Privacy policy | FirmGround Advisory

Purpose

We are committed to protecting privacy and confidentiality in accordance with the Australian Privacy Principles (‘APPs’), Privacy Act 1988 (Cth) (‘Privacy Act’) and the Credit Reporting Privacy Code (‘CR Code’). We will not use personal or sensitive information for any purpose other than the one for which it was provided. Exceptions apply where the individual would reasonably expect the use, or where the law allows it. This Privacy Policy describes our current policies and practices for collecting, handling, using and disclosing personal information. It also deals with how to complain about a breach of the privacy laws, how individuals can access the personal information we hold about them and how to have that information corrected.

Scope

This Privacy Policy applies to FirmGround Advisory Pty Ltd and its affiliated entities, who are bound by the Privacy Act 1988 (Cth), the Australian Privacy Principles and the Credit Reporting Privacy Code and will protect the personal information of individuals in accordance with the above.

What is personal information?

Personal information includes any information or opinion about an identified individual or an individual who can be reasonably identified from their information. The information or opinion will still be personal information whether it is true or not and regardless of whether FirmGround Advisory has kept a record of it.

We may collect personal information about the following individuals:

Clients including but not limited to Natural persons, Sole traders, Partnerships, Companies, Trusts, Trustees, and Self-Managed Superannuation Funds.
Prospective clients;
Service providers or suppliers;
Prospective employees, employees and contractors; and
Other third parties with whom we come into contact.

The above listed are referred to as ‘individuals’ in this policy.

We collect, use and disclose personal information as this Privacy Policy describes. We collect sensitive information only with the individual’s consent, unless the law allows otherwise. Where we need consent, we will ask for it clearly. An individual may withdraw consent at any time by contacting us.

The information that FirmGround Advisory seeks to collect will depend on the products or services that it recommends or provides. If an individual does not allow FirmGround Advisory to collect all of the information requested, FirmGround Advisory may not be able to deliver all of those services effectively.

If FirmGround Advisory receives personal information that it did not ask for, it will decide whether it could have collected that information under the Privacy Act. If it could not have, FirmGround Advisory will destroy or de-identify the information as soon as practicable, where it is lawful and reasonable to do so.

What kind of personal information does FirmGround Advisory collect and hold?

FirmGround Advisory collects personal information only when it is reasonably necessary for one or more of our functions or activities. Where practicable, we collect it directly from the individual. We also collect it from third parties, as this policy describes, where the individual has authorised this or the law allows it.

FirmGround Advisory may ask for various kinds of personal information to the extent this information is necessary for us to carry out the activities involved in providing you with products, services and information. The kinds of personal information include, but is not limited to:

Identification information, including but not limited to, name, address, contact details (including phone number, email address and other digital addresses and accounts), date of birth, tax file number, as well as information to verify an individual’s identity such as driver’s licence, birth certificate, or passport details;
Financial information, including but not limited to, an individual’s assets, liabilities, income, expenses, bank and direct debit details, superannuation and insurance details, and other financial details;
Employment information, including but not limited to, ABN/ACN, occupation, salary, hours of work, employment history dates records;
Screening checks (including but not limited to police, working with children, bankruptcy), reference checks, and other associated insights;
Transactional information of an individual’s dealings with us, including in relation to our products and services, and records of queries or complaints an individual makes;
Insights, responses to surveys such as experiences and information about your activities, interest, and attitudes/views or other feedback expressed;
An individual’s device information such as device ID, geo-location, computer and connection information, statistics on page views, traffic to and from our websites, advertisement data, IP address and standard web log information; and
Any other personal information that may be required in order to facilitate an individual’s dealings with us.

We will not adopt a government-assigned identifier, such as a tax file number, Medicare number or provider number, as our own identifier of an individual. We will use and disclose tax file numbers only as the law allows, including under the Privacy (Tax File Number) Rule 2015 and the tax laws.

The collection of sensitive information is restricted by the Privacy Act. This includes information about religion, racial or ethnic origin, political opinions, criminal record, and sexual orientation. It also includes health information and biometric information. Generally, FirmGround Advisory only collects this sort of information if it is necessary to provide a specific product or service and the individual has consented to that collection. For example, we may collect criminal record information when we screen prospective employees.

What if an individual chooses not to provide some information?

FirmGround Advisory may be unable to provide its services if it does not have all the relevant information it requires to deliver such services.

Where it is lawful and practical, an individual may deal with us anonymously or by using a pseudonym. This will usually not be possible when we provide accounting, tax, advisory or superannuation services, because we must verify identity.

