Privacy Policy

1. About This Policy

Plus Ultra Lawyers ("the Firm", "we", "our" or "us") is committed to protecting the privacy of personal information we collect and hold. We recognise the importance of safeguarding the personal information entrusted to us by our clients, prospective clients, employees, contractors, referrers and other individuals with whom we interact in the course of our practice.

This Privacy Policy sets out how we collect, hold, use, disclose and otherwise manage personal information in accordance with:

• Privacy Act 1988 (Cth) (the "Privacy Act"), including the 13 Australian Privacy Principles ("APPs");
• Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (the "AML/CTF Act");
• Taxation Administration Act 1953 (Cth) and the Tax File Number Guidelines issued under section 17 of the Privacy Act;
• the applicable legal profession legislation and professional conduct rules in the jurisdictions in which we practise, namely:
  • Legal Profession Uniform Law (NSW) and Legal Profession Uniform Law Application Act 2014 (NSW);
  • Legal Profession Act 2007 (Qld);
  • Legal Practitioners Act 1981 (SA);
  • Legal Profession Act 2008 (WA);
  • Legal Profession Act 2007 (Tas); and
• the Australian Solicitors' Conduct Rules (or the equivalent rules adopted in each jurisdiction in which we practise).

This Policy satisfies our obligations under APP 1 to manage personal information in an open and transparent way. It applies to all personal information collected by the Firm, regardless of whether it is collected in the course of providing legal services, through our website, or in connection with our business operations.

We encourage you to read this Policy carefully. If you have any questions about its contents or our privacy practices, please contact our Privacy Officer using the details provided in section 18 of this Policy.

2. Key Definitions

In this Policy, unless the context otherwise requires:

• "Personal information" has the meaning given in section 6 of the Privacy Act and means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not and whether the information or opinion is recorded in a material form or not.
• "Sensitive information" is a subset of personal information as defined in section 6 of the Privacy Act and includes information or an opinion about an individual's racial or ethnic origin, political opinions, membership of a political association, religious beliefs or affiliations, philosophical beliefs, membership of a professional or trade association, membership of a trade union, sexual orientation or practices, criminal record, health information, genetic information, biometric information and biometric templates.
• "APP entity" means an agency or organisation as defined in the Privacy Act.
• "Notifiable Data Breach" has the meaning given in Part IIIC of the Privacy Act and refers to an eligible data breach that meets the threshold for notification to the Office of the Australian Information Commissioner ("OAIC") and affected individuals.
• "Tax File Number" or "TFN" has the meaning given in section 202A of the Income Tax Assessment Act 1936 (Cth).

3. Personal Information We Collect

3.1 Categories of Personal Information

The types of personal information we may collect and hold depend on the nature of your dealings with us and the legal services we provide. The personal information we collect may include, but is not limited to:

• Identity and contact information: full name, date of birth, residential and postal address, telephone numbers, email addresses, and other contact details;
• Identification documents: copies of passports, driving licences, birth certificates, and other government-issued identification, including for the purposes of client verification under the AML/CTF Act;
• Financial information: bank account details, credit card details, income and asset information, taxation records, and information required for billing, trust account management and financial transactions;
• Employment and business information: occupation, employer details, position title, professional qualifications, and business interests;
• Legal matter information: information relating to your legal matter, including court and tribunal records, pleadings, affidavits, witness statements, contracts, correspondence and other documents relevant to the provision of legal services;
• Third party information: information about other individuals relevant to your legal matter, including opposing parties, witnesses, beneficiaries, dependants, business associates and other persons;
• Government-related identifiers: Tax File Numbers, Medicare numbers, Centrelink reference numbers, and other government-related identifiers where required or authorised by law;
• Website and technology information: information collected through our website, including IP addresses, browser type, device information, pages visited and cookies (see section 16 of this Policy).

