1. About this Policy
Atomic Business Advisers Pty Ltd (Atomic Business Advisers, ABA, we, us or our) respects the privacy and confidentiality of the people we deal with.
This Privacy Policy explains how we collect, hold, use, disclose, protect and otherwise manage personal information.
We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) where they apply to us. We also apply the principles of responsible, secure and transparent information handling as a general standard across our practice.
As an accounting and tax practice, we are also subject to additional confidentiality, identification, record-keeping and information-handling obligations under taxation, professional and other regulatory requirements, including applicable Tax Practitioners Board and AML/CTF requirements.
This Privacy Policy should be read together with our Terms of Engagement and, where applicable, our Third-Party, Cloud, Technology & Outsourced Service Provider Schedule.
This Policy does not itself constitute consent to any use of personal information for which specific consent is required. Where specific consent is necessary, we will seek it separately or through an appropriate engagement term or collection notice.
2. What is personal information?
Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable.
It can include information that directly identifies a person, such as their name, as well as information which identifies a person when combined with other information.
Some information receives additional protection under Australian law, including sensitive information and individual tax file number information.
3. What personal information do we collect and hold?
The personal information we collect depends on who you are, the services we provide and the nature of our dealings with you.
We may collect and hold information including:
- name, address, telephone number and email address;
- date and place of birth;
- citizenship, residency and tax residency information;
- family and personal relationships relevant to the services we provide;
- employment, occupation, business and directorship information;
- Australian Business Numbers, Australian Company Numbers and Director Identification Numbers;
- tax file number information where lawfully required;
- taxation records, tax returns and assessments;
- financial statements, accounting records, general ledgers and transaction information;
- bank and financial information;
- superannuation and investment information relevant to our services;
- property and asset information;
- loan, finance and liability information;
- payroll and employee information contained within client records;
- information about companies, trusts, partnerships, superannuation funds and other entities with which you are associated;
- information about beneficial ownership, control and persons acting on behalf of clients;
- identity-verification information;
- information relevant to AML/CTF customer due diligence, including politically exposed person, sanctions, source-of-funds and source-of-wealth information where required;
- correspondence, meeting notes, telephone records, recordings and transcripts where applicable;
- information contained in documents provided to us by you or others;
- information generated through accounting, tax, advisory and other professional work;
- information provided through our website, client portal and other electronic systems;
- website, device and online interaction information;
- payment and billing information;
- complaints and enquiry information; and
- recruitment information, including resumes, employment history, qualifications and referee information.
We may occasionally receive sensitive information, such as health information or other information protected as sensitive information under the Privacy Act, where it is relevant to our services or appears within information provided to us.
We only seek to collect sensitive information where it is reasonably necessary and where its collection is permitted by law, including where required consent has been obtained.
4. Information about other people
Our clients often provide information concerning other individuals, including:
- spouses and partners;
- family members;
- employees;
- directors;
- trustees;
- beneficiaries;
- shareholders;
- customers;
- suppliers;
- business partners; and
- representatives.
Where you provide personal information about another person, you should ensure that you are authorised to provide it and that any notifications or permissions reasonably required in the circumstances have been addressed.
This does not remove our own obligations concerning the collection, use, disclosure and protection of that information.
5. How do we collect personal information?
Where practical, we collect personal information directly from the individual concerned or from an authorised representative.
We may collect information:
- during meetings, telephone calls and correspondence;
- through email, electronic forms and secure client portals;
- from documents and records supplied to us;
- through accounting, taxation, payroll, financial and other software integrations;
- from banks, financial institutions and other financial-data sources where appropriately authorised;
- from an Accredited Data Recipient where you nominate us as a Trusted Adviser under the Consumer Data Right;
- from current or former accountants, bookkeepers and professional advisers;
- from lawyers, financial advisers, mortgage brokers and other advisers;
- from employers, superannuation funds and financial institutions;
- from the Australian Taxation Office;
- from ASIC, the Australian Business Register, Revenue NSW and other government or regulatory systems;
- through approved identity-verification and client-onboarding providers;
- from publicly available registers, websites and other lawful public sources;
- from referrals;
- from recruitment applications and referees; and
- through our website, cookies, analytics and related technologies.
