where we assess politically exposed person status. We collect it because Australian law requires or authorises us to.

We collect the details we need from your identification documents, including your name, date of birth, residential address, the document type and the result of our verification. We do not keep full copies of identification documents any longer than we need to, and we take reasonable steps to destroy or de-identify them once verification is recorded.

Reports to AUSTRAC, and limits on what we can tell you. The AML/CTF Act contains a “tipping off” offence. If we make a report to AUSTRAC, we are prohibited by law from telling you about it. That prohibition also affects your right of access under this policy. If you ask us for access to personal information and giving it to you would breach the tipping off offence, we must refuse. We will notify you in writing that we have refused, but we will not be able to explain why, because the explanation itself would be an offence. A refusal is not an indication that a report has been made.

Our Privacy Act status. Tabiya is a small business operator and is not currently an APP entity under the Privacy Act. Two things follow. Under section 6E of the Privacy Act, if we provide a designated service and become a reporting entity, the small business exemption does not apply to the personal information we handle for the purposes of, or in connection with, our AML/CTF obligations, whatever our turnover. Separately, and by choice, we apply the Australian Privacy Principles across the rest of our business as well, so that you are treated consistently whichever part of our service you deal with.

4. Confidentiality of a sale process

Confidentiality is not a nice-to-have in a business sale. Premature disclosure can cost a vendor their staff, their customers and their price.

Our standard practice is:

• Blind marketing. Businesses are advertised without naming them, using a general description, region and financial summary only.
• Confidentiality agreement first. We do not release the identity of a business, an information memorandum, financial records or any staff, customer or supplier information until a prospective buyer has signed a confidentiality agreement and, where relevant, satisfied us as to their capacity to transact.
• Staged release. More detailed information, including data room access, is released in stages as a buyer progresses and only to the extent needed at each stage.
• Named recipients. Where a buyer wants their advisers to receive information, we ask that those advisers be named and bound by the same confidentiality terms.
• No confirmation to third parties. If an employee, customer, supplier or competitor asks us whether a business is for sale, we neither confirm nor deny it.

Confidentiality agreements are contracts. Breaching one has consequences beyond this policy.

5. What personal information we collect

Identity and contact information. Name, previous names, date of birth, residential and postal address, email address, phone numbers, nationality and residency status where relevant to identity verification.

Verification and financial capacity information. Identification documents and the verification results described in section 3, beneficial ownership and control details for companies, trusts and partnerships, politically exposed person and sanctions screening results, source of funds and source of wealth evidence, proof of funds, finance pre-approval, and information about your capacity to complete a purchase.

Vendor and business information. Business name, structure, ownership and shareholding, trading history, financial statements, tax returns and business activity statements, payroll and staffing information, lease and premises details, plant and equipment registers, contracts, and the reasons for the sale. Reasons for sale sometimes involve personal circumstances such as retirement, illness, relationship breakdown or a dispute between owners. Where that information is sensitive information under the Privacy Act, we collect it only with your consent and only where it is relevant to the engagement.

Buyer profile information. Acquisition criteria, industry preferences, budget, timeframe, relevant experience and qualifications, and your history of enquiries with us.

Transaction information. Offers, negotiations, correspondence, contracts, settlement details, commissions and invoices.

Website and marketing information. IP address, approximate location, device and browser type, pages visited, listings viewed, referring site, and email open and click activity, collected through cookies and similar technologies.

Recruitment information. Applications, CVs, references and assessment results, where you apply to work with us.

You can browse our listings anonymously. Beyond a general enquiry, we need to know who you are, and where the AML/CTF Act applies we are required to verify it.

6. Information about people who are not our clients

A business sale involves personal information about people who never contacted us and never agreed to anything.

Employees of a business being sold. We may receive names, roles, employment terms, remuneration, length of service, leave and entitlement balances, and in some cases performance information, as part of preparing a business for sale and responding to buyer due diligence.

The employee records exemption in the Privacy Act applies to an employer handling records about its own current or former employees. It does not apply to us. We are a third party, so we handle that information under the full Australian Privacy Principles.

Our practice is:

• we ask vendors to provide employee information in de-identified or aggregated form wherever it will do the job, for example roles, hours and total wage cost rather than named individuals
• named and detailed employee information is released only at an advanced stage, to a buyer under a confidentiality agreement, and only where genuinely necessary
• we do not contact a vendor’s employees about a sale unless the vendor has told them
• we return or destroy employee information if a transaction does not proceed

Customers, suppliers, landlords and guarantors. We may receive contact details, contract terms, trading history and, for guarantors, identity and financial information. We treat these the same way: aggregated where possible, named only where necessary, released only under confidentiality.

