Conflux Advisory

Our Commitment to Privacy

Conflux Advisory Pty Ltd (Conflux Advisory, we, our or us) is committed to protecting the privacy of personal information entrusted to us by clients, prospective clients, family members, business stakeholders, referral partners, suppliers and other individuals.

We manage personal information in accordance with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), where those laws apply to us.

This Privacy Policy explains how we collect, hold, use, disclose and protect personal information, and how individuals may access or correct their personal information or make a privacy complaint.

What Personal Information We Collect

The personal information we collect depends on the nature of our relationship with you and the services we provide. It may include:

  • Names and contact details, including addresses, telephone numbers, and email addresses
  • Employment, professional, and business information
  • Information about family relationships, business ownership, governance, succession, transition and decision-making
  • Financial, taxation, estate planning and business information relevant to our advisory services
  • Information about roles, responsibilities, capabilities and expectations within a family or business
  • Records of meetings, workshops, interviews, discussions, correspondence, and agreed actions
  • Audio or video recordings, meeting transcripts, notes and meeting summaries
  • Identification information where reasonably required
  • Billing, payment and account information
  • Information submitted through our website contact form
  • Website usage and technical information, including IP address, browser and device information, pages visited and referral information

We do not generally collect government-related identifiers unless this is reasonably necessary for our services or required or authorised by law.

Sensitive and Confidential Information

Some information entrusted to us may be sensitive or highly confidential because of its personal, family, financial or commercial nature.

“Sensitive information” has the meaning given in the Privacy Act 1988 (Cth) and may include information about an individual’s health, racial or ethnic origin, religious beliefs or affiliations, political opinions, sexual orientation, criminal record or membership of a professional or trade association.

We only collect sensitive information where it is reasonably necessary for our functions or activities and:

  • The individual has consented to its collection
  • Collection is required or authorised by law
  • Another exception under the Privacy Act applies

How We Collect Personal Information

We generally collect personal information directly from you, including when you:

  • Contact us by telephone, email, our website, or social media
  • Submit an enquiry through our website contact form
  • Engage us to provide advisory services
  • Participate in meetings, interviews, workshops, or facilitated discussions
  • Provide documents or other information as part of an engagement
  • Subscribe to updates or publications
  • Attend an event or presentation we deliver

We may also receive personal information from:

  • Family members and business stakeholders involved in an engagement
  • Accountants, lawyers, financial advisers, bankers and other professional advisers
  • Organisations or individuals authorised to provide information to us
  • Publicly available sources
  • Technology providers, contractors and other service providers

Where personal information is provided to us by another person, we rely on the person providing it to have appropriate authority to do so. Where required and practicable, we will take reasonable steps to notify the individual that we have collected their personal information and explain the circumstances of collection.

Meeting Recordings, Transcripts and Summaries

We may record client meetings, interviews, workshops and facilitated discussions with the knowledge and consent of participants.

Recordings may be used to:

  • Create transcripts and meeting notes
  • Prepare meeting summaries, action plans and advisory reports
  • Confirm decisions, commitments and agreed actions
  • Support the accuracy and quality of our professional services
  • Maintain an appropriate record of the engagement

Recordings, transcripts, meeting notes and summaries may contain personal, sensitive, confidential and commercially sensitive information. They are managed as confidential client records and protected in accordance with our information security practices.

We may use Microsoft Teams and other approved technology tools to record or transcribe meetings and assist in preparing meeting notes and summaries. Where technology-assisted tools are used, the resulting material is reviewed before being relied upon or included in a client deliverable.

Participants may raise any questions or concerns about a proposed recording before the meeting is recorded.

