About this policy

This policy is issued by MJT Partners Pty Ltd ACN 098 348 102 and its subsidiaries (as defined in the Corporations Act 2001 (Cth)) (“we”, “us” and “our”).

It explains how we collect, hold, use and disclose personal information, and how we comply with the Privacy Act 1988 (Cth) (“Act”) and the Australian Privacy Principles (“APPs”).

We are a firm of Chartered Accountants and registered tax agents. When we provide tax agent services, we are also bound by the Tax Agent Services Act 2009 (Cth) and its Code of Professional Conduct, including a duty to keep your information confidential. Where those obligations are stricter than this policy, we follow them.

Who this policy covers. It applies to everyone whose personal information we handle, including:

our clients
people connected to our clients whose information we receive, such as spouses, directors, trustees, beneficiaries and employees
guarantors and prospective guarantors
suppliers and service providers
job applicants
visitors to our website.

If you give us personal information about someone else, please let them know you have done so and point them to this policy.

Our commitment. We take reasonable steps to handle personal information in line with the APPs. These steps include this policy, staff training, a written staff policy on the use of artificial intelligence (AI), and clear procedures for complaints and for disclosing information.

If you would like a printed copy of this policy, please contact our Privacy Officer using the details at the end.

What we collect

Personal information is information or an opinion about an identified person, or a person who can reasonably be identified. It does not matter whether it is true or recorded in a material form.

The kinds of personal information we collect depend on how you deal with us. They may include:

your name, date of birth and contact details
your occupation and employment details
tax file numbers and other government related identifiers, such as your ABN, Medicare number, driver licence or passport number (see “Tax file numbers and government identifiers” below)
identity documents we need to verify who you are, including under anti-money laundering laws
financial information, such as income, assets, liabilities, bank account details, superannuation, investments and tax records
business, trust and company records, including accounting ledgers, payroll records, receipts and invoices
payment details for our fees
login details for online services you authorise us to use on your behalf
emails, letters and other correspondence with you
notes, recordings and transcripts of meetings and calls with you (see “Artificial intelligence” below)
details of how you use our services, and your responses to client surveys
information about your use of our website, such as browser session details and approximate (not specific) location
images from video surveillance cameras at our premises.

Sensitive information

Sensitive information is a special category under the Act. It includes information or an opinion about a person’s:

racial or ethnic origin
political opinions, or membership of a political association
religious beliefs or affiliations
philosophical beliefs
membership of a professional or trade association, or a trade union
sexual orientation or practices
criminal record
health, genetic or biometric information.

We do not usually collect sensitive information. Sometimes we need it to provide our services, for example health information relevant to a tax deduction or an insurance claim. We will only collect sensitive information with your consent, unless the Act allows us to collect it without consent.

If we receive sensitive information we did not ask for and are not allowed to keep, we will destroy or de-identify it as soon as practicable, where it is lawful and reasonable to do so.

Dealing with us anonymously

You can make general enquiries without identifying yourself, or by using a pseudonym. To act for you as your accountant or tax agent, we need to know who you are. We are also required by law to verify the identity of our clients in some cases.

How we collect, hold and protect it

How we collect it

We collect personal information by lawful and fair means. Where we can, we collect it from you directly, for example when you:

meet with us, call us, email us or write to us
complete forms, questionnaires or proposals
upload documents or use our client portals
visit our website or subscribe to our updates
apply for a job with us.

We also collect personal information from others where you have authorised it, or where you would reasonably expect it. This includes:

the Australian Taxation Office, ASIC and other government bodies, through the online services available to registered agents
your bank, through bank feeds you have connected to your accounting software
your accounting software, superannuation fund, and other advisers such as your solicitor or financial planner
data shared with us under the Consumer Data Right, where you nominate us as your trusted adviser
your representatives, such as your spouse or another person you have nominated
public sources, such as company and business name registers.

If we collect information about you from someone else and you may not be aware of it, we will take reasonable steps to let you know.

Meetings and calls

We may use a dictation and note-taking tool during meetings and calls. If we intend to record or transcribe a meeting or call that you are part of, we will tell you at the start, and you can ask us not to.

How we hold it

We hold personal information in electronic form in our own systems and in cloud-based software provided by our service providers (see “Who we share it with” below). We also hold some records in paper form at our office.

How we protect it

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, change or disclosure. These steps include:

limiting access to staff who need it for their work
passwords, firewalls, anti-virus software and email filtering
choosing service providers with appropriate security, and checking their terms before we use them
a written staff policy on the use of AI tools
training our staff on privacy and information security
physical security at our premises.

How long we keep it

We keep personal information for as long as we need it to provide our services, and for the periods required by law and by our professional obligations. When we no longer need it, we take reasonable steps to destroy it or de-identify it.

limiting access to staff who need it for their work
passwords, firewalls, anti-virus software and email filtering
choosing service providers with appropriate security, and checking their terms before we use them
a written staff policy on the use of AI tools
training our staff on privacy and information security
physical security at our premises.

