Privacy Policy
1. Purpose of this policy
Alexander & Spencer Partners Pty Ltd ("Alexander Spencer", "we", "us") is trusted with personal information that is often sensitive, including tax file numbers, financial records and identity documents. This policy explains how we collect, use, disclose, store and protect that information, and what rights individuals have in relation to it.
We are bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and this policy serves as the public statement of how we meet those obligations. It reflects the practices and procedures we follow across our Melbourne office, our Cebu team, and the service providers we work with.
2. Scope
This policy applies to all personal information we collect about our clients and their nominated contacts and representatives (including trustees, company directors and officers, officers of co-operatives and associations, client’s spouse and dependents) and to other individuals whose personal information we collect or that our clients, where we provide our clients with recruitment services.
It covers personal information regarding:
Current, prospective and former clients;
People connected to our clients, such as directors, shareholders, partners, trustees, beneficiaries, beneficial owners, family members and authorised representatives;
Other advisers who work with our clients, such as solicitors, financial advisers and mortgage brokers;
Suppliers, service providers and contractors;
Current, prospective and former employees; and
People who attend our events, subscribe to our updates or visit our website.
"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable. It does not include information about corporate entities, although it does include information about sole traders and individuals connected to a business.
Everyone who handles personal information on our behalf, including our staff, our contractors and our service providers, must handle it in a manner consistent with this policy.
3. What information do we collect and why
Type Of Information We Collect
We only collect personal information that is reasonably necessary for our services, our business operations or our legal obligations. Depending on how you interact with us, this may include:
Name, date of birth and contact details;
Identity documents and verification results, such as driver’s licence or passport details;
Tax File Numbers (TFNs) and other government identifiers;
Financial information, such as income, assets, liabilities, investments, superannuation, insurance, bank account details and tax records;
Source of funds and source of wealth information;
Business information, such as roles held, ownership interests and business relationships;
Family and relationship details where they are relevant to the advice or service;
Employment history, qualifications and referee details for job applicants and staff;
Records of our communications with you; and
Information about how you use our website and read our emails.
Sensitive information: Sensitive information includes health information, racial or ethnic origin, religious beliefs, and criminal records. We only collect sensitive information where it is strictly necessary for a service you have requested, with your explicit consent, or where required or authorised by law. For example, we may collect health information if it is directly relevant to a specific tax claim or specialised advisory matter.
Tax file numbers: We collect, use, and disclose Tax File Numbers (TFNs) strictly in accordance with tax law and the Privacy (Tax File Number) Rule 2015. We do not use a TFN as a general or universal identifier for our clients.
Why We Collect Personal Information
We collect personal information to:
Provide our services, including tax, accounting, business advisory, bookkeeping and related professional services;
Verify identity and meet our Anti-Money Laundering obligations;
Lodge returns and deal with the ATO and other regulators on your behalf;
Manage our client relationships, billing and debt recovery;
Meet our professional, audit and quality review obligations;
Recruit and manage our people;
Improve our services, systems and website; and
Tell you about our services, updates and events, subject to section 5 of this policy.
Our Anti-Money Laundering Obligations
As a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) enrolled with AUSTRAC, we are required by law to collect and verify certain information before and while we act for you across all of our services.
To meet these obligations, we may:
Collect and verify identity information for you and for anyone who owns, controls or acts on your behalf;
Ask about the nature and purpose of our work for you, as well as your source of funds and source of wealth;
Screen names against sanctions lists and politically exposed person (PEP) databases;
Use electronic identity verification services to confirm identity documents;
Monitor our dealings with you on an ongoing basis; and
Report certain matters to AUSTRAC.
The law strictly prohibits us from disclosing to anyone (including the client), that a suspicious matter report (SMR) has been or may be made. Consequently, in limited cases, we may not be able to explain a decision or provide access to certain information.
4. How We Collect Personal Information
Wherever we reasonably can, we collect personal information directly from you. This typically occurs through meetings, phone calls, emails, engagement letters, client portals, forms, and document requests. When we collect information, we inform you of what we are collecting and why, usually via our engagement letters or onboarding documentation.
In some circumstances, we may collect personal information from third-party sources where collecting it directly from you is unreasonable or impracticable, or where the law requires us to verify information independently.
These sources include:
The ATO and other government agencies;
Your other professional advisers, your employer or your financial institutions, acting with your authority;
Other associates within your corporate or family group, such as a director providing details regarding a fellow director;
Electronic identity verification and document verification services;
Public registers and records, such as ASIC searches, ABN lookups and property searches;
Sanctions lists and politically exposed person (PEP) screening services; and
Referees nominated by you when applying for a role with us.
Unsolicited Personal Information
If we receive personal information about you that we did not solicit, we will determine whether we could have lawfully collected that information under the Australian Privacy Principles (APP). If we determine that we could not have legally collected it, we will securely destroy or de-identify the information as soon as practicable, provided it is lawful and reasonable to do so.
Website Analytics, Cookies, and Communications Tracking
When you visit our website, we automatically collect standard technical information regarding your visit, such as pages viewed, time spent on site, browser type, referring website, and approximate geographic location. We use this data solely to analyse site traffic, understand how users interact with our platform, and continuously improve our online presence.
