Privacy and credit reporting policy

Applies to: Australia
Effective from: 24/02/2025

William Buck is a network of professional services firms with offices in Australia and New Zealand. In this Privacy and Credit Reporting Policy, ‘William Buck’, ‘we’, ‘us’ and ‘our’ mean all firms carrying on business under the name of William Buck and includes all related bodies corporate and other associated entities. You may obtain a copy of our current Privacy and Credit Reporting Policy from our website or via a request made to the relevant Privacy Officer (as noted below).

We respect your privacy

William Buck respects your privacy and is committed to treating the personal information we collect in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth) (Privacy Act) and APES 110 Code of Ethics for Professional Accountants (including Independence Standards).

This Privacy and Credit Reporting Policy (Policy) outlines how William Buck collects, manages and uses the personal information as well as the credit related information (as defined in the Annexure) we hold about our clients, potential clients, contractors and others (as applicable). This includes information such as your name, email address, identification number, or any other type of information that can reasonably identify an individual, either directly or indirectly.

Annexed to this document, is the Credit Reporting component of this Policy, which specifically outlines how William Buck collects, holds, uses and discloses credit related information (as defined in the Annexure) about our clients, potential clients and others. The Annexure is to be read in conjunction with the general clauses of this Policy.

This Policy does not apply to acts or practices that are directly related to employee records of current or former employees.

If you would like further information on this Policy, you may contact us at the relevant email addresses at the bottom of this page.

Personal information we collect and hold

As a provider of accounting and advisory services we are subject to certain legislative and regulatory requirements which necessitate us obtaining and holding detailed personal information. The type of personal information we collect and hold depends on the nature of our engagement.

The main types of personal information we collect and hold include (but are not limited to):

• Names
• Contact details such as address, email address, phone and mobile numbers, Internet Protocol (IP) address
• Gender
• Dates of birth
• Photographs, images or videos in which you are included
• Employment details, employment history and information provided in connection with a job application you submit to us
• Tax File Numbers
• Details of your financial circumstances, including bank account details, your assets and liabilities (both actual and potential), income, expenditure, credit related information, insurance cover and superannuation
• Health information (eg for some types of insurance cover)
• Details of your investment preferences and aversion or tolerance to risk (if a wealth advisory client)

We will not collect any personal information about you except when you have knowingly provided that information to us, authorised a third party to provide that information to us or subsequently consented to us holding and using the information.

Sensitive information

In some circumstances, we may need to collect sensitive information about you to provide specific services to you. Sensitive information is defined by the Privacy Act and includes information about a person’s race, ethnicity, gender identity, sexual orientation or practices, disability, ethnic origin, political opinions or associations, health or genetic information, some aspects of biometric information, religious or philosophical beliefs, trade union membership and criminal history.

We will only collect and use sensitive information with your consent and only for the purpose for which it was provided or a directly related secondary purpose, in accordance with applicable laws, or in a de-identified aggregated manner. If you do not consent to the collection and use of your sensitive information, we may not be able to provide you with certain services.

Personal information of others

You may need to provide us with personal information about other individuals, such as your spouse, dependents, or other family members or employees. If so, we rely on you to have informed those individuals that you are giving their personal information to us, and that you have the necessary authority to do so. You should also advise them about this Policy and how they can obtain a copy of it.

How we collect your personal information

We collect your personal information from a variety of sources, including:

• Directly from you: This includes information you provide to us when you interact with us in person, over the phone, via email or through our website or social media channels. For example, you may provide us with your name, email address, phone number, and other contact information. You may also provide us with information about your employment, education, or financial situation. In some circumstances, we may take photographs or videos of individuals, for example at events we run or sponsor, seminars, or for promotional purposes.
• From outside sources: This includes information we may obtain from third parties, such as your employer, staff, representative(s), family members or spouse, marketing mailing lists, public records, and commercially available databases. You have a right to refuse us authorisation to collect information from a third party.

Due to the nature of our business, it is generally impractical for us to deal with individuals anonymously or with a pseudonym. This is because we need to be able to identify individuals to provide them with the services they request, to protect their privacy, and to comply with legal requirements.

How we use your personal information

Generally speaking, William Buck will only use personal information for the particular purpose for which it was collected, though there are some exceptions to this under the Privacy Act. or if we are otherwise expressly permitted to do so by law. The purposes for which we may collect, hold and use your personal information include to:

1. provide you with products and services during the usual course of our business activities;
2. administer our business activities (including our client acceptance and reacceptance procedures);
3. provide, improve and manage our products and services and those of all William Buck member firms;
4. conduct recruitment activities;
5. manage, research and develop our products and services;
6. provide you with information about our products and services, invite you to events or distribute articles or publications (noting that you may unsubscribe from any marketing communications at any time);
7. respond to, or comply with laws, regulations, rules or professional standards;
8. communicate with you by a variety of measures including, but not limited to, by telephone, email, SMS or mail; and
9. investigate any complaints.