Where we collect information from someone other than you, we will take reasonable steps to provide any notification required by applicable privacy law.
6. Why do we collect, hold, use and disclose personal information?
We may collect, hold, use and disclose personal information for purposes including:
- providing accounting, taxation, business advisory, SMSF and other agreed professional services;
- understanding your affairs and circumstances;
- preparing financial statements, taxation returns, reports, calculations and workpapers;
- performing accounting analysis, reconciliations and data review;
- communicating with you and people authorised to act on your behalf;
- administering our client relationship;
- client acceptance, onboarding and verification;
- complying with Tax Practitioners Board requirements;
- complying with AML/CTF obligations;
- complying with taxation, corporations, professional and other legal obligations;
- detecting and managing fraud, security, financial crime and regulatory risk;
- lodging information with government and regulatory authorities where authorised or required;
- billing, collecting fees and administering payments;
- obtaining professional advice or insurance;
- internal risk management, quality control, supervision and professional review;
- maintaining and improving our systems and processes;
- business continuity, backup and information security;
- responding to enquiries and complaints;
- recruitment and employment administration;
- communicating information about changes in tax law, business matters and our services; and
- other purposes authorised or required by law or agreed with you.
Where we propose to use personal information for a materially different purpose that is not otherwise permitted, we will obtain any consent required by law.
7. Tax file number information
Tax file number (TFN) information is subject to additional protection under the Privacy (Tax File Number) Rule 2015 and applicable taxation law.
We collect, record, use and disclose individual TFN information only where authorised by law.
Our internal controls include restricting access to TFN information and minimising unnecessary disclosure.
As a general ABA rule, TFNs are removed from ordinary external artificial-intelligence workflows unless their inclusion has been specifically assessed as lawful, necessary and approved.
Where TFN information is no longer required and there is no legal basis for retaining it, we take reasonable steps to securely destroy or appropriately de-identify it.
8. Client identification and AML/CTF information
We are required in various circumstances to establish and verify the identity of clients, representatives, beneficial owners, controllers and other relevant persons.
Where AML/CTF obligations apply, we may also collect information concerning:
- beneficial ownership and control;
- persons acting on behalf of a client;
- authority to act;
- the nature and purpose of a business relationship or transaction;
- politically exposed person status;
- targeted financial sanctions;
- source of funds;
- source of wealth;
- customer risk; and
- other information reasonably required to comply with applicable AML/CTF requirements.
We currently use approved client-verification and onboarding technology which may include BGL Firm Verify, Seamlss and Annature.
Approved providers may need to process identity documents and other personal information as part of the verification process.
ABA does not routinely retain copies or images of passports, driver licences or other full identification documents merely to demonstrate identity verification where this is not required.
Instead, we generally retain the verification result, certificate, audit evidence and other records reasonably required to demonstrate compliance.
If an identification document is otherwise received by ABA, we will retain, destroy or de-identify it in accordance with applicable law, our regulatory obligations and our information-retention requirements.
We may be required to disclose information to AUSTRAC or other authorities. In some circumstances, applicable law may restrict what we are permitted to tell an individual about a report, enquiry or regulatory action.
9. Our use of technology, cloud services and artificial intelligence
Technology, automation and artificial intelligence are used throughout our practice to improve the quality, consistency and efficiency of our work.
We may use approved systems for purposes including:
- document and data extraction;
- accounting and taxation analysis;
- classification of transactions;
- bank and account reconciliations;
- identification of unusual transactions, errors or possible misallocations;
- preparation and review of accounting journals and workpapers;
- financial analysis;
- taxation analysis and research;
- calculations;
- document preparation;
- meeting transcription and summarisation;
- workflow management;
- quality control; and
- administrative support.
This may involve approved technology processing financial statements, accounting records, general ledgers, bank statements, taxation records, workpapers, correspondence and other information relevant to the services we provide.
10. Artificial intelligence controls
Identifiable client information may only be used with artificial-intelligence systems approved by ABA for professional use.
For general-purpose generative AI, ABA’s policy is to use firm-controlled business or enterprise environments, rather than staff personal consumer AI accounts.
