Who this policy covers
This policy explains the handling of personal information in connection with the KPA Accountants, Tax & Business Advisors website, enquiries and professional services. It applies to information about individuals, including people who act for businesses, trusts, companies and SMSFs.
KPA’s contact address is Suite 2, 100 Queen Street, Campbelltown NSW 2560. Privacy questions, access or correction requests and complaints can be sent to tax@kpaaccountants.com.au. Your privacy rights depend on the law that applies to the information and service involved. This may include the Privacy Act 1988 and Australian Privacy Principles. Separate legal protections apply to your tax file number.
Website visits and online enquiries
Website hosting and security services may process technical information such as your IP address, browser and device information, requested pages, dates and times, and error or security logs. This supports delivery, availability and security of the website.
When you submit our contact form, your name, email address, optional phone number, selected service and message are processed through Web3Forms and forwarded to KPA so we can respond. Web3Forms also processes technical information to deliver the service and prevent spam. Read the Web3Forms Privacy Policy for details. You can contact us by phone or email if you prefer.
Our appointment booking page uses Calendly. When you select a team member, the booking calendar loads from Calendly. Information you provide when booking, including your name, email address, selected appointment and any booking answers, is processed through Calendly and made available to KPA to arrange and administer your appointment. Calendly may also receive technical information when the calendar loads. Read Calendly’s Privacy Notice for details about its service, cookies and international information handling. You can arrange an appointment by phone or email if you prefer. Please do not include tax file numbers, bank details or confidential documents in booking notes.
There is no document-upload facility, client account or online payment facility on this website. General enquiries do not need a TFN, date of birth, identity document or bank account number. You may ask a general question without identifying yourself, or use a pseudonym, where practicable. We may need your identity and contact details to respond, verify authority or provide a professional service.
Information relevant to professional services
If you engage KPA, the information needed depends on the services and the relevant person or entity. We discuss the required records and how to provide them as part of that engagement. Information may include:
- Contact, identity, authority, residency and entity details needed for the work.
- Tax, income, expense, employment, benefit and investment records for individual or business taxation.
- Accounting, registration, ownership, payroll and reporting information for business services.
- Rental, purchase, sale, funding, ownership and use-history records for property taxation.
- Fund, trustee, member, contribution, pension, investment, financial-statement and audit information for SMSF work.
- Instructions, correspondence, invoices and records needed to administer the engagement or meet legal and professional obligations.
Information about an employee, partner, beneficiary, family member or other person should only be provided where you are authorised or otherwise have a lawful basis. Sensitive information is requested only when relevant and permitted, with consent where required.
How information is obtained
Information may come directly from you by telephone, email, correspondence, meetings or records provided under an engagement. For agreed professional work it may also come from an authorised representative, a previous adviser, a relevant authority, an accounting system or another source where collection is lawful and appropriately authorised.
We do not ask you to post confidential records publicly. If information is incomplete or inaccurate, we may need clarification before giving advice or completing work. If necessary identity, authority or service information is not provided, we may be unable to undertake the requested service.
Why information is used
Information is handled to respond to enquiries; determine and perform agreed services; verify identity and instructions; prepare or lodge authorised reports; communicate about the work; administer fees and records; address complaints; secure systems; and meet applicable legal or professional duties.
Information is not to be used for an unrelated purpose simply because it was included in an enquiry. If another use requires your permission or a separate privacy notice, we will address this with you before using the information. A general enquiry is not a request to add you to a marketing list.
Tax file numbers and sensitive records
Individuals’ TFN information is subject to the Privacy (Tax File Number) Rule 2015. It may only be requested, recorded, used and disclosed for purposes authorised by law. Agreement to this policy does not authorise a use that the law prohibits.
Do not enter TFNs or send identity documents, bank details, passwords, detailed payroll information or health information through the general website form. If a service requires protected information, ask KPA about the appropriate transfer method and the purpose for which it is needed. TFN information must be protected and securely disposed of when it is no longer required to be retained by law or for an authorised purpose.
Who may receive information
For a particular engagement, information may need to be provided to authorised representatives, the ATO or other authorities, an independent SMSF auditor, a relevant professional adviser, or providers of accounting, communications, storage and IT services. The recipients and authority for sharing depend on the service.