Why We Collect and Use Personal Information

We collect and use personal information to:

  • Provide family enterprise, governance, transition, and related advisory services
  • Understand family, ownership, business and governance circumstances
  • Facilitate interviews, meetings, workshops, and decision-making processes
  • Prepare meeting records, reports, recommendations, action plans and other client deliverables
  • Communicate with clients, prospective clients, family members, stakeholders, professional advisers and referral partners
  • Manage client relationships, engagements, records, invoicing and accounts
  • Manage conflicts of interest and professional risk
  • Maintain the quality and accuracy of our professional services
  • Comply with legal, regulatory, insurance, and professional obligations
  • Improve our services, website, and business operations
  • Protect our people, systems, information and legal rights
  • Respond to enquiries, complaints and requests

We only collect personal information that is reasonably necessary for our functions and activities. If you do not provide information we reasonably require, we may be unable to provide some services, include you fully in an engagement or respond to your request.

Disclosure of Personal Information

We may disclose personal information to:

  • Clients and their authorised representatives
  • Family members, business stakeholders, and professional advisers participating in an engagement, where appropriate and authorised
  • Accountants, lawyers, financial advisers, bankers and other advisers involved in an engagement
  • Technology, cloud hosting, accounting, transcription, document management and communications service providers
  • Contractors and service providers supporting our operations.
  • Insurers, auditors, and professional advisers
  • Chartered Accountants Australia and New Zealand and other professional or regulatory bodies where required or appropriate
  • Regulators, courts, law enforcement bodies, or government agencies where authorised or required by law
  • Other persons with your consent or as otherwise permitted by law

Our technology and service providers include Microsoft, Xero, Grammarly and Google. The Microsoft services we use include Microsoft 365, SharePoint, OneDrive and Teams. Google services used in connection with our website include Google Analytics and Google Search Console.

Service providers may handle personal information only to the extent required to provide their services to us. We take reasonable steps appropriate to the circumstances to select and manage providers that maintain suitable privacy, confidentiality and information security safeguards.

Overseas Disclosure

Some third-party technology and service providers we use may store or process information outside Australia or permit authorised support personnel located outside Australia to access information.

These providers include Microsoft, Xero, Grammarly and Google. The countries from which information may be stored, processed or accessed depend on each provider’s infrastructure, account configuration and support arrangements and may change from time to time.

Where practicable, we will make information about likely overseas locations available in this Privacy Policy, an applicable collection notice or in response to an enquiry.

Before disclosing personal information to an overseas recipient, we take reasonable steps required by the Privacy Act 1988 (Cth) to ensure that the recipient handles the information consistently with the Australian Privacy Principles, unless an exception applies.

Where personal information remains within a provider’s effective control and the provider does not use or disclose it for purposes other than providing services to us, the arrangement may involve overseas storage or access rather than a disclosure for the purposes of APP 8. We nevertheless apply appropriate risk-based safeguards to the arrangement.

Storage and Security of Personal Information

Conflux Advisory maintains client records in digital form. Personal information may be held in our Microsoft 365 environment, including SharePoint, OneDrive, Teams and Outlook, and in other approved business systems such as Xero.

We take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, and disclosure. Our safeguards include:

  • Multi-factor authentication
  • Access controls based on least privilege
  • Secure cloud-based systems
  • Approved and managed devices
  • Data classification and handling procedures
  • Backup and recovery processes
  • Supplier and service-provider risk management
  • Security monitoring and software updates
  • Incident response procedures
  • Periodic review of information security controls

Richards IT provides information technology support and may access systems or information where reasonably necessary to provide that support. Access is limited to what is required for the relevant support activity and is subject to appropriate confidentiality and security requirements.

Further information about our security practices is available in our Information Security Statement.

Retention and Destruction

Client engagement records are generally retained for at least seven years after completion of the relevant engagement.

We may retain records for a longer period where reasonably necessary to:

  • Comply with legal, regulatory, insurance or professional obligations
  • Establish, exercise or defend legal rights
  • Respond to a complaint, dispute or regulatory enquiry
  • Maintain an appropriate record of long-term or continuing advisory work

Meeting recordings do not need to be retained for the same period as final transcripts, meeting summaries, reports or other engagement records. Recordings may be securely deleted when they are no longer reasonably required, provided that any necessary engagement record has been retained.

When personal information is no longer required, we take reasonable steps to securely destroy it or permanently de-identify it, unless we are required or permitted by law to retain it.

