Privacy Policy

Introduction

We respect and protect your privacy and thank you for visiting our website and reviewing our Privacy Policy.

ASF Audits Pty Ltd (referred to below as we, us, and our) is a privacy conscious organisation.

We have created this Privacy Policy to demonstrate our firm commitment to your privacy.

We deal with Personal Information pursuant to the Privacy Act 1988 (Cth) (the Privacy Act) and the Australian Privacy Principles (the Principles) set out in the Privacy Act.

“Personal Information” means information or an opinion about an identified individual, or an individual who is reasonably identifiable:

whether the information or opinion is true or not; and
whether the information or opinion is recorded in a material form or not.

Personal Information may include “Sensitive Information” being:

information or an opinion about an individual’s:
- racial or ethnic origin;
- political opinions;
- membership of a political association;
- religious beliefs or affiliations;
- philosophical beliefs;
- membership of a professional or trade association;
- membership of a trade union;
- sexual orientation or practices;
- criminal record; or
health information about an individual;
genetic information about an individual that is not otherwise health information;
biometric information that is to be used for the purpose of automated biometric verification or biometric identification; or
biometric templates.

This Privacy Policy sets out our policies in relation to the gathering, management and dissemination of Personal Information.

This Privacy Policy may be supplemented or amended from time to time and may be subject to privacy statements that are specific to certain areas of our website.

By accessing our website, using our mobile applications and/or using our services you agree to be bound by the Privacy Policy that is in effect at the time you access our website and/or use our services.

The Last Revised date of this Privacy Policy will inform you as to whether it has been updated since your last visit.

This Privacy Policy is publicly available via our website or by request.

The kinds of Personal Information that we collect and hold

1. General Personal Information

We may need to collect, hold, use and disclose a range of Personal Information from you to allow us to provide you with relevant services which, dependent on your interaction with us, may include, but is not limited to:

your name and date of birth;
your gender and marital status;
your contact information, including:
1. work, postal and residential address(es);
2. telephone and facsimile number(s); and
3. email address(es);
your financial information, including:
1. bank account and credit card details;
2. income;
3. assets and liabilities;
4. account balances and financial statements;
5. tax statements;
6. employment details; and
7. citizenship and residence status;
records of your communications and other interactions with us;
any content that you provide in connection with the use of our website including, but not limited to, postings on any blogs, forums, wikis and other social media applications and services that we may provide;
data relating to your activity on our website via tracking technologies such as analytic, cookie and session tools, which data can include:
1. the identity of your internet browser;
2. the type of operating system you use;
3. your IP address;
4. the domain name of your internet service provider;
5. the pages accessed on our site; and
6. the next site visited; and
details of any survey responses you provide.

We may use this information for internal purposes including, administering our services, diagnosing problems, generating statistics and trends and improving the quality of our services.

While some of this information may not necessarily be classified as Personal Information in isolation, if it can be linked or matched with other information we collect, it may make you reasonably identifiable. In these instances, the information will be treated as Personal Information.

2. Sensitive Information

We do not usually seek, collect, hold, use or disclose Sensitive Information.

If we require your Sensitive Information, we may collect, hold, use and disclose it as permissible by law including:

for the primary purpose for which it is collected;
for any secondary purpose that should reasonably be expected in connection with the primary purpose; or
for any other purposes for which you have provided consent.

By providing or enabling us to collect Sensitive Information, you consent to our collection, holding, use and disclosure of that information for the purpose of discharging our statutory and other functions.

We will not disclose or use your Sensitive Information for the purpose of Direct Marketing without your consent.

3. Government related identifiers

Other than where permitted by the Principles or any other law, we will not adopt any government related identifier of you as our own identifier, nor will we use or disclose any government related identifier of you.

How we collect and hold Personal Information

4. Direct collection of Personal Information from you

We collect your Personal Information directly from you or someone authorised by you wherever it is reasonable and practical to do so.