For what purposes does FirmGround Advisory collect, hold, use and disclose personal information?

FirmGround Advisory collects, uses, holds and discloses personal information to facilitate the provision of its service offerings, interactions with individuals, and otherwise as required in the running of the FirmGround Advisory’s business. This includes, but is not limited to:

Checking whether an individual is eligible for the product or service;
Providing the product or service;
Helping to manage or improve the product or service;
Complying with relevant laws, regulations and other legal obligations;
Preventing fraud, crime or other activity that may cause harm in relation to its products or services;
Assessing your prospective and ongoing suitability for employment or working arrangements with FirmGround Advisory, including conducting screening (including but not limited to police, working with children, bankruptcy) checks, reference checks, and other associated insights;
Conducting testing, surveys, research, insights and analytics (including through our third-party service providers);
Understanding and meeting your needs, including tailoring the content of our websites, emails, apps and social platforms to your preferences;
Conducting marketing activities in relation to our business, products, and service; and
Using software and AI tools to deliver and manage our services, and to assess anti-money laundering and know-your-client risk; and
As otherwise required in the running of FirmGround Advisory’s business.

What service offerings does FirmGround Advisory provide?

FirmGround Advisory understands the importance of a holistic service offering, whereby its clients can see their goals, needs and expectations being met. This approach encompasses providing products and services in relation to:

Business advisory and virtual CFO services
Forecasting, budgeting and planning
Tax planning, advice and compliance
Accounting and financial statements
Bookkeeping, BAS, payroll and payroll tax
Self-managed superannuation fund accounting and administration
Business structure, succession, estate planning (with your solicitor) and exit advice

How does FirmGround Advisory collect personal information?

FirmGround Advisory collects most of the personal information directly from the individual. This can be done electronically. (see section "Does FirmGround Advisory collect personal information electronically?" of this policy for more information).

FirmGround Advisory also collects personal information about an individual from third party organisations. This may happen without the individual’s direct involvement. For instance, FirmGround Advisory will collect personal information about an individual from:

Publicly available sources of information;
The individual’s external representatives (including legal adviser, mortgage broker, executor, administrator, guardian, trustee, accountant or attorney);
the individual’s other FirmGround Advisory representatives (including Accountant, or business advisory adviser);
The individual’s employer;
Other organisations, who jointly with FirmGround Advisory, provide products or services to the individual;
Commercial information service providers, such as companies that provide fraud prevention reports;
Third party information aggregators, and insight and analytics providers; and
Third parties providing screening (including but not limited to police, working with children, bankruptcy) checks, references, insights and other employment information in relation to prospective employees, employees, and consultants.

What laws require or authorise FirmGround Advisory to collect personal information?

FirmGround Advisory is required or authorised to collect:

Certain identification information about an individual by the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) and Anti-Money Laundering and Counter-Terrorism Financing Rules Instrument 2007 (No. 1);
An individual’s Tax File Number, if they choose to provide it, by the Income Tax Assessment Act 1936 (Cth); and
Information we must keep or report under the laws that apply to our services, including the Tax Agent Services Act 2009 (Cth) and the Superannuation Industry (Supervision) Act 1993 (Cth).

How does FirmGround Advisory hold personal information?

FirmGround Advisory strives to maintain the relevance, reliability, accuracy, completeness and currency of the personal information we hold and to protect its privacy and security. Much of the information FirmGround Advisory holds about an individual will be stored electronically in secure data centres, which are primarily located in Australia, and owned by external service providers. Some service providers, including providers of cloud software and AI tools, store or process information outside Australia. See the section on overseas disclosure below. Some information FirmGround Advisory holds about an individual could be stored in paper files and these files could be held in secure offsite storage.

FirmGround Advisory use a range of physical and electronic security measures to protect the security of the personal information they hold. For example:

Access to information systems is controlled through identity and access management;
Employees are bound by policies and procedures that require them to handle information in a secure manner; and
Regular monitoring and review their compliance with internal policies and industry best practice.

FirmGround Advisory takes reasonable steps to manage data destruction either physical or digital. These extend to our third parties who manage and hold our data.

Who does FirmGround Advisory disclose personal information to, and why?

FirmGround Advisory may provide personal information about individuals to external organisations. To protect personal information, FirmGround Advisory enter into contracts with their service providers that require them to handle personal information in a secure manner. These contracts oblige them to only use the personal information FirmGround Advisory disclose to them for the specific role they ask them to perform.