Our currently approved general-purpose environment includes OpenAI’s ChatGPT Business. OpenAI currently states that inputs and outputs from ChatGPT Business are not used to train its models by default. This position is subject to our ongoing vendor and system review. OpenAI
When using external AI systems, we apply data-minimisation controls appropriate to the task.
As a normal practice:
- TFNs are removed from ordinary external-AI workflows;
- full bank account numbers are removed or masked where the complete number is unnecessary;
- passports, driver licences and other identity documents are not uploaded into ordinary general-purpose AI workflows;
- unnecessary employee and third-party identifiers are removed or replaced where practical; and
- passwords, internet-banking credentials, authentication codes, security answers and similar access credentials must not be entered into AI systems.
Artificial intelligence is used to assist our people. It does not replace our professional responsibility.
Material professional outputs are subject to appropriate human review and verification.
11. Atomic AI and technology development
ABA works with Atomic AI Pty Ltd (ABN 82 686 869 787) in connection with artificial intelligence, automation, technology development, maintenance and support.
Atomic AI may process identifiable client information where this is reasonably necessary to develop, maintain, test or operate technology used in providing ABA’s services.
A different issue arises where identifiable personal information is proposed to be used for a separate purpose such as:
- training or fine-tuning an AI model;
- developing a commercial technology product unrelated to providing the relevant client’s services;
- broader research;
- benchmarking; or
- product improvement.
Where the use or disclosure is not otherwise permitted by law, ABA will seek an appropriately informed and specific consent before using identifiable personal information for that separate purpose.
Where practical, we prefer to use de-identified information for technology development, testing, research and benchmarking where identification is not necessary.
Acceptance of this Privacy Policy by itself is not treated as consent for separate identifiable-personal-information AI model training or unrelated product development.
The OAIC specifically cautions that AI-training consent should not be buried in broad privacy-policy consent and that organisations should be explicit where personal information is used for AI training. OAIC
12. Automated decision-making
ABA currently uses artificial intelligence and automation principally as assistive tools.
We do not currently rely solely on an automated system to make material professional decisions that could reasonably be expected to significantly affect an individual’s rights or interests.
Material accounting, taxation, client-acceptance and professional decisions remain subject to appropriate human judgement and review.
If our use of automated decision-making materially changes, we will update this Policy and our practices to address applicable legal requirements.
This is also useful future-proofing: additional APP privacy-policy requirements dealing with significant automated decisions commence on 10 December 2026. OAIC
13. Recording and transcription of meetings and calls
We may use approved systems to record or transcribe meetings and telephone conversations for purposes such as:
- preparing file notes;
- preparing meeting summaries;
- recording agreed actions;
- improving accuracy;
- providing professional services; and
- quality control.
Where recording or transcription technology is used, we will notify participants and obtain consent where required.
Recordings and transcripts may be processed by approved providers identified in our Third-Party, Cloud, Technology & Outsourced Service Provider Schedule.
Access to recordings and transcripts is restricted in accordance with our information-security and confidentiality arrangements.
14. Third-party service providers
We use third-party providers to assist us in providing our services and operating our practice.
These may include providers of:
- accounting and taxation software;
- document management;
- cloud hosting and storage;
- client portals;
- electronic signatures;
- practice management;
- communications;
- payment processing;
- outsourced accounting and taxation services;
- audit services;
- identity verification;
- AML/CTF compliance;
- artificial intelligence;
- automation;
- technology support;
- meeting transcription;
- marketing and communications; and
- information security.
Our current material providers, the purposes for which they are used and their relevant service/processing locations are described in our Third-Party, Cloud, Technology & Outsourced Service Provider Schedule.
Not every listed provider is used for every client.
15. Other people and organisations to whom we may disclose information
We may disclose personal information, where appropriate, to:
- people authorised by you;
- your spouse or partner where authorised under the relevant engagement arrangements;
- lawyers, financial advisers, mortgage brokers and other advisers where authorised or otherwise permitted;
- the Australian Taxation Office;
- the Tax Practitioners Board;
- AUSTRAC;
- ASIC;
- Revenue NSW and other government bodies;
- professional bodies and professional quality-review programs;
- auditors;
- insurers and insurance advisers;
- professional advisers acting for ABA;
- banks and payment-service providers;
- debt-collection or legal service providers where reasonably necessary;
- outsourced professional service providers;
- technology, cloud and software providers;
- law-enforcement bodies and courts where required or authorised;
- a potential purchaser, investor or successor to all or part of our practice, subject to appropriate confidentiality protections; and
- other persons where you have given permission or disclosure is otherwise permitted by law.
