Who we are
Pomacs Consortium Pty Ltd (ABN 47 622 478 577), trading as Agentix Consulting, is a Sydney business. We build workflow automation (“rai”) for real estate agencies, and we run this website.
Privacy questions, access requests and complaints go to Will Po, Agentix Consulting, through the contact form.
This policy explains what personal information we collect, why, where it is held, and how to ask about it. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth).
Two situations
You may be reading this as one of two people:
- A visitor to this website.
- A customer, vendor, buyer, tenant or staff member of an agency that uses rai.
Each is covered below.
1. Website visitors
What we collect. This site does not run analytics, advertising or tracking cookies. Our hosting provider records standard server logs (IP address, pages requested, browser type) to serve the site and protect it.
The contact form. If you send us an enquiry, we keep your name, email address, company (if given), the engagement type you chose, your message, the time you sent it, your IP address and browser type. We use these to reply to you and to protect the form from abuse. The enquiry is emailed to us and stored in our database. It is processed and stored on Google Cloud, which may include servers in the United States.
How long. We keep enquiries for two years after our last contact with you, then delete them, unless you become a client.
Marketing. We only send marketing email to people who have asked for it or who we have a business relationship with, and every message carries an unsubscribe link, as the Spam Act 2003 requires.
2. People whose details an agency processes through rai
rai is a workflow service that a real estate agency uses on its own data to check listings, support customer due diligence under anti-money laundering (AML/CTF) law, and prepare vendor reports. The agency decides what rai is used for and remains responsible to you for its own privacy obligations. We process personal information on the agency’s behalf.
What rai reads.On the agency’s instruction, rai reads documents and records that already live in the agency’s systems: its CRM, Microsoft 365 (SharePoint, OneDrive, Outlook), Microsoft Teams, and forms or e-signing tools the agency uses. These can include agency agreements, contracts, trust deeds and company extracts, and the names and contact details in them.
Identity checks and screening.When the agency runs an identity check, it is done by an identity verification provider the agency has chosen and holds its own account with. Your identity documents and photos go to that provider, not to rai. rai receives only the result: whether the check passed, a score, and the provider’s reference number. The same applies to sanctions and politically-exposed-person screening: rai keeps the outcome and the risk rating, not the underlying data.
What rai keeps.
| rai keeps | rai does not keep |
|---|---|
| Pass or fail for each check, with the reasons | Copies of agreements, contracts, trust deeds or company extracts |
| The few facts a decision needs, such as a signed date or an estimated price range | ID images, passport or licence photos, or selfies |
| A short quote supporting a decision, with no personal identifiers in it | ID numbers |
| The identity check result and score, with the provider’s reference | Dates of birth, beyond what a result requires |
| AML screening outcomes and risk ratings | Working copies of documents after a check finishes |
| Every approval: who made it, or which agency policy applied | Personal details in system logs, which are designed to record only IDs, statuses and timings |
When a check finishes, rai deletes the working copy it used. What remains is the result, the approval and a short reference back to the document in the agency’s own system.
Where.rai’s records database is in Google Cloud’s Sydney region. Some supporting services may run in the United States; see Overseas disclosure.
AI processing. Where rai uses AI models to read documents or draft text, we use provider settings under which the provider does not keep the content after the request is processed and does not use it to train models. We name the providers to an agency on request.
How long. rai keeps check results, approvals and screening outcomes for as long as the agency uses rai, because the agency must keep AML due-diligence records for the period the AML/CTF Act requires. When an agency leaves, it receives a full export of its records, and we delete them from rai within 30 days of the end of the agreement.
Who sees it. Only people the agency invites. Each agency sees only its own data. Agentix staff access it only to run and support the service.
Sub-processors, by category.
- Cloud hosting and database: Google Cloud (Australia; some services in the United States).
- AI model providers (United States), on the settings described under AI processing.
- Identity verification and screening: the providers the agency chooses and contracts with directly. Their own privacy policies apply to your identity documents.
- Microsoft 365 and the agency’s CRM: these are the agency’s own systems; rai accesses them with the agency’s consent.
- Billing: Stripe, for the agency’s subscription and invoices. Stripe receives the agency’s business contact and payment details, not customer records.
Automated decision-making
rai assists people; it does not replace them at the points that matter.
- rai performs checks on documents and records (for example, whether a listing price matches the agency agreement, or whether an identity check has passed) and extracts facts needed for a decision.
- Every step that affects a person, such as accepting a customer after due diligence or publishing a listing, passes through an approval gate. Each gate is approved either by a member of the agency’s staff or by a written policy the agency has set for that gate.
- Where an identity check fails, a sanctions or politically-exposed-person screen returns a match, or a matter is rated high risk, a person at the agency makes the decision. rai does not decide these on its own.
- Reports to AUSTRAC are drafted by rai and submitted only by a person.
Kinds of personal information used by rai: names and contact details of parties to a sale or lease; identity check results and scores; sanctions and politically-exposed-person screening outcomes; facts extracted from agency agreements and contracts.
Decisions made solely by a computer program: none, unless an agency has chosen to let a step run under a policy it set, which it can see and change at any time.
Decisions where a program does something substantially and directly related to the decision: customer due-diligence outcomes; listing compliance checks; vendor reports. In each case a person at the agency approves the outcome.
Overseas disclosure
Our main systems are in Australia. Some providers we use process data in the United States:
- Google Cloud services that support this website and rai.
- AI model providers, on the settings described under AI processing.
- Stripe, for billing.
Before we send personal information overseas we take reasonable steps to make sure the recipient handles it in a way consistent with the Australian Privacy Principles.
Security
We keep personal information secure by design: rai does not store identity documents or document bodies; access is limited to the people an agency invites; every approval is logged with the name of the person who made it; system logs are designed to carry IDs, statuses and timings rather than personal details; data for each agency is kept separate. Agentix Consulting holds professional indemnity, public liability and cyber insurance. A security questionnaire and architecture description are available to an agency’s IT team or head office on request, under NDA.
If a data breach is likely to cause serious harm, we will notify the affected people and the Office of the Australian Information Commissioner (OAIC) as the Notifiable Data Breaches scheme requires.
Access, correction and complaints
You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it. Use the contact form. We will respond within 30 days. Where the information is held for an agency, we may need to refer your request to the agency, because it decides what rai is used for and holds the record.
If you are unhappy with how we have handled your personal information, tell us first and we will try to resolve it. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner: www.oaic.gov.au, 1300 363 992.
Changes
We will update this policy when our services or the law change, and show the date of the latest version at the top of the page. A material change for rai agencies is also notified to the agency.
Last updated: 18 October 2026