PRIVACY POLICY

3. Personal information we may collect

The information required depends on the engagement. We may collect:

• identity and contact information, including name, date of birth, address, citizenship, residency, passport or visa information and authorised representatives;
• government identifiers and taxation information, including TFN, ABN, ATO account, income statement, PAYG, Medicare, study-loan and superannuation information;
• financial information, including bank details, payment records, income, expenses, loans, assets, liabilities, ownership interests and tax payments;
• employment, business, trust, partnership, company and superannuation information;
• property, rental, capital gains, shares, managed funds, employee share schemes, crypto exchanges, wallets, transaction records and blockchain addresses;
• foreign income, foreign tax, travel, accommodation, family, employment and other facts relevant to Australian tax residency or treaty analysis;
• spouse, dependant, family and related-party information relevant to a service;
• health or other sensitive information only where relevant, such as information needed for a Medicare levy exemption or another lawful tax purpose;
• identity-verification, authority, ownership and sanctions information where reasonably required for tax-practice risk management or by law;
• communications, call notes, emails, portal records, signatures, declarations, approvals, complaints and advice
  records;website, device, security, access-log, cookie and analytics information; and
• other information reasonably necessary for an agreed professional service or a legal, professional, security or administrative obligation.

We seek to collect only the information reasonably required for the relevant purpose and ask clients not to provide unnecessary full identity documents, TFNs, health information or third-party information.

Where APP 3 requires consent to collect sensitive information, we seek informed consent unless a permitted general situation or another lawful exception applies. Acceptance of general engagement terms is not treated as blanket consent to collect unrelated sensitive information.

4. Tax file numbers and government identifiers

TFN information is collected, recorded, used and disclosed only where permitted by taxation, personal assistance or superannuation law. We do not use a TFN as our general client identifier. Quoting an individual’s TFN is generally voluntary and it is not an offence to refuse; however, without it we may be unable to identify the correct ATO account, access authorised records, prepare or lodge a return or provide a requested taxation service. When requesting a TFN, we identify the law or taxation-law framework authorising the request, the purpose, the voluntary nature of
quotation and the practical consequences of refusal. 

If a document contains a TFN that is not required for the relevant purpose, the sender should redact it. We restrict access to TFN information, use secure exchange methods, and securely destroy or permanently de-identify TFN information when it is no longer lawfully required or necessary for an authorised purpose.

Other government identifiers are not adopted as our own identifier except where authorised by law or reasonably necessary to verify identity or perform a regulated function.

5. How we collect information

We collect information directly from the individual where reasonable and practicable, including through engagement forms, questionnaires, meetings, telephone, email, secure portals, document uploads, electronic signatures and payment systems.

We may also collect information from an authorised representative, spouse or family member, employer, bookkeeper, lawyer, financial adviser, migration agent, foreign tax adviser, property manager, bank, broker, exchange, wallet record, insurer, valuer, government body, public register, the ATO or another source the client authorises or that law permits.

Where we collect information about a person from someone else, we take reasonable steps to notify the person of relevant collection matters where required, unless an exception applies. Clients must have authority to provide third-party information and should provide only what is relevant.

6. Unsolicited personal information

If we receive personal information we did not request, we assess whether we could lawfully have collected it. If not, and no law requires retention, we will take reasonable steps to destroy or de-identify it. Before destruction, we may retain a minimal record needed to document the decision or meet a legal hold.

7. Why we collect, hold, use and disclose information

We use personal information for purposes including:

• assessing and accepting an engagement, verifying identity and authority, checking conflicts and managing risk;
• preparing and lodging tax returns, activity statements and related documents;
• providing tax advice and preparing calculations, schedules, workpapers and correspondence;
• accessing and communicating with the ATO and other authorities as authorised;
• conducting quality review, supervision, training, risk management, insurance, complaints handling and professional compliance;
• preventing fraud, protecting systems, investigating security events and responding to data breaches;
• complying with taxation, TPB, professional, privacy, TFN, sanctions, court, regulator and other legal obligations;
• engaging and managing approved software, cloud, IT, cybersecurity, payment, document, signature, specialist and professional providers;
• billing, receiving payment, accounting, recordkeeping and administering the practice; and
• sending service communications and, where permitted, relevant marketing or tax updates.

We do not sell client personal information. We do not use client information for an unrelated purpose unless authorised or permitted by law.