This can be:

when we contact you or you contact us;
when we communicate with you including, recording the information you provide via phone calls, interviews and other forms of communication;
when you attend our office;
through applications or other forms that you complete and provide to us including surveys;
when you attend an event we have organised or sponsored;
when you post about us on any blogs, forums, wikis and other social media applications and services;
when you use our website or mobile applications including, through the use of third party analytic, cookie and session tools; and
any other means by which you directly communicate or provide the information to us.

We may utilise outsourced service providers and cloud computing service providers, including:

Offshore service providers located in India or elsewhere (currently Vitae International Accounting Services Pvt Ltd who are situated in Coimbatore, India) to complete initial audit and file preparation;
Amazon Web Services and Microsoft Azure data centre locations in Australia for the storage and accessing of data used in our proprietary in-house software systems; and
other third parties from time to time which will be separately notified to you.

To protect these systems, we implement an Information Security Management System covering:

infrastructure and physical security;
backups;
disaster recovery and business continuity;
access control;
user acceptable use and security incident reporting policies, including regular external vulnerability assessments.

To perform the services, we may provide these third parties with access to your data to the extent this is required to perform the services.

Your data will be stored in servers physically located in Australia (other than information we disclose to analytics and advertising platforms, as described in section 17) and in accordance with the security practices of the third-party service provider and our Privacy Policy.

5. Collection of Personal Information from external sources

Sometimes, we may also collect your Personal Information from external sources where it is unreasonable or impracticable to collect it from you directly. These external sources may include, but are not limited to:

public records or sources of information (e.g. telephone directories, government registers, market research organisations, credit reporting bodies);
- people authorised by you to provide us with your Personal Information (e.g. your lawyer, accountant, SMSF administrator, financial planner, insurance broker, employer); and
- credit providers.

When an external source provides us with your Personal Information, we will attempt to ensure that you and the external source are aware of certain matters including our identity and contact information. If an external source provides us with your Personal Information and we are aware that they have not informed you that they will be doing so, we will notify you of our collection of your Personal Information as soon as practicable after it has been provided to us.

If you are an external source that provides us with Personal Information of a person, by accessing and using our website, you acknowledge and confirm that before providing us with such Personal Information:

you have been authorised by that person to do so; and
- you have informed that person that you will be doing so.

6. Unsolicited Personal Information

If we receive your Personal Information in an unsolicited manner, within a reasonable period after receiving the information, we will determine if we could have collected the information under the Privacy Act and the Principles as if we had solicited the information and:

if we determine we could not have collected your Personal Information and your Personal Information is not contained in a Commonwealth record, we will, as soon as practicable but only if it is lawful and reasonable to do so, destroy your Personal Information or ensure that your Personal Information is de-identified; or
if we determine we could have collected your Personal Information or your Personal Information is contained in a Commonwealth record, we will collect, hold, use and disclose your Personal Information in accordance with this Privacy Policy, the Privacy Act and the Principles.

7. How we hold Personal Information

Your Personal Information will be held in accordance with the storage and security of Personal Information procedures outlined in this Privacy Policy. This can include but is not limited to:

being held as physical records at our premises or off-site; or
being held as electronic records on our servers or on third party servers.

8. Use of artificial intelligence and automated tools

We use our own software, including artificial intelligence tools, to help us deliver our services. These tools may perform tasks such as, but not limited to:

extracting and organising data from fund records;
preparing working papers; and
identifying matters for our auditors to review.

This software processes the fund and Personal Information you or your authorised representatives provide to us. It runs on infrastructure we control, hosted in Australia. We do not provide your Personal Information to external AI providers, and it is not used to train third-party AI models. We may also use this information to improve the accuracy of our own software, which remains within our systems.

Our software uses Personal Information in fund records such as:

trustee and member names and details;
financial statements;
bank statements; and
investment, contribution and benefit payment records.