Artificial intelligence

We use artificial intelligence (AI) tools to help us deliver our services. Client information, including personal information, does go into some of these tools. This section explains which tools, what for, where the information goes and how we control it.

The AI tools we use

Tool	What we use it for	Where information is stored or processed
Claude (Anthropic), business plan	Research, analysis and drafting	Stored in the United States. May be processed in the United States, Europe, Asia or Australia.
Fyxer	Reading emails we receive and drafting replies for our team	Belgium and the Netherlands
Wispr Flow, enterprise plan	Dictation, and notes of meetings and calls	United States
Xero, including its AI assistant JAX	Accounting, and suggestions for coding transactions	Processed by AWS, Microsoft Azure, Google Cloud and OpenAI in various locations, including the United States
Dext	Extracting information from receipts and invoices	Hosted by AWS in various locations
FYI	Document management, including AI summaries and automations. FYI uses Anthropic’s Claude through Amazon Web Services.	AWS in various locations

We may add or change tools from time to time. We will update this policy when we do.

How we control their use

No training on your information. We use business versions of these tools, with settings under which the provider does not use your information to train its AI models.
Review by a qualified person. All advice, returns, financial statements and other work we prepare with the help of AI is reviewed by a senior accountant or partner before we rely on it or it leaves our firm. We keep a record of that review. A partner signs off all work we lodge with the Australian Taxation Office.
Emails. Emails drafted with the help of AI are read and checked by the member of our team who sends them. No AI tool sends anything on its own.
Sensitive identifiers. Our staff must not enter tax file numbers, bank account details, Medicare numbers, or driver licence or passport numbers into general AI tools such as Claude. See “Tax file numbers and government identifiers” below.
We remain responsible. Using AI does not change our responsibility for our advice and our professional judgements.

If you think information an AI tool helped produce about you is wrong, you can ask us to correct it (see “Correcting your information” below).

Automated decisions

We do not make decisions about you using computer programs alone.

Some of the programs we use do things that are substantially and directly related to work that can affect you. For example:

Dext extracts amounts, dates and supplier details from receipts and invoices
Xero suggests how transactions should be coded
FYI suggests how documents should be filed and summarised.

That work feeds into the tax returns, activity statements and financial statements we prepare for you, which affect your tax obligations and entitlements. The personal information these programs use includes your financial transactions, receipts, invoices, bank records and business records. A qualified member of our team reviews the output before we rely on it, as described above.

Why we use it and who we share it with

Why we use it

We collect, hold and use personal information to:

provide our accounting, tax, business advisory and related services
verify your identity and meet our obligations under anti-money laundering and other laws
manage our relationship with you, including billing, payments and collecting overdue fees
deal with enquiries and complaints
meet our professional obligations, including quality reviews by Chartered Accountants Australia and New Zealand
manage our business, insurance and risk, and establish or defend legal claims
send you information about our services, where you have not opted out (see “Direct marketing” below)
recruit staff and contractors.

We only use or disclose personal information for another purpose if you consent, if you would reasonably expect it and it is related to the original purpose, or if the Act otherwise allows it.

Who we share it with

We may disclose personal information to:

the Australian Taxation Office, ASIC, AUSTRAC, the Tax Practitioners Board and other government bodies, when acting for you or when required by law
your other advisers and representatives, where you have authorised it
our service providers, including the AI tools listed above and the software we use to run our practice: Xero, MYOB, Ignition, Class, NowInfinity, Annature, Trust Easy, FYI, Dext, ATOmate and Microsoft 365
Chartered Accountants Australia and New Zealand, as part of its quality review program
our insurers, auditors and professional advisers
potential purchasers of our practice and their advisers, limited to what is reasonably necessary and on a confidential basis
anyone else you authorise, or where the law requires or allows it.

We require our service providers to keep personal information confidential and to use it only to provide services to us.

Disclosure to overseas recipients

We are likely to disclose personal information to recipients outside Australia. This happens mainly because some of our cloud software and AI providers store or process information overseas.

The countries where these recipients are likely to be located are:

United States: Anthropic (Claude), Wispr Flow and Xero, and the website analytics and social media providers listed under “Website and cookies” below
North America: Ignition
Belgium and the Netherlands: Fyxer
Various locations: Dext, FYI and Trust Easy, which use Amazon Web Services in various locations, and the AI providers Xero uses for JAX (AWS, Microsoft Azure, Google Cloud and OpenAI).

Before we disclose personal information overseas, we take reasonable steps to ensure the recipient does not breach the APPs in relation to that information. This includes reviewing the provider’s privacy, security and contract terms. We remain accountable under the Act for how overseas recipients handle personal information we disclose to them.

Tax file numbers and government identifiers

Tax file numbers

As registered tax agents, we collect tax file numbers (TFNs) so we can act for you with the Australian Taxation Office, for example to prepare and lodge your tax returns. We handle TFNs in line with taxation law and the Privacy (Tax File Number) Rule 2015.