You have a right not to provide information that can identify you. If, however, you withhold your personal information, it may not be possible for us to provide you with our products and services, or alternatively, it may affect the adequacy or appropriateness of advice or services provided.

If there is a change of control in our business or a sale or transfer of business assets, we reserve the right to transfer to the extent permissible at law our user databases, together with any personal information and non- personal information contained in those databases.

Employee records are not generally subject to the Privacy Act and therefore this Policy may not apply to the handling of information about employees at William Buck. For more information about our practices relating to employee information, please contact us directly using the details below or your People & Culture or Human Resources contact.

Marketing communications

Occasionally, we might use and disclose your personal information to keep you informed about our services and products.

We do not engage in any spamming or the selling, or renting of website visitors’ email addresses. We are committed to safeguarding your privacy and respecting your communication preferences.

If there comes a point when you no longer wish to receive marketing communications directly from us, you have the following options:

• Use the opt-out link provided within materials related to direct marketing.
• Contact your local William Buck office via email or phone to opt-out.

Unsolicited personal information

There may be times when we receive personal information that we do not solicit. If this occurs, we will determine if you have given your consent and the information is necessary for us to provide our services, or whether the collection is required or authorised by or under an Australian law or a court/tribunal order. If it is, the information will be dealt with in accordance with the Australian Privacy Principles as if the information had been solicited.

If it is determined that we could not have lawfully obtained this information, we will destroy or de-identify the information as soon as practicable, provided it is lawful and reasonable to do so.

Disclosure of personal information to third parties

In providing our services we may need to disclose personal information to a third party. This will be done to the extent that it is permitted by law and set out in this Policy.

Examples of the types of third parties we may disclose personal information to include:

• Member firms of the William Buck Group and their related bodies corporate and other associated entities.
• Companies or individuals contracted to assist us in providing services or who perform functions on our behalf (such as mailing houses, specialist consultants, barristers and solicitors, contractors, information technology service providers, superannuation fund trustees, insurance providers, fund managers, market research organisations and other product or service providers).
• Courts, tribunals and regulatory authorities, as required or authorised by law and in accordance with the Code of Ethics for Professional Accountants and any other such professional codes as applicable to William Buck.
• Auditors or compliance officers, as required by law or relevant professional associations.
• Anyone else where you have given consent, such as banks, accountants and other financial institutions.

Our client files (including your files and documents) may be subject to review as part of the quality review programs of our professional associations, for example Chartered Accountants Australia and New Zealand, CPA Australia or the Financial Planning Association of Australia, that monitor our compliance with mandatory professional standards or our own quality monitoring program. The Corporations Act 2001 (Cth) also provides the Australian Securities and Investments Commission with the authority to inspect our client files. Compliance with these programs may involve the disclosure of your personal information. The same strict confidentiality requirements apply under these programs as apply to us as your advisor, consultant, accountant or auditor.

Where you engage us to attend to your tax affairs we will assume (unless you advise otherwise) that you have specifically authorised us to deal directly with the Australian Tax Office and New Zealand Inland Revenue regarding day to day matters. If, in the course of our dealings with these bodies, they request information regarding you that we believe is outside of such matters, e.g. a tax office audit, we will request your specific authority before complying with their request.

If we are required by law or professional obligations to disclose information about you or your organisation, we must co-operate fully. However, where possible we will advise you of this fact.

Security of your personal information

William Buck is committed to ensuring that the information you provide to us is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure information and protect it from misuse, interference, loss and unauthorised access, modification and disclosure. This includes with respect to our third-party suppliers and vendors to the extent they are required to access, store or manage personal information in order to provide their services to William Buck and our clients.

Our employees are required to respect the confidentiality of personal information and the privacy of individuals, and privacy and data protection training is undertaken. As part of that training, all employees are required to read this Policy and understand their obligations in respect to personal information.

Where we employ data processors to process personal information on our behalf, we only do so on the basis that such data processors comply with the requirements under the Privacy Act and GDPR and have adequate measures in place to protect personal information from unauthorised use, loss and theft.

While we take all reasonable steps to protect your personal information, we cannot guarantee that personal information that we collect will not be disclosed in a manner that is inconsistent with this Policy. In particular, the electronic transmission of personal information by you to us will be at your own risk.

We will retain your personal information only as long as necessary to fulfil the purpose for which it was collected, as required by law and the Australian Privacy Principles, or in accordance with our documentation retention policies.

Hosting and international data transfers

Depending on the nature of the engagement or circumstances of personal information collection, we may disclose your personal information to entities overseas for any purpose for which we are entitled to use your information.

For instance, William Buck has offices and/or facilities in Australia, New Zealand, the Philippines and India. Our suppliers and contractors may be located in Australia and New Zealand or other countries, in particular, the EU, the UK, USA, the Philippines and India. The hosting facilities for our website are situated in Australia. We may also store, process or back up your personal information on servers that are located overseas (including through third party service providers). These servers are commonly located in (but are not limited to) USA, the UK, the Netherlands, Ireland and Singapore.