3.2 Sensitive Information

In the course of providing legal services, particularly in areas such as family law, criminal law, personal injury, employment law, estate planning and health-related matters, we may collect sensitive information including:

• Health and medical information: medical records, psychological reports, disability information and other health-related information relevant to your legal matter;
• Criminal history: criminal records, charges, convictions and related information;
• Racial or ethnic origin: where relevant to anti-discrimination matters, family law proceedings or estate planning;
• Religious beliefs or affiliations: where relevant to your legal matter;
• Sexual orientation or practices: where relevant to family law or anti-discrimination matters;
• Trade union or professional association membership: where relevant to employment or industrial law matters.

We will only collect sensitive information where:

• you have consented to the collection and the information is reasonably necessary for one or more of our functions or activities;
• the collection is required or authorised by or under an Australian law or a court or tribunal order; or
• a permitted general situation or permitted health situation (as defined in the Privacy Act) exists.

4. How We Collect Personal Information

4.1 Direct Collection

Where it is reasonable and practicable to do so, we collect personal information directly from you. This may occur when you:

• engage us to provide legal services, including during initial consultations and throughout the conduct of your matter;
• complete our client intake forms or provide identification documents;
• correspond with us by telephone, email, post, facsimile or in person;
• provide instructions, documents or other materials in connection with a legal matter;
• attend our offices for meetings or consultations;
• submit an enquiry or request through our website or social media channels;
• subscribe to our newsletters, publications or legal updates;
• attend seminars, workshops or events hosted by the Firm; or
• apply for employment or engagement with the Firm.

4.2 Collection from Third Parties

In certain circumstances, we may collect personal information about you from third parties. This may occur when we receive information from:

• courts, tribunals and government agencies (including the Australian Securities and Investments Commission, land registries, and the Australian Taxation Office);
• opposing parties and their legal representatives;
• barristers, expert witnesses, mediators and other professionals engaged in connection with your matter;
• referrers, including other law firms, accountants, financial advisers and real estate agents;
• your employer, business partners or associates (where relevant to the legal services we provide);
• credit reporting bodies and debt collection agencies;
• law enforcement agencies; and
• publicly available sources, including court records, ASIC registers, land title registers, electoral rolls and published media.

Where we collect personal information about you from a third party, we will take reasonable steps to ensure that you are made aware of the matters set out in this Policy, unless doing so would be unreasonable in the circumstances.

4.3 Unsolicited Personal Information

From time to time, we may receive personal information that we have not solicited ("unsolicited information"). In accordance with APP 4, where we receive unsolicited personal information, we will, within a reasonable period, determine whether we could have collected the information under APP 3. If we determine that we could not have collected the information, and the information is not contained in a Commonwealth record, we will destroy or de-identify the information as soon as practicable, provided it is lawful and reasonable to do so.

4.4 Anonymity and Pseudonymity

In accordance with APP 2, you have the option of not identifying yourself, or of using a pseudonym, when dealing with us. However, due to the nature of legal services, it will generally be impracticable for us to deal with you on an anonymous or pseudonymous basis. We are required by law and by our professional obligations to verify the identity of our clients, including under the AML/CTF Act. If you do not provide us with the personal information we reasonably require, we may be unable to provide you with the legal services you have requested.

5. Purposes of Collection, Use and Disclosure

5.1 Primary Purposes

We collect, hold, use and disclose personal information for the primary purpose of providing legal services and administering our practice. Our primary purposes include:

• providing legal advice, representation and related services;
• administering and managing client matters, including opening files, conducting conflict checks and maintaining matter records;
• communicating with you in relation to your legal matter;
• preparing legal documents, court filings, submissions and correspondence on your behalf;
• billing for legal services rendered, issuing tax invoices, managing trust account transactions and processing payments;
• complying with our legal and regulatory obligations, including our duties under the applicable legal profession legislation in each jurisdiction in which we practise;
• complying with our client identification and verification obligations under the AML/CTF Act;
• fulfilling our professional and ethical obligations under the Australian Solicitors' Conduct Rules and equivalent rules in each jurisdiction; and
• managing and resolving complaints.