We use this information to check fund records against the requirements of the Superannuation Industry (Supervision) Act 1993 (Cth) and related regulations, flag possible contraventions and identify audit risks. The results contribute to decisions about whether we qualify an audit opinion and whether we report a contravention to the Australian Taxation Office. These decisions can significantly affect trustees and members.

No decision is made by a computer program alone. Our auditors review the results of the software, and our staff make all audit opinions and decisions about reporting to regulators. If you would like more information about how we use these tools, or about a decision that affects you, please contact our Privacy Officer (see section 29).

9. Automated decision-making

Automated decision-making (ADM) refers to decision-making processes that rely completely or substantially and directly on computer systems. This can include pre-programmed rule-based processes, artificial intelligence and software or applications.

While we utilise software and artificial intelligence to assist us in delivering services, we do not use ADM to completely, or substantially and directly make decisions without human review. Your Personal Information will only be used by our software and artificial intelligence for the purposes outlined in this Privacy Policy.

This section 9 of the Privacy Policy will be updated if ADM is utilised by us at any point.

Purpose for which we collect, hold, use and disclose Personal Information

10. Primary purposes

Understanding and meeting our clients’ SMSF auditing needs is the core component of our business.

The services that we offer to our clients are wide ranging and we need to collect certain Personal Information to provide services effectively to our clients.

We will collect, hold, use and disclose your Personal Information where it is reasonably necessary for primary purposes including, but not limited to:

providing or offering you relevant services;
responding to your requests or inquiries;
establishing, managing and maintaining any relevant services provided to you;
arranging for other related services to be provided or offered to you by third parties;
any other purposes that you may reasonably expect;
any other purposes that have been disclosed to and authorised by you (including, but not limited to, those you consent to below); and
any purpose authorised or required by law, court or tribunal including those required by the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and the Corporations Act 2001 (Cth). These primary purposes may include disclosures to organisations or third parties that handle information on our behalf or provide us with technical/support services and professional advice.

11. Secondary purposes

If we have collected Personal Information (other than a government related identifier) for a primary purpose, we will not use or disclose the Personal Information for another purpose (other than for Direct Marketing) unless:

you have consented to the use or disclosure of the Personal Information; or
you would reasonably expect us to use or disclose the Personal Information for the other purpose and the other purpose is:
- if the information is Sensitive Information—directly related to the primary purpose; or
- if the information is not Sensitive Information—related to the primary purpose; or
- otherwise authorised by law, court or tribunal.

12. Your consent

By providing us with your Personal Information, you acknowledge that we will collect, hold, use and disclose your Personal Information (including holding by, using by and disclosure to any third parties or overseas recipients):

in the manner set out in this Privacy Policy;
for the primary purposes referred to above;
for the secondary purposes referred to above;
for any other purpose(s) specified in this Privacy Policy;
to provide you with news and information about our services or events;
for any purposes necessary or incidental to the provision of our services;
to provide you with the functionality on our website including customising and improving your online experience with us;
to personalise your experience with our services (e.g. via use of blogs, forums, wikis and other social media applications and services);
for internal purposes including, administering our services, diagnosing problems, generating statistics and trends and improving the quality of our services;
to send you marketing and promotional material (including Direct Marketing) that we believe you may be interested in, either from any of our related entities or a third party business which we consider may be of interest to you;
to disclose your contact details (such as your name, email address and employer), in hashed form where the platform supports it, to advertising platforms including Meta (Facebook and Instagram), Google, and LinkedIn so that they can match those details to their users and show you our advertising, as described in section 14 of this Privacy Policy;
to seek your feedback on our services, or for market research purposes;
as part of a corporate transaction such as a sale, divestiture, merger or acquisition; and
for any other purpose required or authorised by law, court or tribunal.

13. Other uses

Your Personal Information may also be used and disclosed to protect our rights or property and that of our users and, where appropriate, to comply with legal processes, which may include disclosures to law enforcement, regulatory or government agencies.