8. Privacy Collection Notice

At or before collection, or as soon as practicable afterwards, we provide or make the individual aware of the APP 5 matters relevant to the collection. These include our identity and contact details, the circumstances and purposes of collection, any legal authority, consequences of non-collection, usual disclosures, overseas recipients, and how to access, correct or complain.

A general privacy policy is available continuously, but it does not replace a contextual collection notice. A fresh or supplemental notice may be required where the purpose, source, recipient, overseas location or technology use changes materially.

9. Disclosure to government and professional bodies

We may disclose information to the ATO, TPB, ASIC, ABR, Services Australia, State or Territory revenue authorities,courts, tribunals, law-enforcement bodies or other regulators where authorised by the client or required or permitted by law.

We may disclose information to CPA Australia or another applicable professional body’s quality-review or disciplinary processes, professional indemnity insurers, external quality reviewers, lawyers or other professional advisers where reasonably necessary and subject to an applicable professional duty or right, client authority where required, confidentiality, legal privilege and data-minimisation safeguards.

10. Service providers and professional advisers

We use approved providers for tax software, client portals, cloud storage, email, electronic signatures, practice management, workflow, backup, cybersecurity, IT support, payments, identity verification, document processing and other professional or administrative functions.

The current Technology, Cloud and Provider Schedule supplements this policy and identifies the principal providers used by the firm, their purpose, relevant information categories and likely processing locations. It is supplied or linked where relevant to an engagement and is also available on request. The firm currently uses Seamless as its client portal, Dropbox for document storage, Xero Tax for tax-return preparation, electronic signatures and lodgment, and email for communications.

The approved schedule is incorporated into this policy by reference and is made available with engagement documents or on request. The version supplied or linked must match the schedule actually approved for use.

A provider may act under our control as a contracted processor or may be an independent recipient, depending on the arrangement. We assess this distinction rather than assuming every cloud use is or is not a legal disclosure.

11. Overseas access, storage and disclosure

Some approved providers may store, route, back up, access or support information outside Australia. Based on currently published provider information and subject to the firm’s actual account configurations, likely overseas processing or recipient locations may include New Zealand, the United States, the United Kingdom, Japan and countries in the European Union. Xero states that personal data may be transferred to and processed in Australia, New Zealand and the United States. Dropbox states that storage servers are located across the United States and, for eligible users, may also be available in Australia, the European Union, Japan and the United Kingdom. The current Provider Schedule records known account-specific settings and is updated where reasonably practicable. Where a provider uses numerous or changing countries or subprocessors, the schedule may link to the provider’s controlled country or subprocessor list and record why further country identification is impracticable.

Before a disclosure to an overseas recipient subject to APP 8, we take reasonable steps required in the circumstances to ensure the recipient does not breach the APPs, unless a statutory exception applies. Overseas storage or processing does not necessarily constitute a disclosure for APP 8 purposes; the legal character depends on whether information is made accessible outside the firm and released from its effective control. Safeguards may include enforceable contractual terms, security assessment, access restrictions, audit rights, subprocessor controls, incident notification, return or deletion obligations and review of local legal risk.

Client consent is not used as a blanket substitute for reasonable safeguards. Where informed consent is relied on for an APP 8 exception, the individual will be told the practical consequence, including that the firm may not be accountable under the Privacy Act for the overseas recipient’s conduct in the same way.

12. Overseas contractors and outsourced professional work

The firm does not currently use overseas contractors, offshore employees or external overseas preparers to perform client professional work. This does not mean that every cloud-provider employee, support person or subprocessor is located in Australia; technology-provider access and processing are described in the current Technology, Cloud and Provider Schedule.

Before any future outsourcing of professional work begins, the firm will assess professional confidentiality, APES 305 disclosure, supervision, competence, privacy, cybersecurity, conflicts, data location and client-authorisation requirements.

13. Unlisted technology services

No unlisted general-purpose technology service is authorised to process identifiable client confidential information unless the firm first assesses the provider, plan, purpose, data use, retention, access, security, subprocessors and processing locations and updates the applicable Provider Schedule and client disclosure. Until then, such a service may be used only with public information or material that has been properly de-identified. Any resulting output must be subject to competent human verification before it is used in professional work.

14. Identity, authority and sanctions information

We may collect identity, representative, authority, ownership, transaction and sanctions information where reasonably required to verify the client, prevent fraud, protect the tax system or comply with law and professional obligations.