5.2 Secondary Purposes

We may also use and disclose personal information for secondary purposes that are related to the primary purpose of collection, where you would reasonably expect us to use or disclose the information for that secondary purpose. These secondary purposes may include:

• internal administration and management of the Firm, including staff training, supervision, quality assurance and risk management;
• maintaining and developing our client relationship management systems;
• conducting legal and factual research relevant to our clients' matters;
• reporting to professional indemnity insurers and responding to claims;
• participating in legal profession regulatory processes, including responding to complaints and audits by legal profession regulators;
• complying with court orders, subpoenas, notices to produce and other compulsory processes; and
• any other purpose required or authorised by or under law.

6. Disclosure of Personal Information to Third Parties

In the course of providing legal services and conducting our business operations, we may disclose your personal information to the following categories of recipients:

6.1 Professional Service Providers

• barristers and counsel briefed in connection with your matter;
• expert witnesses, valuers, investigators and other professionals engaged to assist with your matter;
• mediators, arbitrators and other dispute resolution practitioners;
• other law firms, including firms acting for co-parties or instructing agents in other jurisdictions; and
• interpreters, translators and transcription service providers.

6.2 Courts, Tribunals and Government Bodies

• courts, tribunals and judicial officers;
• government departments and regulatory agencies (including the Australian Taxation Office, ASIC, the Office of State Revenue, and relevant land titles offices);
• law enforcement agencies;
• the Office of the Australian Information Commissioner;
• legal profession regulatory bodies, including the Law Society and Bar Association in each relevant jurisdiction, and the Office of the Legal Services Commissioner (NSW); and
• the Australian Transaction Reports and Analysis Centre ("AUSTRAC") where required under the AML/CTF Act.

6.3 Business Service Providers

We engage third-party service providers to assist with our business operations. These providers may have access to personal information in the course of providing services to us, including:

• information technology service providers (including cloud storage, practice management software, document management systems, email hosting and cybersecurity providers);
• accounting and auditing firms;
• banking and financial institutions (including for the operation of our trust accounts);
• insurance providers (including our professional indemnity insurer);
• marketing and communications service providers;
• archival and document storage providers; and
• postal and courier services.

We take reasonable steps to ensure that our third-party service providers are bound by obligations of confidentiality and are required to handle personal information in accordance with the APPs.

6.4 Other Disclosures

We may also disclose your personal information where:

• you have consented to the disclosure;
• the disclosure is required or authorised by or under an Australian law or a court or tribunal order;
• a permitted general situation or permitted health situation exists (as defined in sections 16A and 16B of the Privacy Act);
• the Firm reasonably believes that the disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety; or
• the disclosure is reasonably necessary for the establishment, exercise or defence of a legal or equitable claim.

7. Direct Marketing

In accordance with APP 7, we may use your personal information to send you marketing communications about our legal services, publications, seminars, events and other matters that may be of interest to you. We will only do so where:

• you have consented to receiving such communications; or
• you would reasonably expect us to use your personal information for direct marketing purposes and we provide a simple means by which you can request not to receive such communications ("opt out").

We will not use sensitive information for direct marketing purposes without your express consent.

You may opt out of receiving direct marketing communications from us at any time by:

• clicking the "unsubscribe" link in any electronic marketing communication;
• contacting our Privacy Officer using the details set out in section 18 of this Policy; or
• notifying us by telephone, email or in writing.

We will action your opt-out request without charge and within a reasonable period.

8. Cross-Border Disclosure of Personal Information

In accordance with APP 8, we will take reasonable steps to ensure that any overseas recipient of personal information does not breach the APPs in relation to that information.

In certain limited circumstances, we may disclose personal information to recipients located outside Australia. This may occur where:

• your legal matter has an international dimension requiring communication with foreign legal practitioners, courts or regulatory bodies;
• we engage barristers or expert witnesses located overseas;
• our information technology service providers (including cloud storage and software-as-a-service providers) store data on servers located outside Australia; or
• the disclosure is otherwise necessary for the provision of legal services to you.