If you are one of these people and you want to know what we hold about you, section 15 applies to you just as it does to our clients.

7. How we collect personal information

We collect personal information directly from you wherever we can, through our website, listing enquiry forms, buyer registration, confidentiality agreements, email, phone calls and meetings.

We also collect it from:

• vendors, about their business, their employees, their customers and their suppliers
• your accountants, lawyers, brokers, financiers and other advisers, where you have asked them to deal with us
• business-for-sale listing portals and advertising platforms we use
• identity verification, sanctions screening and adverse media services we use for AML/CTF purposes
• public registers and sources, including ASIC, land titles, court records and business directories
• referral sources and publicly available professional profiles such as LinkedIn

If we receive personal information we did not ask for and do not need, we destroy or de-identify it where the law allows.

8. Why we collect, hold, use and disclose personal information

We use personal information to:

• appraise, prepare, market and sell businesses
• assess, qualify and verify prospective buyers
• meet our AML/CTF obligations, as set out in section 3
• negotiate, document and settle transactions
• match registered buyers to businesses that meet their criteria, and send business-for-sale alerts where you have asked for them
• administer our business, including engagements, invoicing, commissions and record keeping
• resolve disputes, and establish or defend legal claims
• meet our legal, regulatory, tax, insurance and professional obligations

If we want to use your personal information for a purpose you would not reasonably expect, we will ask you first, unless the law allows or requires us to proceed without asking.

Direct marketing. Every marketing email includes an unsubscribe link, and you can opt out of buyer alerts at any time by emailing info@tabiya.com.au. We comply with the Spam Act 2003 (Cth). We do not use sensitive information for direct marketing. Opting out of marketing does not stop transactional messages about a deal you are part of.

9. Who we disclose personal information to

We do not sell or rent personal information.

We may disclose personal information to:

• prospective buyers, under a confidentiality agreement and in the staged way described in section 4
• vendors, about prospective buyers, including identity, capacity to complete and offer terms, so that they can assess an offer
• the professional advisers involved in a transaction, including accountants, lawyers, financiers, valuers, insurance brokers and settlement agents
• AUSTRAC, where the AML/CTF Act requires it
• identity verification, sanctions screening and adverse media providers, for AML/CTF purposes
• our service providers, including our website host, CRM, email marketing platform, virtual data room, e-signature provider, cloud storage, accounting platform and IT support
• listing portals and advertising platforms, for marketing a business, on the blind basis described in section 4
• our own professional advisers, including accountants, insurers and lawyers
• law enforcement, regulators, courts and government agencies, where required or authorised by law
• a purchaser or prospective purchaser of our own business, subject to confidentiality obligations

A current list of the categories of provider we use is available on request from our Privacy Officer.

10. Data location and security standards

We keep your information in Australia. The platforms we use to run our business store and process personal information in Australian data centres. Client and transaction information stays onshore, and we do not disclose it to overseas recipients in the ordinary course of our work.

If that ever changes, we will tell you. Before disclosing personal information to an overseas recipient we would take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles, including through our contracts with them, and we would update this policy to name the countries involved.

Three exceptions to be aware of.

• Website analytics. We use Google Analytics on our website, and Google processes that data on servers outside Australia. It covers website usage, not the information you give us in an engagement or a transaction. Section 11 explains how to opt out.
• Sanctions and screening. Sanctions and politically exposed person screening draws on international data sources, so a screening check may involve a provider located outside Australia.
• Where the law requires it. Where a disclosure to an overseas recipient is required or authorised by Australian law, including the AML/CTF Act, the accountability provisions in the Privacy Act may not apply in the same way.

The Essential Eight. Many of the businesses we deal with are assessed against the Australian Signals Directorate’s Essential Eight, and some are required to hold their suppliers to a standard. We have not been independently assessed and we do not claim a maturity level under that model.

What we do have is a set of controls covering the same ground: multi-factor authentication, keeping software and operating systems patched, restricting administrative access, and regular backups. Section 13 sets out the rest. If you need detail for your own supplier assessment, ask us and we will walk you through it.

The ASD is currently evolving the Essential Eight into a broader Essentials series. We will keep pace with that guidance as it is published.

11. Cookies, analytics and tracking

Our website uses cookies and similar technologies to keep the site working, understand how it is used, remember your listing preferences, and measure the performance of our marketing.

We use Google Analytics to understand how our website is used. We do not run advertising pixels or social media tracking tags on our site.

You can refuse or delete cookies through your browser settings, and some parts of the site may not work properly if you do. Where our site presents a cookie banner, your choices there control the non essential cookies we set.

