This policy applies to Lady Abacus (ABN 31 613 188 551), a registered BAS agent practice operating from Level 7, 154 Melbourne St, South Brisbane QLD. It covers this website and every part of our bookkeeping, payroll, BAS and advisory work.

Two different kinds of information

Almost every privacy policy describes one relationship. Ours has to describe two, because bookkeeping involves being given information about people who never contacted us themselves.

  • Your information. What we collect about you when you visit this website, send an enquiry, or engage us as a client.
  • Information we handle for you. When you become a client, we process records containing personal information about other people — your employees, your contractors, your customers and your suppliers. You remain responsible for that information. We handle it on your instructions and only for the work you have engaged us to do.

Where we stand legally

Australian small businesses with an annual turnover of $3 million or less are generally exempt from the Privacy Act 1988 (Cth). We do not rely on that exemption. We handle personal information in line with the Australian Privacy Principles as though the Act applied to us in full.

Some obligations apply to us regardless of our size, and we want to be clear that these are not optional courtesies:

  • The Privacy (Tax File Number) Rule 2015 governs how tax file numbers are collected, used, stored and destroyed. It binds every entity that handles a TFN, whatever its turnover.
  • The Tax Practitioners Board Code of Professional Conductbinds us as a registered BAS agent. Among other things, it prevents us from disclosing anything about a client's affairs to a third party without that client's permission or a legal duty to do so.
  • The Spam Act 2003 governs the marketing emails we send, including our obligation to prove consent and to honour an unsubscribe request promptly.

We are also a member practice of the Institute of Certified Bookkeepers and observe its professional standards.

What we collect through this website

When you send us an enquiry

Our contact and booking forms ask for your name and email address, and depending on the form, your phone number, business name, what you need help with, a preferred time to talk, and whatever you choose to write in the message field. Please don't include tax file numbers, bank account details or other sensitive identifiers in an enquiry form — we will ask for those separately and securely once you are a client.

We also record the IP address the enquiry came from and the date and time it was sent. That is not for tracking you. Because our consent to email you relies on a notice beside the submit button rather than a ticked box, the law puts the burden on us to show when and how that consent was given, and those two details are the evidence.

When you simply browse

We use Google Analytics to understand how the site is used — which pages people read, roughly which city they are in based on their IP address, what device and browser they are on, how they arrived, and what they clicked. This is reported to us in aggregate. We do not use it to identify individuals, and we have configured it not to send personally identifying information to Google.

We also advertise on Google. That involves measuring which advertisements lead to an enquiry, so we can tell which are worth paying for. Our web host, Vercel, additionally keeps standard server logs, which include IP addresses, as a normal part of serving and securing the site.

Cookies, and how to refuse them

The analytics and advertising tools above set cookies in your browser. None of them are necessary for the site to work, and blocking them costs you nothing here. You can clear or block cookies in your browser settings, installGoogle's Analytics opt-out browser add-on, or turn off ad personalisation in yourGoogle account settings.

What we collect and handle as your bookkeeper

Once you engage us, the information involved is considerably broader than anything the website collects. Depending on the services you have asked for, it can include bank and credit card transaction data, invoices, receipts and statements, payroll records, tax file number declarations, superannuation details, employee bank account details, dates of birth, contact details for your customers and suppliers, correspondence with the ATO, and your BAS and GST records.

We collect it from you, from the people you authorise to give it to us, from your accounting software, and where you have authorised us to act, from the ATO.

We use it for one purpose: doing the work you have engaged us to do, and meeting the legal and professional obligations that come with it. We do not use your records, or your employees' or customers' information, for marketing.

Tax file numbers

Tax file numbers get their own mention because they carry their own rules. We collect a TFN only where we are authorised to, use it only for the tax and superannuation purposes it was provided for, never use it as a general reference or identifier for a person, never ask you to send one by ordinary email, and destroy it securely once there is no longer a lawful reason to hold it.