Where we disclose personal information to overseas recipients, we will:

• take reasonable steps to ensure that the overseas recipient does not breach the APPs;
• where practicable, ensure that contractual arrangements with the overseas recipient include obligations to handle personal information in accordance with the APPs; and
• inform you, to the extent practicable, of the countries in which the overseas recipients are likely to be located.

If you consent to the cross-border disclosure of your personal information after being informed that APP 8.1 will no longer apply, we will not be accountable under the Privacy Act if the overseas recipient handles your information in a manner that breaches the APPs. We will not seek such consent unless it is necessary in the circumstances of your matter.

9. Government-Related Identifiers

In accordance with APP 9, we will not adopt, use or disclose a government-related identifier (such as a Tax File Number, Medicare number, driver licence number or passport number) unless:

• the adoption, use or disclosure is reasonably necessary for us to verify your identity for the purposes of our activities or functions;
• the adoption, use or disclosure is required or authorised by or under an Australian law or a court or tribunal order; or
• a permitted general situation (other than the situation referred to in item 4 of the table in subsection 16A(1) of the Privacy Act) or a permitted health situation exists.

9.1 Tax File Numbers

Where we collect Tax File Numbers in the course of providing legal services (for example, in taxation, estate planning, commercial and real estate matters), we will handle them in accordance with the Privacy (Tax File Number) Rule 2015 and the Tax File Number Guidelines issued by the Information Commissioner under section 17 of the Privacy Act. In particular, we will:

• only collect TFNs where it is reasonably necessary for a lawful purpose connected with our functions or activities;
• store TFNs securely and limit access to authorised personnel;
• not disclose TFNs except where required or authorised by law; and
• destroy or de-identify records containing TFNs when they are no longer required for the purpose for which they were collected.

10. Data Quality

In accordance with APP 10, we take reasonable steps to ensure that the personal information we collect, use and disclose is accurate, up-to-date, complete and relevant, having regard to the purpose of the use or disclosure.

We encourage you to contact us if any of the personal information we hold about you is inaccurate, out-of-date, incomplete, irrelevant or misleading. You may request correction of your personal information in accordance with section 14 of this Policy.

11. Security of Personal Information

In accordance with APP 11, we take reasonable steps to protect the personal information we hold from misuse, interference and loss, and from unauthorised access, modification or disclosure. The security measures we employ include:

11.1 Physical Security

• secure office premises with restricted access controls;
• locked filing cabinets and storage rooms for physical records;
• clean desk policies and secure disposal of physical documents (including shredding); and
• visitor management procedures at our offices.

11.2 Technical Security

• encryption of electronic data, both in transit and at rest;
• secure, password-protected information technology systems with multi-factor authentication;
• firewalls, intrusion detection systems and antivirus software;
• regular security updates and patch management;
• access controls limiting access to personal information to authorised personnel on a need-to-know basis;
• secure backup systems and disaster recovery procedures; and
• regular security assessments and penetration testing.

11.3 Organisational Security

• staff training on privacy and information security obligations;
• confidentiality agreements with employees, contractors and service providers;
• internal policies and procedures for the handling of personal information;
• regular review and updating of security measures; and
• incident response procedures for potential data breaches.

Notwithstanding the measures we employ, no method of transmission over the internet or method of electronic storage is completely secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

12. Data Retention and Destruction

We will retain personal information for as long as it is reasonably necessary for the purposes for which it was collected, or as required by law. In determining the appropriate retention period, we have regard to:

• the nature of the personal information and the sensitivity of the information;
• the purposes for which the information was collected;
• our legal and regulatory obligations, including record-keeping requirements under the applicable legal profession legislation in each jurisdiction;
• limitation periods for potential legal claims;
• professional conduct obligations, including obligations relating to the retention of client files; and
• any applicable industry standards or guidelines.