16. Overseas disclosure and processing
Some of the providers we use operate outside Australia or use overseas infrastructure, personnel or subprocessors.
Depending upon the particular services used, personal information may be disclosed to recipients located in countries including:
the United States, the Philippines, India, Japan, New Zealand, Singapore, Canada, the United Kingdom, Ireland, Germany, other European Union countries and Taiwan, as well as other jurisdictions identified in our current provider schedule.
The precise location depends on the provider, the service used and its authorised subprocessors.
Our Third-Party, Cloud, Technology & Outsourced Service Provider Schedule contains more detailed and regularly reviewed information about relevant providers and locations.
Before disclosing personal information overseas, we take reasonable steps appropriate to the circumstances to assess and manage the privacy, confidentiality and security arrangements applying to the recipient.
These steps may include contractual protections, security assessments, data-minimisation controls and review of provider data-handling arrangements.
APP 1 requires a privacy policy to disclose likely overseas recipients and, where practicable, their countries; APP 8 also requires reasonable steps in relation to overseas disclosures and can make an Australian entity accountable for overseas recipient conduct in certain circumstances. OAIC
17. How we hold and protect personal information
Personal information may be held:
- electronically within ABA systems;
- within approved cloud platforms;
- within secure client portals;
- within approved software used to provide our services;
- by approved outsourced or technology providers;
- within email and communication systems;
- within backups and business-continuity systems; and
- in limited circumstances in physical records.
Our Client Portal uses Microsoft SharePoint.
We take reasonable technical and organisational steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.
Depending on the circumstances, these measures may include:
- role-based and need-to-know access;
- multi-factor authentication;
- secure client portals;
- network, endpoint and malware protection;
- secure backup arrangements;
- encryption provided through approved systems;
- staff privacy, security and AI training;
- access monitoring and audit controls;
- service-provider due diligence;
- confidentiality requirements;
- incident-response procedures; and
- appropriate physical security.
No information system can be guaranteed to be completely secure. We continually review our controls having regard to the nature and sensitivity of the information we hold.
APP 11 requires reasonable technical and organisational measures and also requires destruction or de-identification when personal information is no longer needed, and no retention requirement applies. OAIC
18. How long do we retain personal information?
We retain information for as long as reasonably necessary for:
- the purpose for which it was collected;
- providing our services;
- responding to professional or regulatory enquiries;
- defending or managing legal or professional claims;
- maintaining appropriate business records; and
- meeting taxation, AML/CTF, professional and other legal obligations.
Different information is subject to different retention periods.
For example, professional, tax-agent and AML/CTF records can be subject to multi-year statutory retention requirements.
Information contained in backups or archives may remain until the applicable backup or archival cycle expires.
When personal information is no longer required, and we are not required or permitted by law to retain it, we take reasonable steps to securely destroy it or de-identify it.
19. Data breaches
We maintain processes for identifying, investigating and responding to suspected privacy and data-security incidents.
Where the Notifiable Data Breaches scheme applies and a data breach is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner where required.
The NDB scheme requires notification in those circumstances for organisations covered by the Privacy Act. OAIC
20. Website, cookies and analytics
Our website may use cookies, pixels and similar technologies.
These technologies may collect information such as:
- IP address;
- device and browser information;
- pages viewed;
- time spent on pages;
- links selected;
- referring websites;
- approximate location; and
- interactions with website content and marketing.
We currently use or may use services including:
- Duda analytics;
- Google Analytics;
- Meta/Facebook/Instagram technologies;
- Mailchimp analytics; and
- other approved website and marketing tools.
Some of these providers may process information outside Australia.
Cookies and analytics help us understand website usage, improve our website and services and measure the effectiveness of communications and marketing.
Where tracking technologies involve personal information for direct marketing or targeted advertising, we will manage their use consistently with applicable privacy and marketing requirements.