There will be circumstances in which the disclosure of the information is required or authorised by Australian or New Zealand law or a court/tribunal order, the Code of Ethics for Professional Accountants, or where you have given your direct consent to disclose it.

Keeping personal information up to date

We endeavour to ensure that the personal information we hold is accurate, complete and up-to-date. Changes inevitably are required and unfortunately errors do occur from time to time. Under the Privacy Act you have a right to request correction of your personal information which is held by us. You should contact us immediately in order to request any changes to the personal information we hold about you.

Data breach notifications

William Buck is committed to protecting the privacy of your personal information. If there is a data breach that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable.

A data breach is a security incident that results in the unauthorised access, disclosure, or loss of personal information. Serious harm may include physical, psychological, emotional, financial or reputational harm.

Our mandatory data breach notification policy and procedures

Our Mandatory Data Breach Notification Policy and Procedures govern how we will address any suspected or actual data breaches. The policy and procedures set out the steps we will take to investigate and respond to data breaches.

Our websites and applications online

When you visit our websites

When you visit our websites (www.williambuck.com and www.williambuck.com/nz) and our applications including mobile applications, we may collect certain information such as browser type, operating system, website visited immediately before coming to our site, etc. This information is used in an aggregated manner to analyse how people use our site, such that we can improve our service.

We may also collect personal information through subscription applications, event registration and emails. You are not required to provide personal information via our websites; however, you may choose to do so in order to receive communications on our services, apply for an employment position or receive invitations to events. Information collected via our digital marketing activities is treated in accordance with this Policy.

Cookies and other technologies

We may use cookies on our websites. Cookies are small text files which a website uses to identify you when you come back to the site and to store details about your use of the site. They are widely used to make websites work more efficiently, as well as to provide information to site owners.

Cookies are not malicious programs that access or damage your computer. Most web browsers automatically accept cookies, but you can choose to reject cookies by changing your browser settings. However, this may prevent you from taking full advantage of our websites. Our websites may use cookies to analyse website traffic and help us provide a better visitor experience.

In addition, cookies may be used to serve relevant advertisements to website visitors through third party services such as Google AdWords. These advertisements may appear on our websites or other websites you visit.

We may also use other technologies, such as web beacons, clickstream and data analytics, on some of our websites and through email to automatically collect certain types of information. The collection of this information helps us customise and personalise your online experience (including improving our online presence). We may also use this information for development and analytics purposes. You can customise your experience with these technologies by adjusting the privacy and browser settings on your device.

Third party sites

Our websites may from time to time have links to other websites not owned or controlled by us. These links are meant for your convenience only. Links to third party websites do not constitute sponsorship or endorsement or approval of these websites. Please be aware that William Buck is not responsible for the privacy practices of other such websites. We encourage our users to be aware, when they leave our website, to read the privacy statements of each and every website that collects personal identifiable information.

Social media platforms

You may wish to participate in the various social media platforms hosted by us and which we make available to you. These platforms are designed to facilitate and share content. We cannot be held responsible if you publicly share personal information on these sites that is subsequently used, misused or otherwise appropriated by another party/entity.

When you provide personal information on any William Buck social media platform, that information may be shared with other users of that platform. We have limited or no control over how other users of that platform may use or share your personal information.

Changes to Privacy and Credit Reporting Policy

Please be aware that this Policy may be updated as and when required, for example, to take into account new laws, changes to our operations and practices, changes in the business environment and technology. We may modify this Policy at any time, in our sole discretion and all modifications will be effective immediately upon our posting of the modifications on our websites. Please check back from time to time to review this Policy.

Access to your personal information and credit related information

Under the Privacy Act you have a right to request access to personal information and certain credit related information held by us. You may request details of personal information and credit related information that we hold about you in accordance with the provisions of the Privacy Act and the GDPR (only to the extent applicable). If you would like a copy of the information which we hold about you or believe that any information we hold on you is inaccurate, out of date, incomplete, irrelevant or misleading, please contact the Privacy Officer for the relevant office via the contact details below.

We reserve the right to refuse to provide you with information that we hold about you in certain circumstances permitted by the Privacy Act or any other applicable law. If access is denied, we will explain the reason why it is denied. We will require you to verify your identity and to specify what information you require. We may charge reasonable costs for providing you with access to your personal information or credit related information.

Corrections and complaints

If you believe that personal information or credit related information we hold about you is incorrect or out of date, or if you have any concerns about how we are handling your personal information, please contact us using the below options and we will try to address those concerns.

If you have a complaint about our privacy practices, please send details of your complaint to the relevant email address below. We take complaints very seriously and will respond shortly after receiving written notice of your complaint. If you are not satisfied with our handling of your problem or compliant you may make a complaint to the Office of the Australian Information Commissioner (OAIC) (https://www.oaic.gov.au/contact-us).

If you would like access to your personal information or credit related information, or have any questions about privacy-related issues, you should contact the Privacy Officer in your local office via the contact details below.