Under the legal profession legislation applicable in the jurisdictions in which we practise, we are required to retain certain client records and trust account records for minimum periods, which may be seven years or longer from the date of the relevant transaction or the completion of the matter.

Where personal information is no longer needed for any purpose for which it may be used or disclosed under the APPs, and we are not required by or under an Australian law or a court or tribunal order to retain the information, we will take reasonable steps to destroy the information or to ensure that it is de-identified.

Destruction of personal information is carried out by secure means, including secure shredding of physical documents and secure deletion or overwriting of electronic records.

13. Access to Personal Information

In accordance with APP 12, you have the right to request access to the personal information we hold about you. To request access, please contact our Privacy Officer using the details set out in section 18 of this Policy.

We will respond to your access request within a reasonable period (and in any event within 30 days of receiving the request) and will provide access in the manner you have requested, where it is reasonable and practicable to do so.

We may refuse to give you access to your personal information in certain circumstances permitted under the Privacy Act, including where:

• giving access would pose a serious threat to the life, health or safety of any individual, or to public health or safety;
• giving access would have an unreasonable impact on the privacy of other individuals;
• the request for access is frivolous or vexatious;
• the information relates to existing or anticipated legal proceedings between the Firm and you, and the information would not be accessible by the process of discovery in those proceedings;
• giving access would reveal the intentions of the Firm in relation to negotiations with you, in such a way as to prejudice those negotiations;
• giving access would be unlawful;
• denying access is required or authorised by or under an Australian law or a court or tribunal order;
• giving access would prejudice an investigation of possible unlawful activity; or
• giving access would prejudice activities carried out by an enforcement body.

If we refuse your access request, we will provide you with a written notice setting out the reasons for the refusal (unless it would be unreasonable to do so), the mechanisms available to you to complain about the refusal, and any other matter prescribed by the regulations.

Important note regarding legal professional privilege: Access to certain information may be subject to legal professional privilege or client legal privilege. We will not provide access to information where to do so would compromise the privilege attaching to that information, whether in relation to your matter or the matter of another client.

14. Correction of Personal Information

In accordance with APP 13, you have the right to request that we correct any personal information we hold about you that you believe is inaccurate, out-of-date, incomplete, irrelevant or misleading.

To request a correction, please contact our Privacy Officer using the details set out in section 18. We will respond to your correction request within a reasonable period (and in any event within 30 days of receiving the request).

If we correct personal information that we have previously disclosed to a third party, we will, at your request, take reasonable steps to notify the third party of the correction, unless it is impracticable or unlawful to do so.

If we refuse to correct personal information as requested, we will provide you with a written notice setting out the reasons for the refusal, the mechanisms available to you to complain about the refusal, and any other matter prescribed by the regulations. In such circumstances, you may request that we associate with the information a statement that you believe the information is inaccurate, out-of-date, incomplete, irrelevant or misleading, and we will take reasonable steps to do so.

15. Notifiable Data Breaches

In accordance with Part IIIC of the Privacy Act (the Notifiable Data Breaches scheme), we have procedures in place to respond to data breaches.

Where we have reasonable grounds to believe that an eligible data breach has occurred in relation to personal information that we hold, and the breach is likely to result in serious harm to any individual to whom the information relates, we will:

• as soon as practicable, prepare a statement in accordance with section 26WK of the Privacy Act and provide a copy to the OAIC;
• take such steps as are reasonable in the circumstances to notify the contents of the statement to each individual to whom the relevant information relates, or to each individual who is at risk from the eligible data breach; and
• take such other steps as are reasonable in the circumstances to contain the breach, assess the risk of harm and prevent future breaches.

If we have reasonable grounds to believe that there has been an eligible data breach but a remedial action is taken before serious harm is caused, we will take all reasonable steps to implement that remedial action.

We maintain a data breach response plan which sets out our internal procedures for identifying, containing, assessing and responding to data breaches.