Who else sees your information

We do not sell personal information, and we never will. We share it only in these circumstances:

  • Software we run the practice on. Principally Xero, where your accounts are kept, along with payroll and document storage systems used in the course of the work.
  • Website and email services. Vercel hosts this site. Resend delivers the enquiry to us and the confirmation to you. Mailchimp stores the contact details of people on our email list. Google provides our own business email.
  • Google Analytics and Google Ads, as described above.
  • Government agencies, principally the ATO, where we are lodging on your behalf under your authority, or where the law requires or authorises disclosure.
  • Superannuation funds and clearing houses, where we are processing your super obligations.
  • Your accountant, tax agent or auditor, but only with your authority.
  • Our professional advisers, and our professional indemnity insurer, where a matter genuinely requires it.

Information that leaves Australia

Several of the services above are operated overseas, mostly in the United States. In practical terms, if you send us an enquiry or join our email list, those contact details are stored on servers outside Australia. Before disclosing personal information to an overseas recipient we take reasonable steps to satisfy ourselves that it will be handled to a comparable standard, but you should know that once information is held in another country it is also subject to that country's laws.

Our email list

Sending an enquiry adds you to our email list, which is stated on the form before you send it. You will receive occasional bookkeeping tips and reminders about BAS and other deadlines. It is not frequent and it is not a sales sequence.

Every email carries an unsubscribe link, and you can also simply reply and ask. We will action it immediately. Unsubscribing from the list has no effect on the emails we send you about actual work in progress, and if you have previously unsubscribed, sending a new enquiry will not quietly put you back on the list.

How we keep it safe

We limit access to client information to the people who need it to do the work. We use reputable cloud platforms rather than storing records on local machines, protect accounts with strong and unique credentials and multi-factor authentication wherever a provider supports it, and keep the devices we work on updated and encrypted.

We should be honest about the limits of this. No method of transmitting information over the internet is perfectly secure, and we cannot guarantee absolute security. The most useful thing you can do to help is this: please don't email us tax file numbers, bank account details or passwords. Ordinary email is not a secure channel. Ask us and we will give you a safe way to send them.

How long we keep it

Longer than you might expect, because bookkeeping records are subject to mandatory retention periods rather than our preference:

  • Financial and tax records — at least five years from the date the relevant transaction or lodgement was completed, as required by tax law.
  • Employee and payroll records — at least seven years, as required by the Fair Work Act 2009.
  • Enquiries that don't become engagements — kept while there is a realistic prospect of working together, then deleted.
  • Email list contact details — until you unsubscribe, after which we retain only the minimum needed to make sure we don't email you again by mistake.

When information is no longer needed and no longer required to be kept, we destroy or de-identify it.

Seeing and correcting your information

You can ask us what personal information we hold about you and request a copy, and you can ask us to correct anything inaccurate, incomplete or out of date. Just email hello@ladyabacus.com.au.

We will respond within 30 days and we don't charge for it. We may need to verify your identity first. There are limited situations where we cannot hand something over — for example, where doing so would reveal another person's personal information, or where we are legally required to withhold it — and if that happens we will tell you why in writing.

If we hold information about you because you are an employee or a customer of one of our clients, the right place to start is with that business, since the records are theirs and we act on their instructions. Contact us anyway if that isn't practical and we will help you get to the right person.

If something goes wrong

If a data breach occurs that is likely to result in serious harm, we will notify the people affected and the Office of the Australian Information Commissioner, in line with the Notifiable Data Breaches scheme. We would also tell you what happened and what we were doing about it, because that is the only defensible way to treat someone whose financial information has been exposed.

Complaints

Please raise it with us first — email hello@ladyabacus.com.auor call 0435 839 182. We will acknowledge your complaint promptly, investigate it properly, and give you a written answer.

If you are not satisfied with how we have handled it, you can take a privacy complaint to the Office of the Australian Information Commissioner atoaic.gov.au or on 1300 363 992. A complaint about our conduct as a registered BAS agent can be made to the Tax Practitioners Board attpb.gov.au.

Changes to this policy

We will update this page when our practices or the services we use change, and the date at the top will always tell you when it was last revised. If a change materially affects how we handle information we already hold about you, we will tell you rather than rely on you noticing.

Contact us

Sarah Lane, Lady Abacus
Level 7, 154 Melbourne St, South Brisbane QLD
hello@ladyabacus.com.au
0435 839 182
Mon–Fri, 9am–5pm AEST