14. Direct Marketing

We may use your Personal Information for Direct Marketing purposes. Direct Marketing can include but is not limited to:

communicating with you directly via post, phone call, text message or email to inform you of new services or events we believe you may be interested in; or
displaying an advertisement on third-party platforms such as Meta (Facebook and Instagram), Google and LinkedIn.

We can only use or disclose Personal Information for the purpose of Direct Marketing if:

we have collected the Personal Information from you;
you would reasonably expect us to use or disclose the Personal Information for this purpose;
we provide a simple way for you to request not to receive Direct Marketing communications from us (‘opting out’); and
you have not made an opt out request to us.

Sensitive Information is not used for Direct Marketing.

You can contact our Privacy Officer at any time using the details in section 29 of this Privacy Policy if you want us to identify the source of Personal Information we use or disclose for Direct Marketing. We will then provide a response within 30 days of your request unless this is impracticable or unreasonable giving consideration to:

possible consequences for you if you are not notified of the source;
length of time that has passed since your Personal Information was collected by us;
whether the source of your Personal Information was recorded (if collected prior to the commencement of the new Privacy Act amendments); and
time and cost involved.

If the burden upon us to provide this information is excessive, we may be unable to supply this information to you.

15. Opting Out of Direct Marketing

If you receive Direct Marketing communications from us and do not wish to continue receiving them, you can ask to be removed from all or some future Direct Marketing programs. You can also request for us to not use or disclose Personal Information to a second organisation for Direct Marketing. You can opt-out of receiving Direct Marketing information from us at any time by:

contacting our Privacy Officer using the contact details in section 29 of this Privacy Policy;
replying ‘STOP’ to a Direct Marketing text message; or
following the ‘Unsubscribe’ link in our emails or text messages.

Once we have received your opt-out request, we will remove you from our Direct Marketing programs within 30 days of your request. You will not be charged for opting out of Direct Marketing (other than any applicable mobile data or postage charges).

Who we disclose Personal Information to and cross border disclosure

16. Who we disclose Personal Information to

We may share your Personal Information with other parties. These parties will vary according to the service involved, but could include:

accountants, SMSF administrators, financial planners, brokers and other parties authorised or accredited by us;
contracted service providers and specialist advisers we engage to provide us with services such as administrative, financial, insurance or research services, some of whom may contact you on our behalf;
courts, tribunals and other dispute resolution bodies during a dispute;
credit reporting or reference agencies or insurance investigators;
anyone authorised by you or to whom you have provided your consent (either expressly or impliedly);
anyone to whom we are required or authorised by law to disclose your Personal Information (e.g. law enforcement agencies and national and international government and regulatory authorities including but not limited to the Australian Taxation Office, the Australian Prudential Regulation Authority, the Australian Securities and Investments Commission and the Australian Transaction Reports and Analysis Centre);
other financial services institutions to detect, investigate or prevent actual or potential fraud in connection with the services we provide to you; and
online platforms, including Meta, Google and LinkedIn, as described in section 14.

17. Whether we disclose Personal Information to overseas recipients

We may disclose Personal Information to entities outside Australia. This disclosure may occur in the following circumstances:

to assist us in providing professional services to you or in the operation of our business, to complete initial audit and file preparation (currently conducted by Vitae International Accounting Services Pvt Ltd who are situated in Coimbatore, India);
web traffic information being disclosed to Google Analytics or other analytics providers when you visit our websites;
for Direct Marketing purposes as outlined in section 14;
for advertising tags and tracking pixels outlined in section 24; and
when communicating with us through social networks such as Meta, LinkedIn, X or YouTube.

Where these entities and third parties are located in other countries, we will take reasonable steps to ensure the overseas recipient complies with the Australian Privacy Principles or is bound by a substantially similar privacy scheme, unless you expressly consent to the overseas disclosure or it is otherwise required or permitted by law.

Notwithstanding any processing that may occur overseas, all data is stored in Australia, other than information that we disclose to analytics and advertising platforms as described in this policy.