16. Website Privacy

16.1 Cookies and Tracking Technologies

Our website may use cookies and similar tracking technologies to enhance your browsing experience and to collect information about how you use our website. Cookies are small text files that are stored on your device when you visit a website.

We may use the following types of cookies:

• Strictly necessary cookies: these cookies are essential for the operation of our website and enable you to navigate the site and use its features;
• Performance and analytics cookies: these cookies collect information about how visitors use our website, including which pages are visited most often and any error messages received. We may use third-party analytics services (such as Google Analytics) to assist with this;
• Functionality cookies: these cookies allow our website to remember choices you make and provide enhanced, more personalised features; and
• Targeting or advertising cookies: these cookies may be used to deliver content that is more relevant to your interests.

You may disable cookies through your browser settings. However, if you disable cookies, some features of our website may not function properly.

16.2 Website Analytics

We may use third-party analytics tools to collect and analyse information about the use of our website. These tools may collect information such as your IP address, browser type, operating system, referring URLs, pages visited, and the date and time of your visit. This information is used to analyse trends, administer the website, track user movements around the website and gather demographic information about our user base as a whole.

16.3 Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those third-party websites. We encourage you to read the privacy policies of any third-party website you visit.

16.4 Online Forms

Where you submit information to us through our website (for example, by completing a contact form or enquiry form), the information you provide will be collected and handled in accordance with this Policy. Information submitted through our website contact forms does not create a solicitor-client relationship and is not protected by legal professional privilege unless and until we agree to act for you.

17. Complaints

17.1 Internal Complaints Process

If you believe that we have breached the APPs or otherwise handled your personal information inappropriately, you are entitled to make a complaint. We take all complaints seriously and will endeavour to resolve your concerns promptly and fairly.

To lodge a complaint with us, please contact our Privacy Officer using the details set out in section 18 of this Policy. We ask that you set out in your complaint the details of the matter about which you are complaining and the outcome you are seeking.

Upon receiving your complaint, we will:

• acknowledge receipt of your complaint within five (5) business days;
• investigate the complaint and assess whether a breach of the APPs or of this Policy has occurred;
• provide you with a written response setting out the outcome of our investigation and the steps we will take to resolve the complaint (if applicable) within 30 days of receiving the complaint (or such longer period as is reasonably necessary in the circumstances); and
• where appropriate, take steps to remedy any breach and to prevent a recurrence.

17.2 Complaints to the Office of the Australian Information Commissioner

If you are not satisfied with our response to your complaint, or if you believe that we have not adequately addressed your concerns, you may lodge a complaint with the OAIC. The OAIC can be contacted as follows:

Office of the Australian Information Commissioner
GPO Box 5218
Sydney NSW 2001
Telephone: 1300 363 992
Website: www.oaic.gov.au
Email: enquiries@oaic.gov.au

You may also lodge a complaint with the relevant legal profession regulatory body in the jurisdiction in which the conduct occurred, if you believe that our handling of your personal information has breached our professional conduct obligations.

18. Contact Details — Privacy Officer

If you have any questions about this Policy, wish to make an access or correction request, or wish to lodge a complaint, please contact our Privacy Officer:

Privacy Officer
Plus Ultra Lawyers — Jonathan Nassif
Address: Suite 11H 325 Pitt Street, Sydney NSW 2000
Telephone: 0421 147 798
Email: jn@plusultralawyers.com.au

We will endeavour to respond to all enquiries and requests within a reasonable period.

19. Legal Professional Privilege and Confidentiality

This Policy does not limit or affect the operation of legal professional privilege (also known as client legal privilege) which protects confidential communications made between a legal practitioner and a client for the dominant purpose of providing or receiving legal advice or in relation to existing or anticipated legal proceedings.