Generally, FirmGround Advisory disclose personal information to organisations that help them with their business. These may include:

FirmGround Advisory personnel, and related bodies corporate;
FirmGround Advisory agents, contractors, third party suppliers, and external service providers (for example, mailing houses, technology service providers, analytics and insight providers);
Payment systems operators (for example, merchants receiving card payments);
Other organisations, who jointly with FirmGround Advisory, provide products or services to the individual;
Financial services organisations, including banks, superannuation funds, stockbrokers, custodians, fund managers and portfolio service providers;
Debt collectors;
FirmGround Advisory professional advisers, dealers, and agents;
An individual’s representatives (including their legal adviser, accountant, mortgage broker, executor, administrator, guardian, trustee, or attorney), or any other third parties authorised by an individual to receive personal information;
Fraud bureaus or other organisations to identify, investigate or prevent fraud or other misconduct;
HR advisors, including third parties used to provide candidate and employee screening checks, references, and insights;
External dispute resolution schemes;
Regulatory bodies, government agencies and law enforcement bodies in any jurisdiction;
Social media and digital platforms; and
Other companies in the event (including in initial discussions) of a corporate sale, merger, transfer, reorganisation, dissolution or similar event.

We may also disclose an individual’s personal information to others where:

FirmGround Advisory is required or authorised by law or has a public duty to do so;
The individual may have expressly consented to the disclosure, or the consent may be reasonably inferred from the circumstances; or
FirmGround Advisory are otherwise permitted to disclose the information under the Privacy Act.

We may use and disclose your personal information for any of these purposes. We may also use and disclose an individual’s personal information for secondary purposes, which are related to the primary purposes set out above, or in other circumstances authorised by the Privacy Act.

Sensitive information will be used and disclosed only for the purpose for which it was provided (or a directly related secondary purpose), unless an individual agrees otherwise, or an exemption in the Privacy Act applies.

How might we use or disclose credit information?

In relation to credit information held by us, we will only use and disclose credit information for the following purposes:

Assessing an individual’s credit worthiness and likelihood of approval for an application for credit;
Collecting payments that are overdue in relation to any credit that may be provided by us;
Dealing with a serious credit infringement we believe an individual has committed;
If the disclosure is required or authorised by law;
Assisting the individual to avoid defaulting on his or her credit obligations; or
The provision or management of credit to an individual.

We will only disclose credit information to the following recipients:

A related body corporate;
A person who will be processing an individual’s application for credit;
A person who manages credit;
A credit provider if we believe an individual has committed a serious credit infringement, or the individual has consented to the disclosure;
A debt collector;
A credit reporting body; and
Anyone else to whom the individual authorises us to disclose it.

Does FirmGround Advisory hold credit card or other payment details?

If and when FirmGround Advisory collect credit card or other payment details, we will not store them. The card details will be passed directly via a secure encrypted TLS connection directly to the bank’s payment gateway.

Does FirmGround Advisory disclose personal information overseas?

FirmGround Advisory may disclose an individual’s personal information to a recipient which is located outside Australia. This includes:

Any financial institution which the individual holds an account with overseas where they have given FirmGround Advisory permission to make enquiries on their behalf.
Other members of FirmGround Advisory that are located outside Australia, in some circumstances.
Our data hosting and other IT service providers
Contractors and outsourced service providers that use staff located outside Australia;
Providers of software and AI tools that process information outside Australia (see the section on artificial intelligence below);
Other third-party service providers

Refer to APPENDIX A for the list of countries where these recipients may be located.

Some encrypted data may be backed up or mirrored in overseas jurisdictions by third parties. We will not send personal information to recipients outside of Australia unless:

We have taken reasonable steps to ensure that the recipient does not breach the Act, the APPs and the Credit Reporting Privacy Code;
The recipient is subject to an information privacy scheme similar to the Privacy Act; or
The individual has consented to the disclosure.

Does FirmGround Advisory use or disclose personal information for marketing?

FirmGround Advisory will use personal information to offer individuals products and services they believe may interest them but will not do so if the individual tells them not to. FirmGround Advisory may offer individuals products and services by various means, including mail, telephone, email, SMS or other electronic means, such as through social media or targeted advertising through FirmGround Advisory’s website.

FirmGround Advisory may also disclose an individual’s personal information to external companies who assist FirmGround Advisory to market their products and services to the individual, such as a mailing house.