These overseas recipients may store Personal Information across multiple countries (it is impracticable to name each one). These entities have their own privacy policies, and we strongly recommend that you review them.

18. Anonymity and pseudonymity

Where possible, if you wish to remain anonymous or to use a pseudonym when interacting with us, we may be able to provide you with limited information or services, such as general details about our services.

However, in many cases it will be impracticable or impossible for us to assist you if you wish to remain anonymous or use a pseudonym.

Our audit services are specific to each fund, and we are required by law to identify the fund, its trustees and the other parties involved in an audit.

Because of this, if you choose not to identify yourself or wish to use a pseudonym, we may be unable to provide you with the specific service you want.

19. Consequences if Personal Information is not provided

It’s your choice whether to provide your Personal Information; however, if you don’t provide all the requested Personal Information, it may not be possible to fulfil your request for a specific service or to complete an audit within the required timeframe.

Storage and security of Personal Information

20. Storage and security of Personal Information

We have in place reasonable commercial standards of technology and operational security to protect all Personal Information provided to us from misuse, interference, loss, unauthorised access, modification or disclosure.

We take steps to protect the security of your Personal Information by:

regularly assessing the risks of misuse, interference, loss, unauthorised access, modification or disclosure; and
taking measures to address those risks.

For further information on the way we manage security risks in relation to your Personal Information please feel free to contact our Privacy Officer.

21. Destruction of records

We may be legally required to maintain some of your Personal Information; however, once we no longer need your Personal Information and are not legally obligated to hold it, we will take such steps as are reasonable in the circumstances to destroy the information or ensure that the information is de-identified.

Privacy and the internet

22. Internet transmission of information

Where appropriate we use secure transmission facilities; however, no transmission of information over the internet can be guaranteed to be completely secure and we do not warrant the security of any information transmitted by or to us over the internet.

Users enter our website at their own risk.

23. Cookies and website analytics

Our website and mobile applications may use a range of tools provided by third parties, including Google, Meta, LinkedIn and our web hosting company to collect or view website traffic information.

These providers have their own privacy policies.

We may also use cookies and session tools to improve and customise your experience when accessing our websites.

‘Cookies’ are small text files that are stored by the browser (e.g. Microsoft Edge, Firefox, Chrome or Safari) on your computer or mobile device.

They allow websites to store such things as user preferences and to help us determine the type of browser and settings you are using, where you have been on the website, when you return to the website, the next page you accessed and where you came from.

The purpose of this information is to provide you with a more relevant and effective experience on our website, including presenting web pages according to your needs or preferences.

Cookies are frequently used on many websites on the internet and you can choose if and how a cookie will be accepted by changing your preferences and options in your browser.

You may not be able to access some parts of our website if you choose to disable the cookie acceptance in your browser, particularly the secure parts of the website.

We therefore recommend you enable cookie acceptance to benefit from all the services on the website.

Website analytics measurement software may also be used to assist in tracking traffic patterns to and from the websites and to understand how visitors use the sites.

The system is used to collect such information as the number of unique visitors, how long these visitors spend on the website when they do visit, and common entry and exit points into and from the website.

This information is collected and aggregated by third-party software and provided to us to assist in our analysis of our websites.

We do not use this information to identify you, except as described in section 24.

24. Advertising tags and tracking pixels

Our website uses the Meta Pixel, Google Tag, and the LinkedIn Insight Tag. These are referred to as advertising tags or tracking pixels and measure how our advertising performs and allow us to show our advertising to people who have visited our website.

These tags and pixels collect information such as pages you view, your IP address, your browser and device details and identifiers stored in cookies, and may send it to Meta, Google and LinkedIn.

Those platforms may link it to other information they hold about you. We only collect the minimum amount of Personal Information necessary in the circumstances, and Sensitive Information is not disclosed.

We do not use these tags on our client portal or on other pages that display client information. We do not send the content you enter into our forms, such as your name or email address, to these platforms through these tags.