In addition to our obligations under the Privacy Act, we are bound by the duty of confidentiality imposed on legal practitioners under:

• the Australian Solicitors' Conduct Rules (and equivalent rules in each jurisdiction in which we practise);
• the common law duty of confidentiality; and
• the applicable legal profession legislation in each jurisdiction.

Our duty of confidentiality is broader in certain respects than our obligations under the Privacy Act. We will not disclose information that is subject to legal professional privilege or the duty of confidentiality except with your informed consent, where required or permitted by law, or where necessary to prevent the commission of a serious criminal offence or serious harm.

Nothing in this Policy requires or authorises us to act in a manner that is inconsistent with our professional obligations or the rules of legal professional privilege.

20. State-Specific Regulatory Framework

Plus Ultra Lawyers practises in multiple Australian jurisdictions. In addition to the Privacy Act and the APPs, our handling of personal information is informed by the professional conduct obligations and regulatory requirements applicable in each jurisdiction in which we practise:

20.1 New South Wales

Legal Profession Uniform Law (NSW): We comply with the Legal Profession Uniform Law as applied by the Legal Profession Uniform Law Application Act 2014 (NSW), including trust account obligations, record-keeping requirements and professional conduct standards administered by the Law Society of New South Wales and the Office of the Legal Services Commissioner.

20.2 Queensland

Legal Profession Act 2007 (Qld): We comply with the Legal Profession Act 2007 (Qld), including trust account and record-keeping obligations. We also note the Information Privacy Act 2009 (Qld), which establishes privacy obligations for Queensland government agencies; while it does not directly apply to private law firms, we adopt its principles as a matter of best practice where relevant.

20.3 South Australia

Legal Practitioners Act 1981 (SA): We comply with the Legal Practitioners Act 1981 (SA) and the professional conduct obligations administered by the Law Society of South Australia, including obligations relating to confidentiality and the proper handling of client information.

20.4 Western Australia

Legal Profession Act 2008 (WA): We comply with the Legal Profession Act 2008 (WA), including trust account requirements, record-keeping obligations and professional conduct standards administered by the Legal Practice Board of Western Australia and the Legal Services and Complaints Committee.

20.5 Tasmania

Legal Profession Act 2007 (Tas): We comply with the Legal Profession Act 2007 (Tas), including trust account and record-keeping obligations, and professional conduct standards administered by the Law Society of Tasmania.

In each jurisdiction, we are also bound by the Australian Solicitors' Conduct Rules (or the equivalent conduct rules adopted in that jurisdiction), which impose duties of confidentiality and obligations regarding the proper handling of client information that complement and, in certain respects, exceed the requirements of the Privacy Act.

21. Anti-Money Laundering and Counter-Terrorism Financing

As a designated service provider under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) (the "AML/CTF Act"), we are required to collect and verify certain personal information about our clients before providing designated legal services. The designated services relevant to legal practitioners include services relating to the transfer of real property, the management of client funds, and the creation or management of legal structures such as companies and trusts.

Our obligations under the AML/CTF Act include:

• conducting customer identification and verification procedures before providing designated services;
• conducting ongoing customer due diligence;
• monitoring transactions and reporting suspicious matters to AUSTRAC;
• maintaining AML/CTF programs, including risk assessments; and
• retaining records of customer identification and transactions for a minimum of seven years.

Personal information collected for the purposes of the AML/CTF Act will be handled in accordance with this Policy and the Privacy Act. We are required to retain such information for the periods prescribed by the AML/CTF Act, even if we would otherwise destroy or de-identify the information under our general data retention practices.

22. Changes to This Policy

We may update or amend this Privacy Policy from time to time to reflect changes in our privacy practices, legal requirements or business operations. When we make material changes to this Policy, we will:

• publish the updated Policy on our website;
• update the effective date at the beginning of the Policy; and
• where the changes are significant, take reasonable steps to notify affected individuals (for example, by email or by notice on our website).

We encourage you to review this Policy periodically to stay informed about how we are protecting your personal information.

The current version of this Policy is available on our website and on request from our Privacy Officer.