1. Purpose of the policy
BDO is committed to protecting the privacy of personal information obtained through its operations as a professional services firm. BDO is bound by the Privacy Act 1988 (Cth) (Privacy Act), including the Australian Privacy Principles (APPs) and any relevant privacy code registered under the Privacy Act.
2. Policy Statement
The 13 Australian Privacy Principles apply to personal information, that is, information or an opinion (whether true or not) relating to an identified individual or which can be used to identify that individual. Please note that information about companies is not personal information. However the principles will apply to an individual who is carrying on a business as a sole trader. All BDO offices in Australia are subject to policies and procedures that seek to ensure that the organisation complies with the Australian Privacy Principles.
3. The kinds of personal information we collect and hold
BDO collects personal information that is reasonably necessary for, or directly related to, its functions or activities, e.g. audit services, taxation advice and services, corporate finance, insolvency, financial planning and similar business activities. The specific types of personal information BDO may collect and hold includes the following:
- contact details;
- business/mailing address;
- nature of business;
- advice received from the client or prospective client that may contain additional personal information, such as family relationships and other business-related connections;
- qualifications, memberships and other accreditations; and
- financial records.
As set out below, BDO also collects certain information that is not directly and specifically provided by third parties, such as an IP address, browsing pattern on the site, click stream, and the status of cookies placed on a computer. BDO does not collect any personal information other than information reasonably necessary for, or directly relating to, the primary purpose for which BDO has been engaged or may be engaged, or its other functions and activities.
4. How we collect personal information
BDO only collects personal information that has been directly provided to us by our clients or prospective clients, associates of clients, our suppliers or potential suppliers, our employees or potential employees, or is otherwise available in the public domain where this information will assist us with the provision of services to our current and prospective clients. Information may have been provided verbally or in writing (including by email or through web forms).
BDO may from time to time collect personal information concerning an associate of a client or a prospective client (e.g. a spouse or a child) where it is considered unreasonable or impracticable to seek this same information directly from the associate.
By way of example, we may at times seek personal information such as a name, address, date of birth and similar personal information directly from a client in relation to their associate (for example, their spouse, de-facto partner or their children) where we are satisfied that the associate would not object to the provision of that information to us in order for BDO to provide services involving that associate.
We also log IP addresses, or the location of computers on the internet to help diagnose problems with our server and to administer the site. If the user prefers not to accept a cookie, they can set their web browser to warn them before accepting any cookies. Alternatively they can refuse all cookies by turning them off in their web browser.
5. How we use your personal information
BDO may at times use and disclose personal information about an individual for the “primary purpose” of collection (i.e. the dominant or fundamental purpose for which that information is collected). As well as providing services to clients, that “primary purpose” includes facilitating our internal business processes, communicating with clients, prospective clients and other external parties, providing ongoing marketing information about our products and services, complying with our legal obligations and dealing with enquiries and complaints.
In certain circumstances, the law may permit or require us to use or disclose personal information for other purposes (for instance where a client would reasonably expect us to and the purpose is related to the purpose of collection).
For tax clients, tax file numbers:
- can be collected by tax agents and accountants;
- can be used only to conduct client’s affairs; and
- can be disclosed only to client and the Australian Tax Office.
Our policy is that we do not collect sensitive information about our clients or prospective clients. If any of our clients or prospective clients elects to provide us with any sensitive personal information, we will take all reasonable steps to ensure that the sensitive information is securely protected.
6. Disclosure of Personal Information
Personal information is not disclosed to a third party unless the disclosure is necessary to support the delivery of the client services for which BDO has been, or is expected to be, engaged, or is required by law. Examples where personal information may be disclosed to a third party include:
- disclosures to our related companies to provide services;
- superannuation details to a fund administrator;
- Tax File Number Declaration to the Australian Taxation Office;
- where BDO is required by law to provide personal information so that BDO complies with court orders, subpoenas or other legislation that requires us to provide personal information (for example, a garnishee order).
In certain circumstances, BDO may also disclose personal information to third party service providers (such as IT service providers) who assist us to administer our business.
We may also provide a client’s or prospective client’s personal information to credit reporting bodies and other credit providers. Our separate credit reporting policy sets out how we deal with credit-related information.
Should it be necessary for BDO to forward personal information to third parties outside the firm, we will make every effort to ensure that the confidentiality of the information is protected.
The nature of our business activities may on occasion require that personal information be disclosed to overseas recipients in order to provide the services contemplated under the terms of our engagement or prospective engagement. The location of any overseas recipients of this information will depend upon the nature of the client assignment being conducted or contemplated.
In the event that personal information is disclosed to overseas recipients, BDO will take all reasonable steps to ensure that any personal information is secure and treated in accordance with the Australian Privacy Principles.
7. How we store your personal information
BDO will take all reasonable steps to protect against the loss, misuse and/or alteration of the information under its control, including through appropriate physical and electronic security strategies. Only authorised BDO personnel are provided access to personal information, and these employees are required to treat this information as confidential. We may need to maintain records for a significant period of time. However, when we consider information is no longer needed, we will destroy or de-identify these records.
Our policy is that all electronic records are only stored within Australia whenever this is commercially feasible. However, on occasion, a limited number of specialist software applications may involve the storage of personal data at an overseas location where a suitable alternative is not available. We presently disclose some information to the Netherlands in limited circumstances.
BDO will only store data with an external provider if a technical assessment of a service provider’s security protocols are considered to meet or exceed the level of security that BDO could apply if the electronic data were to be stored in BDO’s own in-house systems and where we are satisfied that BDO is able to meet its commitments under Australian Privacy Legislation.
8. Accuracy of personal information
BDO will take all reasonable steps to make sure that any personal information collected, used or disclosed is accurate, complete and up to date.
If a person believes that the information we hold is inaccurate or out of date, they may contact our Privacy Officer and we will update the relevant information accordingly.
9. Access to personal information
Under the Australian Privacy Principles, a person has the right to request access to any personal information that we may hold about them and to advise us if the information should be corrected. The Australian Privacy Principles set out the circumstances when we can refuse those requests. If we do refuse a request, we will provide the person with a written notice that sets out the reasons (unless it would be unreasonable to provide them).
Subject to our right to refuse access, BDO will provide the person with a report that lists any personal information that we may hold.
Our policy is to provide written acknowledgement of our receipt of any request for access to personal information or a request for correction of personal information within 7 days of the request being received. We will then provide a written response within 30 days of our receipt of the request.
In the event that an individual would prefer to submit a privacy request using a pseudonym or otherwise keep their identity secret, BDO will do its best to support that request if it is feasible to do so under the circumstances.
10. Privacy Enquiries
If you wish to make an enquiry about your personal information at BDO, or make a complaint because you believe that we may have breached the Australian Privacy Principles or a privacy code that applies to us, please email our nominated Privacy Officer at firstname.lastname@example.org or telephone (02) 9240 9995.
We will respond to each request within a reasonable time.
If a party has lodged a complaint with BDO and is not satisfied with our response, they may contact the Commonwealth Information Commissioner.