If individuals do not wish to receive marketing offers from FirmGround Advisory, they may ask us to stop at any time. Every marketing message will include a simple way to opt out. We do not charge for acting on a request. We send electronic marketing in line with the Spam Act 2003 (Cth). On request, we will tell an individual where we obtained their personal information for marketing.

Does FirmGround Advisory collect personal information electronically?

FirmGround Advisory will collect information from individuals electronically, for instance through internet browsing, mobile or tablet applications.

Each time an individual visits one of FirmGround Advisory’s websites, FirmGround Advisory collects information about the individual’s use of the website, which may include the following:

The date and time of visits;
Which pages are viewed;
How users navigate through the site and interact with pages (including fields completed in forms and applications completed);
Location information about users;
Information about the device used to visit our website; and
IP addresses.

FirmGround Advisory uses technology called cookies whenever an individual visits a FirmGround Advisory website. Cookies are small pieces of information stored on the individual’s hard drive or in memory. Cookies can record information about an individual’s visits to the site, allowing it to remember them the next time they visit and provide an enriched experience.

One of the reasons for using cookies is to offer individuals increased security. The cookies FirmGround Advisory send to an individual’s computer cannot read their hard drive, obtain any information from their browser or command their computer to perform any action. Cookies are designed so that they cannot be sent to another site or be retrieved by any non- FirmGround Advisory site.

FirmGround Advisory won't ask individuals to supply personal information publicly over Facebook, LinkedIn, X, or any other social media platform that we use. Sometimes FirmGround Advisory may invite individuals to send their details to them via private messaging, for example, to answer a question. individuals may also be invited to share their personal information through secure channels to participate in other activities, such as competitions.

What information do we collect through our website?

Enquiry form. When you send an enquiry, we collect your name, business name, email address, phone number, industry, annual turnover range, main goal, the monthly amount you would consider for advisory support, how you would like to meet and anything else you tell us. We use this information to respond to you and prepare for your discovery call.

Business Health Score. You can complete the Business Health Score and see your results without giving us your contact details. If you ask for a PDF copy of your results, we collect your business name, contact name, phone number and business email address, together with your answers and results. Your PDF downloads to your device, and we receive a copy so we can follow up on your results. We do not store your answers unless you ask for a PDF.

Cash Flow Calculator. The figures you enter stay in your browser, and we do not receive them unless you ask for a PDF copy of your results. If you do, we collect your business name, contact name, phone number and business email address, together with your figures and results. Your PDF downloads to your device, and we receive a copy so we can follow up on your results.

Sample reports. When you ask for a sample report, we collect your name, email address and, if you give it, your business name. We use them to email you a link to the report.

We may contact you once about your results. We add you to our newsletter only if you subscribe. Two service providers handle the information you send us through our website before it reaches us. Cloudflare hosts our website and passes the details you send through it to SMTP2GO. Cloudflare is based in the United States, and its network may process your details outside Australia. SMTP2GO delivers your enquiry, newsletter sign-up, sample report request and PDF copies of free tool results to our email, sends you the sample reports you request, and stores these emails in Sydney, Australia. If you book a call through our website, Microsoft Bookings receives your booking details and stores them in our Microsoft 365 account. We then store the information in Microsoft SharePoint.

Newsletter. When you subscribe, we collect your email address and any name you give us and use them to send you our monthly article. Every newsletter includes a way to unsubscribe.

Client portal and dashboard. If you are a client, we collect the login details needed to give you access to our client portal and your dashboard. We handle documents and approvals you send through the portal as this policy describes.

How does FirmGround Advisory use artificial intelligence and automated decision-making?

FirmGround Advisory uses computer programs, including artificial intelligence (‘AI’) tools, in its business. Some of these tools use personal information.

AI tools that assist our staff. Our staff use general AI tools such as Microsoft Copilot, ChatGPT and Claude. Our accounting and practice software also has built-in AI features. This software includes Xero, MYOB, QuickBooks, Karbon, Spotlight Reporting and Figured. We use these tools for tasks such as drafting, summarising, analysing financial data and managing work. A FirmGround Advisory employee reviews the output and makes the final decision. Some of these tools process information outside Australia. See the section on overseas disclosure above.

Software that supports decisions about individuals. We use AML Guardian to help assess anti-money laundering and know-your-client (AML/KYC) risk. The software uses personal information to produce a risk rating for a client. A FirmGround Advisory employee reviews each rating and makes the final decision. That decision may affect whether we accept, continue or limit our services to a client.

The kinds of personal information used in this software include identification information, business and ownership information, financial information and screening check results.