Our website utilises cookies to ensure proper technical functionality and enhance your user experience:
Essential Cookies: Necessary for the core operation and security of our website.
Analytics Cookies: Utilised (via tools such as Google Analytics) to help us understand aggregate site usage and performance.
While cookies do not personally identify you on their own, they may do so if combined with other information. You can configure your browser settings to block or delete cookies; however, please note that doing so may impact certain website functionalities. Additionally, our website may contain links to external third-party sites or embedded content for which we are not responsible regarding their independent privacy practices.
For our electronic marketing communications, we may utilise tracking technologies to monitor whether an email has been opened or a specific link has been clicked. This helps us evaluate the relevance and usefulness of our content. You can opt out of this tracking and unsubscribe from our mailing lists at any time by utilising the unsubscribe link provided in our emails or by contacting our Privacy Officer.
5. How We Use and Disclose Personal Information
Use
We use personal information for the primary purposes for which it was collected (as set out in Section 2) and for related purposes you would reasonably expect. We will only use personal information for an unrelated purpose with your consent, or where the law requires or permits it.
Disclosure
We do not sell, rent, or trade personal information. We disclose it only where needed for the purposes outlined in this policy, where you have consented, or where required or authorised by law.
This may include disclosure to:
The ATO, ASIC, AUSTRAC and other government bodies and regulators;
Your other professional advisers, financial institutions and superannuation funds, acting at your direction;
IT, software, cloud storage, document management and identity verification providers;
Professional bodies, insurers, auditors and quality reviewers, for compliance purposes;
Our lawyers and other professional advisers;
Debt collection agencies, where an account remains unpaid;
A purchaser or merger partner, if part of our business is sold or restructured; and
Courts, tribunals and law enforcement agencies, where the law requires it.
We require all third-party service providers to protect personal information and to use it strictly for the services they provide to us.
Overseas Disclosure
Personal information is accessed from outside Australia in two main ways:
Our Philippines Team: Our team in Philippines, works on client files as part of our integrated service delivery. They access information through our Australian-based systems under the exact same policies, confidentiality obligations, and security controls as our Melbourne staff.
Cloud and Software Providers: Certain third-party software and cloud service providers may store or process data outside Australia (typically in locations such as the Philippines, the United States, New Zealand, or Singapore).
Before disclosing personal information overseas, we take reasonable steps to ensure that recipients handle the data in accordance with the Australian Privacy Principles through contracts, access controls, and vendor security assessments. We remain fully accountable for how our overseas recipients handle your information under the Privacy Act.
Automated Decision-making
Some of our processes may utilise computer programs to assist with administrative reviews or verification checks (such as electronic identity verification matching documents against official records). A member of our team always reviews these results before any substantive decision is finalised.
Direct Marketing
We may send you information about our services, updates, newsletters, and events if you are a client who would reasonably expect it, or if you have subscribed or otherwise consented. We send electronic marketing in compliance with the Spam Act 2003 (Cth). Every marketing communication includes a clear unsubscribe link, and you can opt out at any time. We do not use sensitive information for marketing without explicit consent.
6. Information Security and Retention
We hold personal information primarily in electronic form within secure practice management, document management, and cloud systems, with limited physical records maintained in our Melbourne office. We protect this information using robust technical and administrative measures, including role-based access controls, multi-factor authentication, encryption, secure client portals, staff confidentiality deeds, regular privacy training, and physical office security.
We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable laws (such as tax, accounting, and AML/CTF record-keeping obligations, which generally mandate a retention period of five to seven years). When personal information is no longer required, we securely destroy or de-identify it.
Data Breaches
If a data breach occurs and is likely to result in serious harm to the individuals whose information is involved, we will notify those individuals and the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme.
7. Your Rights: Access, Correction and Complaints
Access and Correction
We take reasonable steps to make sure that your personal information is accurate, complete and up-to-date. You may request access to and correction of your personal information by contacting Alexander Spencer office by phone or in writing. We will need to verify your identity to deal with your request and we will endeavour to deal with your request within a reasonable timeframe. In some circumstances we may not be able to give you access to all of the personal information we hold about you, as authorised under the Australian Privacy Principles.
The law may permit or require us to refuse access in certain cases (e.g. where it would compromise another person's privacy, relate to legal proceedings, or breach AML/CTF confidentiality requirements). If we refuse a request, we will provide our reasons in writing, unless it would be unreasonable to do so. If you do not agree with our decision you may ask us to review the decision via our complaint handling procedures which we will explain to you.
Complaints
If you believe we have breached the Australian Privacy Principles, please contact our Privacy Officer in writing. We will acknowledge your complaint as soon as practical after receipt of your complaint, investigate the matter, and provide a formal written response as soon as reasonably practical. We will need to verify your identity, and we may need to ask you for further information.
If you are not satisfied with our response, you can refer your complaint to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
Contact us
For any questions regarding this Privacy Policy, to update your details, or to make a privacy complaint, please contact us at:
Privacy Officer
Alexander Spencer
Suite 1
Level 3, 250 Camberwell Rd
Camberwell VIC 3124
privacy@alexanderspencer.com.au
Ph: +61 3 8199 3000