Registered tax practitioners must protect information about a client’s affairs. Disclosure to a third party requires the client’s permission unless there is a legal duty to disclose. If we need your permission to share information with a software provider or another service provider, we will seek it through your engagement agreement or contact you separately. Reading this policy does not provide that permission.
Information may also be disclosed where the law requires it, including a valid regulatory or court requirement. Where customer due diligence or financial-crime reporting obligations apply to a designated service, additional checks, records or lawful disclosures may be necessary. This does not mean that every KPA service is a designated service.
Overseas handling and service providers
Online providers can use infrastructure outside Australia. The Google map on the Contact page is a third-party service; Google states that it processes information on servers around the world. Its handling of information is explained in the Google Privacy Policy.
Before sharing your client information with an overseas provider, we will explain who will receive it, why it is needed and where it is likely to be handled, and seek your permission where required. An overseas disclosure must meet applicable privacy and confidentiality obligations; accepting these website terms is not a blanket waiver of those protections.
Ask KPA about the providers and countries relevant to the particular service before sharing client documents. We will provide the relevant information about overseas handling and seek permission where required before client information is disclosed.
Security and retention
We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, alteration or disclosure. The safeguards needed depend on the sensitivity of the information and may include restricting access, using secure transfer methods and checking service provider arrangements. No internet or email transmission is completely risk-free; contact KPA before sending sensitive records.
Retention depends on the nature of the work, applicable tax, superannuation, company and professional record obligations, and any continuing lawful need such as a dispute. Different records can have different retention periods. A request to delete information does not override a legal requirement to retain it. Information no longer needed for a lawful purpose is securely destroyed or de-identified as appropriate. Ask us about the period applicable to your records.
Access and correction
Contact tax@kpaaccountants.com.au to request access to personal information held about you or correction of inaccurate, incomplete or out-of-date information. Describe the information and your request, without initially sending unnecessary identity documents.
We may need to verify identity and authority, including where you act for an entity or another person. Requests are considered under the applicable law, with reasons given for any lawful refusal and information about available complaint options. Access to another person’s information may be restricted. There is no charge to make a request; any permitted reasonable access cost would be explained before it is incurred.
Choices and communications
You can ask how information will be used, request correction, decline optional information, or withdraw a consent for future handling where that is available. Withdrawal does not invalidate earlier lawful handling or prevent compliance with a legal obligation. Some requested services may not be possible without necessary records or authority.
Making an enquiry does not automatically subscribe you to promotional messages. Any commercial email or SMS marketing must have the necessary consent, identify the sender and provide an appropriate unsubscribe method. You can contact KPA to opt out of marketing; messages necessary to administer an engagement or meet legal duties may still be required.
Privacy complaints
Send a complaint to tax@kpaaccountants.com.au or write to KPA at PO Box 878, Campbelltown NSW 2560. Explain the concern, the relevant dates and the outcome sought. Please do not include a TFN or unnecessary financial records in the initial complaint.
We will consider the complaint and communicate about the response. The OAIC generally expects an organisation to be given 30 days to respond before a complaint is escalated. If you are dissatisfied or do not receive a response, you may contact the Office of the Australian Information Commissioner where the matter is within its jurisdiction. Professional-conduct concerns may also be raised with the Tax Practitioners Board where relevant. These options do not remove other rights you may have.
Information-security concerns
If you suspect that personal information associated with KPA has been exposed or misused, contact the office promptly by telephone or email. Avoid repeating the affected sensitive information in a general message.
If we become aware of a suspected data breach, we must assess it and respond as required by the law that applies. Where the Notifiable Data Breaches scheme applies and a breach meets its notification threshold, the relevant affected individuals and the OAIC must be notified. Other confidentiality, security or reporting obligations may also apply.
Updates and further information
The review date appears at the top of this policy. We may update this policy if the way we collect, use or share personal information changes. A policy update is not retrospective consent to a different use of existing client information.
For this policy in another accessible format, or questions about the arrangements for a particular service, contact tax@kpaaccountants.com.au or call (02) 4626 3050. Further information about Australian privacy rights is available from oaic.gov.au.
Contact KPA
Suite 2, 100 Queen Street, Campbelltown NSW 2560
Postal: PO Box 878, Campbelltown NSW 2560
(02) 4626 3050
tax@kpaaccountants.com.au