You can manage cookies through your browser settings and through any website privacy or cookie controls made available by us.
The OAIC’s current guidance specifically recognises that tracking pixels can involve personal information and that transparency and appropriate opt-out mechanisms may be required. OAIC
21. Direct marketing
Where permitted by law, we may use contact information to send:
- taxation and legislative updates;
- business information;
- newsletters;
- invitations;
- educational material;
- information about ABA services; and
- other communications we reasonably believe may be relevant.
We comply with applicable requirements under the Privacy Act, the Spam Act 2003 and other relevant marketing laws.
You may opt out of marketing communications at any time using the unsubscribe facility provided or by contacting us.
Opting out of marketing does not prevent us from sending communications reasonably required to:
- provide professional services;
- administer an engagement;
- meet legal or professional obligations;
- send invoices or account information; or
- provide other essential client communications.
Where APP 7 applies, individuals must be given a simple way to opt out and an opt-out request must be honoured. OAIC
22. Consumer Data Right information
Where you nominate ABA as a Trusted Adviser under the Consumer Data Right, an Accredited Data Recipient may disclose CDR data to us in accordance with your instructions and applicable CDR requirements.
We use information received in this capacity only for the purposes for which it has been provided to us and otherwise handle it in accordance with applicable legal, professional, confidentiality and security requirements.
23. Can you deal with us anonymously?
Where it is lawful and practical, you may make a general enquiry without identifying yourself or by using a pseudonym.
However, this will generally not be possible where we are providing accounting, taxation or other professional services because we may need to know who you are to:
- perform the service;
- comply with taxation requirements;
- verify authority;
- satisfy client-identification obligations; or
- comply with AML/CTF and other laws.
If required information is not provided, we may be unable to provide some or all services.
24. Access to your personal information
You may request access to personal information we hold about you.
Before providing information, we may need to verify your identity and authority.
We will deal with access requests within a reasonable period and in accordance with applicable law.
In some circumstances, we may be permitted or required to refuse access to some information. Where required, we will explain the reason for refusal and the available complaint mechanisms.
25. Correction of personal information
We take reasonable steps to keep personal information accurate, up to date, complete, relevant and not misleading, having regard to the purpose for which it is held.
If you believe information we hold about you is incorrect, please contact us.
Where appropriate, we will take reasonable steps to correct the information and, where required and requested, notify relevant recipients of the correction.
APP 1 requires the Privacy Policy to explain access and correction procedures, while APPs 12 and 13 provide the substantive access and correction framework. OAIC
26. Privacy enquiries, access and correction requests
Please contact:
Privacy Contact
Atomic Business Advisers Pty Ltd
PO Box 444
Earlwood NSW 2206
Australia
Telephone: 02 9784 2000
Email: support@atomicba.au
You may also contact us at:
Shop 2, 17–25 William Street
Earlwood NSW 2206
Australia
The current ABA website confirms those office and postal details. Atomic Business Advisers
27. Privacy complaints
If you believe we have not handled your personal information appropriately, please contact us using the details above.
Please provide enough information for us to understand and investigate the concern.
We aim to acknowledge a privacy complaint within approximately three business days and to investigate and respond within a reasonable period, ordinarily within 30 days.
If you are not satisfied with our response, you may be entitled to lodge a complaint with the Office of the Australian Information Commissioner (OAIC).
The OAIC’s APP 1 guidance recommends first raising a privacy complaint with the organisation and generally allowing around 30 days for it to respond before escalation. OAIC
28. Links to third-party websites
Our website may contain links to websites operated by third parties.
Those websites are responsible for their own privacy practices and are not controlled by ABA.
We encourage you to review the privacy information provided by any third-party website before providing personal information through it.
29. Changes to this Privacy Policy
Our information-handling practices, technology, service providers and legal obligations change over time.
We may update this Privacy Policy to reflect:
- changes in law or regulatory guidance;
- new or changed technology;
- new service providers;
- changes in our services;
- changes in our information-handling practices; or
- improvements to our privacy and security framework.
The current version will be published on our website and will identify its effective date and last-updated date.
Where a change requires specific notice or consent, publishing an updated Privacy Policy will not replace that separate requirement.