You don’t have to give us your TFN. It is not an offence to decline. If you don’t give it to us, we may not be able to provide some services, such as lodging your tax return.
We only use and disclose your TFN as taxation law allows. We do not use it to identify you for any other purpose.
How to give it to us. Please give your TFN to us in person or by phone. Please do not email it.
AI tools. Our staff must not enter TFNs into general AI tools such as Claude. We do not use the AI features of our practice software, such as Xero and FYI, on records or documents that contain TFNs. When you give us your TFN in a meeting or call, we do not record or dictate it using AI tools.
Security. Access to TFNs is limited to staff who need it. Some of our software, such as ATOmate, automatically hides TFNs on documents it captures from the Australian Taxation Office.
Disposal. When we no longer need your TFN for a purpose allowed by taxation law, we take reasonable steps to destroy it or remove it from our records.

Other government identifiers

We do not use a government related identifier, such as your Medicare number, driver licence or passport number, as our own way of identifying you. We only use or disclose these identifiers where:

it is reasonably necessary to verify your identity for our business activities
it is reasonably necessary to meet our obligations to a government agency
it is required or authorised by an Australian law or a court or tribunal order
a permitted general situation under the Act applies, or
it is reasonably necessary for an enforcement related activity by or for an enforcement body.

Website, marketing and job applicants

Website and cookies

When you visit our website or open an email from us, we may collect information about your visit using log files, cookies and tracking pixels.

Log files record details such as your IP address, browser type, internet service provider, the date and time of your visit, and the pages you visit. We use them to run the website and understand how it is used. We do not use your IP address to identify you.
Cookies are small text files stored by your browser. They record things like the pages you visit and the device you use.
Tracking pixels are small graphic files in web pages or emails. They record things like whether an email was opened, clicks, and website activity.

We use these to manage and improve our website and social media pages, understand who visits them, and improve our services. Third parties that may place cookies or pixels through our website include:

Google Analytics (Google LLC), for statistics on visitors and how the site is used
YouTube (Google LLC), to remember settings when you play a video, if you are logged in to YouTube
Meta Platforms, Inc., through the Meta pixel and Facebook and Instagram sharing buttons
LinkedIn Corporation, for its follow and share buttons
X Corp., for its share button.

These providers are based in the United States. You can turn off cookies in your browser settings, but some parts of our website may not work properly if you do.

Direct marketing

We may send you information about our services, events and publications. We will not use sensitive information for direct marketing without your consent. We will not give your personal information to anyone else for their direct marketing without your consent.

Every marketing message we send will tell you how to opt out. You can also opt out at any time by contacting our Privacy Officer. We keep a record of opt-outs and will stop sending you marketing material.

Job applicants

If you apply to work with us, we collect information about your experience, qualifications and character. With your consent, we may also carry out screening checks, such as reference, identity, right to work, qualification, directorship and police checks. Some of these may involve sensitive information, which we only collect with your consent.

We use this information to assess your application and to contact you about roles. We may exchange it with referees, recruiters, screening check providers, education institutions and professional bodies. If you don’t provide the information we ask for, we may not be able to consider your application.

Your rights, data breaches and complaints

Accessing your information

You can ask for access to the personal information we hold about you by contacting our Privacy Officer. We will need to confirm your identity first. We will usually respond within 30 days.

We do not charge you for making a request. If giving you access involves significant work, we may charge a reasonable fee, and we will tell you before we do.

We may refuse access only where the Act allows. For example, where giving access would pose a serious threat to someone’s life, health or safety, would unreasonably affect someone else’s privacy, or relates to legal proceedings between us. If we refuse, we will tell you why in writing, and how you can complain.

Correcting your information

If you think information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, please tell our Privacy Officer. This includes information produced with the help of AI tools. We will take reasonable steps to correct it, usually within 30 days, and there is no charge.

If we don’t agree that a correction is needed, we will tell you why in writing and how you can complain. You can also ask us to attach a statement to the information saying you believe it is wrong. Where appropriate, we will tell third parties we have shared the information with about the correction.

Data breaches

If there is unauthorised access to, disclosure of, or loss of personal information we hold, and it is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Act.

Complaints

If you have a concern about how we have handled your personal information, please contact our Privacy Officer. We will acknowledge your complaint promptly and aim to resolve it within 30 days.

If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC):

website: www.oaic.gov.au
phone: 1300 363 992
post: GPO Box 5288, Sydney NSW 2001.

The OAIC may decline to investigate if you have not first raised the complaint with us.

If your complaint is about a tax agent service, you can also complain to the Tax Practitioners Board at www.tpb.gov.au/complaints.

Changes to this policy

We will update this policy from time to time, including when we change the AI tools or service providers we use. The date at the top shows when it was last updated.

Contact us

The Privacy Officer

MJT Partners Pty Ltd

234 Marius Street, Tamworth NSW 2340

Phone: (02) 6766 7366

Email: admin@mjtpartners.com.au