12. Artificial intelligence and automated decision making

This section covers artificial intelligence and automated systems across our business, including in meetings, in preparing a business for sale and in assessing buyers. It is not limited to our website.

We do not use AI tools. We do not use AI assisted tools in our work. Meetings and calls are not recorded or transcribed by AI notetakers. We do not use AI to draft listing material or information memoranda, to summarise your financial documents, or to assess buyers. If that ever changes, we will update this policy and tell you before we start.

We do not put your information into public AI services. Confidential vendor information, buyer identity documents and due diligence material are never entered into public or consumer AI tools.

No automated decision making. No decision that could reasonably be expected to significantly affect your rights or interests is made, or directly supported, by a computer program using your personal information. Buyer qualification, identity verification outcomes, valuation opinions and recommendations to vendors are decisions made by our people. Software may sort, match or flag, but a person decides.

New APP 1.7, inserted by the Privacy and Other Legislation Amendment Act 2024 (Cth), commences on 10 December 2026 and requires this disclosure. If our use of automated decision making changes, we will update this section before that use begins.

13. How we hold and protect personal information

Section 10 sets out where your information is stored and the security standard we work to. This section describes the controls we apply day to day.

We hold personal information in cloud based systems operated by reputable providers, in a virtual data room for transaction material, and in limited physical records.

Our protections include access controls and least privilege access, multi factor authentication on business systems, encryption in transit and at rest through our platform providers, permission controls and access logging in the data room, watermarking of confidential documents where appropriate, confidentiality obligations in our engagement terms and in our contracts with providers, staff training on confidentiality and AML/CTF obligations, and periodic review of who has access to what.

No system is completely secure. We cannot guarantee the security of information transmitted over the internet, and any transmission is at your own risk.

Data breaches. If we suspect a data breach we investigate promptly. If a breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

14. How long we keep personal information

We keep personal information only for as long as we need it, or for as long as the law requires.

Information	Retention
AML/CTF customer due diligence and transaction records	7 years, as required by the AML/CTF Act
Full copies of identification documents	Destroyed or de-identified once verification is recorded, subject to a reasonable transition for legacy records
Completed transaction files	7 years from settlement
Engagements that do not proceed to sale	7 years from the end of the engagement
Buyer enquiries that do not progress	24 months from last contact
Employee, customer and supplier information belonging to a business that did not sell	Returned or destroyed at the end of the process
Financial and tax records	7 years, as required by law
Marketing subscriber records	Until you unsubscribe, then a suppression record only
Unsuccessful job applications	12 months, unless you ask us to keep them longer

When we no longer need personal information we destroy it or de-identify it.

15. Accessing and correcting your personal information

You can ask us for a copy of the personal information we hold about you, and you can ask us to correct it if it is wrong, out of date, incomplete or misleading.

Email our Privacy Officer at info@tabiya.com.au. We may need to verify your identity. We do not charge for making a request, and we will respond within 30 days.

We may refuse access in the limited circumstances the Privacy Act allows, including where giving access would have an unreasonable impact on the privacy of others, would reveal commercially sensitive information about a transaction or another party, would be unlawful, or would breach the tipping off provisions described in section 3. If we refuse, we will tell you in writing and, except where the law prevents us, explain why and how to complain.

You can also ask us to stop sending you marketing at any time, and ask us to delete personal information we no longer need. Where the AML/CTF Act or another law requires us to keep records, we will tell you what we can and cannot delete.

16. Complaints

If you think we have mishandled your personal information or breached the Australian Privacy Principles, tell us first.

We will acknowledge your complaint within 5 business days and give you a written response within 30 days. If we need longer, we will tell you why.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner:

• Online: www.oaic.gov.au/privacy/privacy-complaints
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

17. Other websites

Our website and our listings link to other websites, including business-for-sale portals, our booking tool and our social media profiles. We are not responsible for the privacy practices or content of those sites.

18. Children and young people

Our services are for adults. We do not knowingly collect personal information from anyone under 18. If you believe we have, contact our Privacy Officer and we will delete it.

19. Changes to this policy

We review this policy at least once a year and update it when our practices, our systems or the law change. The current version, with its effective date, is always published at www.tabiya.com.au/privacy-policy.

Where a change is significant, we will tell clients and registered buyers directly rather than relying on the website alone.

20. Contact us

Version

2.0

Effective date

18 August 2026

Last reviewed

18 August 2026

Next scheduled review

18 August 2027

Tabiya Services Pty Ltd | ABN 33 659 802 089  ·  Privacy Policy v2.0