The kinds of decisions made solely by a computer program: none. We do not make decisions about individuals solely by using a computer program.

The kinds of decisions where a computer program does something substantially and directly related to the decision: decisions to accept or continue a client relationship, based in part on an AML/KYC risk rating.

Meeting recordings and transcripts. With the consent of everyone attending, we may use AI tools to record or transcribe client meetings and prepare notes and action items. We will not record or transcribe a meeting if any attendee objects. We handle recordings, transcripts and notes in the same way as our other client records.

If you have a question about how we use these tools, please contact us using the details in the Key Contact section.

Keeping information Secure

FirmGround Advisory uses security procedures and technology to protect the information we hold. To prevent misuse or unlawful disclosure of sensitive information, FirmGround Advisory has implemented internal policies which cover staff conduct and the continuous training and monitoring of staff. If other organisations provide support services, we require these organisations to appropriately safeguard the privacy of the information provided to them.

Where the personal information we collect is no longer required, we may retain it in a secure manner for record keeping purposes, delete the information or permanently de-identify it in accordance with relevant laws and our internal records management policy. We generally keep client records for 7 years, as our Terms of Business set out.

Access to and correction of personal information

Under the Privacy Act, individuals have a right to seek access to information which we hold about them; although, there are some exceptions to this. They also have the right to ask us to correct information about them, which is inaccurate, incomplete or out of date. To do so, they must contact FirmGround Advisory.

We do not charge for making a request for access to personal information or for making a correction request. If we give access, we may charge a reasonable fee for the cost of providing it. The fee will not be excessive. We will tell you the fee before we provide access. We aim to respond to access and correction requests within 30 days. If we correct information that we have already disclosed to another entity, we will take reasonable steps to tell that entity if you ask us to.

There are some circumstances in which FirmGround Advisory are not required to give individuals access to their personal information. If FirmGround Advisory refuse to give an individual access to or to correct their personal information, FirmGround Advisory will give them a notice explaining the reasons why, except where it would be unreasonable to do so. If we refuse an individual request to correct their personal information, the individual also has the right to request that a statement be associated with their personal information noting that they disagree with its accuracy. If FirmGround Advisory refuses an individual’s request to access or correct their personal information, we will also provide them with information on how they can complain about the refusal.

Notification

Due to the Privacy Amendment (Notifiable Data Breaches) Act 2017, FirmGround Advisory is legally required to notify affected individuals and the Office of the Australian Information Commissioner (‘OAIC’) of any eligible data breach. An eligible data breach is one that is likely to result in serious harm to an individual. We will assess suspected data breaches quickly. We will notify affected individuals and the OAIC when the law requires.

Resolving privacy concerns and complaints

If an individual is concerned about how their personal information is being handled or if they have a complaint about a breach by FirmGround Advisory of the Australian Privacy Principles, they must contact FirmGround Advisory.

FirmGround Advisory will acknowledge the complaint as soon as practical after receipt of the individual’s complaint. FirmGround Advisory will let the individual know if they need any further information from the individual to resolve their complaint.

We aim to resolve complaints as quickly as possible. We strive to resolve complaints within five business days, but some complaints can take longer to resolve. If a complaint is taking longer, we will let the individual know what is happening and a date by which they can reasonably expect a response.

If the individual is unhappy with our response, they can take the matter further with the OAIC.

Under the Privacy Act, an individual may complain to the Office of the Australian Information Commissioner about the way FirmGround Advisory handled their personal information.

The Commissioner can be contacted at:

Office of the Australian Information Commissioner GPO Box 5288

Sydney NSW 2001

Phone: 1300 363 992

Email: enquiries@oaic.gov.au

Website: www.oaic.gov.au

Key Contact

The individual can contact FirmGround Advisory by:

Calling 0438 802 531
Emailing complaints@firmgroundadvisory.com.au
Visiting www.firmgroundadvisory.com.au
Writing to us PO Box 14, Bathurst, NSW 2795

Changes to the Privacy Policy

We may change the way we handle personal information from time to time for any reason. If so, we will update this Privacy Policy which will be updated on the website accordingly.

We publish this Privacy Policy on our website free of charge. On request, we will give an individual a copy in another form, as far as practicable.

Last updated: November 2026

Appendix A

FirmGround Advisory may disclose an individual’s personal information to a recipient which is located outside Australia.

These recipients may be in New Zealand, United States, Canada, United Kingdom, Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, India, Malaysia, Philippines, Vietnam.