Professional and Ethical Obligations

The Managing Director of Conflux Advisory holds a Certificate of Public Practice issued by Chartered Accountants Australia and New Zealand.

In addition to our obligations under privacy legislation, our handling of client information is subject to applicable professional, ethical, confidentiality, risk management and record-keeping obligations.

The professional principle of confidentiality generally requires a professional accountant not to disclose information acquired through professional or business relationships without proper and specific authority, unless there is a legal or professional right or duty to disclose it. It also prohibits the improper use of confidential information for the advantage of the professional accountant or another person.

We maintain professional indemnity insurance appropriate to our professional practice.

Access to and Correction of Personal Information

You may request access to personal information we hold about you. You may also ask us to correct information that you believe is inaccurate, out of date, incomplete, irrelevant, or misleading.

Requests should be made in writing to the Managing Director using the contact details below. We may need to verify your identity and clarify the information requested before acting on a request.

We will respond within a reasonable period. We will not charge for making a request, although we may charge a reasonable fee for providing access where permitted by law. We will advise you of any proposed fee before proceeding.

In some circumstances, the Privacy Act permits or requires us to refuse access or correction. If we refuse a request, we will generally provide written reasons and explain how the decision may be challenged, unless it would be unreasonable or unlawful to do so.

Where we decline to correct information, you may ask us to associate a statement with the information recording that you consider it to be inaccurate, out of date, incomplete, irrelevant or misleading.

Direct Marketing

We may use contact information to send clients, prospective clients, referral partners and other professional contacts information about our services, insights, events and publications where permitted by law.

We will provide a reasonably accessible way to opt out of direct marketing communications. You may opt out at any time by:

  • Using the unsubscribe facility included in a communication
  • Contacting us using the details below

We will action opt-out requests within a reasonable period. We will not sell personal information to third parties for marketing purposes.

Website, Contact Form, Cookies and Analytics

When you submit an enquiry through our website contact form, we may collect your name, contact details, organisation, the contents of your enquiry and any other information you choose to provide.

Our website uses or may use cookies and similar technologies to:

  • Operate and secure the website
  • Understand how visitors find and use the website
  • Measure website traffic and performance
  • Identify technical issues
  • Improve website content and the user experience

We use Google Analytics and Google Search Console in connection with our website. Information collected through these services may include IP address, browser and device information, approximate location, referral source, pages visited and website interaction information.

Some information collected through website analytics may be processed by Google outside Australia in accordance with Google’s services and data-handling arrangements.

You can manage or disable cookies through your browser settings. Disabling cookies may affect some website functionality. be affected.

Notifiable Data Breaches

We maintain an incident response process for investigating and managing suspected or actual loss, unauthorised access, unauthorised disclosure or other compromise of information.

Where an incident involves personal information, we will assess whether it is likely to result in serious harm to any affected individual.

Where required by Australia’s Notifiable Data Breaches scheme under the Privacy Act 1988 (Cth), we will notify affected individuals and the Office of the Australian Information Commissioner and provide the information required by law.

We may also notify clients, insurers, professional bodies, service providers or other parties where notification is appropriate or required.

Making a Privacy Complaint

If you believe we have breached your privacy or handled personal information inappropriately, you may make a written complaint to the Managing Director using the contact details below.

We will:

  • Acknowledge the complaint, generally within five business days
  • Consider and investigate the matters raised
  • Request further information where reasonably necessary
  • Provide a substantive response, generally within 30 days where reasonably practicable
  • Explain the outcome and any corrective action we propose to take

If we require additional time, we will advise you and explain the reason for the delay.

If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner.

Contact

The Managing Director is responsible for overseeing privacy matters at Conflux Advisory.

For privacy enquiries, requests for access or correction, or privacy complaints, please contact us by writing to: The Managing Director, Conflux Advisory Pty Ltd, PO Box 1515, North Sydney NSW 2059, or email us at info@confluxadvisory.com.au.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, business practices, technology, service providers, professional obligations or legal requirements.

The current version will be available on our website. The date shown below indicates when the policy was last updated.

Last updated: September 2026