In our use of advertising tags and tracking pixels, we comply with the Direct Marketing requirements outlined in section 14 and the obligations required for disclosure to third-party and overseas recipients in section 17.

You can manage cookies through your browser settings. You can opt out of our use of your details for advertising by following the opt out procedure in section 15, and you can opt out of personalised advertising in your account settings on Meta, Google and LinkedIn.

25. Social networking services

We may use social networking services such as Meta, LinkedIn, X and YouTube to communicate with you and the public at large about our work.

When you communicate with us using these services we may collect your Personal Information, but we only use it to help us to communicate with you and the public.

The social networking service will also handle your Personal Information for its own purposes.

These social networking services have their own privacy policies, and we strongly recommend that you review them.

26. Linked websites

Our website may contain links to external third-party websites that we believe may be of relevance or use to you.

This Privacy Policy does not apply to any of these linked websites, and they are not subject to our privacy standards and procedures.

A linked website will contain its own privacy statement, and we strongly recommend that you review it before using the website.

Access to and correction of Personal Information

27. Quality of Personal Information

We will take reasonable steps to ensure that your Personal Information is accurate, complete, up to date and relevant whenever it is collected, used or disclosed.

We rely on the accuracy of the information you, and anyone authorised by you, provide to us.

If you think that we may hold information about you that is incorrect in any way, please contact our Privacy Officer using the details in section 29.

If your Personal Information is found to be inaccurate, not up to date, incomplete, irrelevant or misleading having regard to the purpose for which it is held, we will take reasonable steps to correct your Personal Information.

28. Your access to Personal Information

You may request access to your Personal Information by contacting the Privacy Officer (see section 29).

You are also welcome to contact our Privacy Officer to:

seek more information about anything contained in this Privacy Policy;
request a copy of this Privacy Policy in a different format;
update or correct your Personal Information;
ask about accessing or correcting your Personal Information that we hold;
opt-out of receiving Direct Marketing communications, including use by advertising tags or tracking pixels; or
make a privacy related complaint.

Subject to us being permitted or required by law to withhold your Personal Information, we would be happy to advise you what Personal Information we hold about you.

We will respond to all requests within a reasonable period.

There may be some cost to you to cover the cost of retrieving and processing your Personal Information if it requires a significant amount of time to locate, collect or to present it to you in an appropriate form.

We will let you know in advance if any charges will apply.

The cost will not be excessive and will not apply to the making of the request.

29. Privacy Officer details

If you have any questions, concerns or requests regarding your privacy or your Personal Information or, if you would like to make a complaint, please direct your correspondence or communication to:

The Privacy Officer, GPO Box 1037, ADELAIDE SOUTH AUSTRALIA 5001

Telephone: +61 8 8212 8710. Facsimile: +61 8 8212 8715. Email: privacy@asfaudits.com.au

Complaints

30. Complaint procedure

If you wish to make a complaint to us about how we have handled your Personal Information, please do so in writing addressed to our Privacy Officer using the details in section 29.

If you need help lodging a complaint, please feel free to contact us.

We take all complaints seriously and will respond to your complaint within a reasonable period.

We will determine what (if any) action we should take to resolve the complaint.

If we decide that a complaint should be investigated further, the complaint will usually be handled by a more senior officer than the officer whose actions you are complaining about.

31. Further action you can take

If you believe that we have not adequately handled your complaint you may contact us further to advise of your concerns and, if we are unable to reach a satisfactory resolution, you may contact the Office of the Australian Information Commissioner via their website at https://www.oaic.gov.au/ or via the following contact details:

Office of the Australian Information Commissioner, GPO Box 5218, SYDNEY NEW SOUTH WALES 2001. Telephone: 1300 363 992. Email: enquiries@oaic.gov.au

Additional information

32. Further information

For further information about privacy and the protection of privacy, visit the Office of the Australian Information Commissioner’s website at https://www.oaic.gov.au/.