The information we hold, and how we hold it.

1.Why this policy exists, and who it covers.

We are bound by the Privacy Act 1988 and the thirteen Australian Privacy Principles regardless of the size of the firm, because we provide a financial service.

This policy is published by Independent Wealth Advisory Australia Pty Ltd (ABN 43 670 376 673), the holder of Australian Financial Services Licence 552198. It applies to the personal information we collect from clients, prospective clients, and visitors to this website.

The Privacy Act 1988 (Cth) and the Australian Privacy Principles set out the standards we follow. Other obligations, particularly under the Corporations Act 2001, the Anti-Money Laundering and Counter-Terrorism Financing Act 2006, and the Superannuation Industry (Supervision) Act 1993, also direct what records we must collect and how long we must keep them. Where one of those obligations requires us to hold information for a specified period, that requirement prevails over our preference to hold less.

Throughout this policy the words we, us, and our refer to Independent Wealth Advisory Australia Pty Ltd. The words you and your refer to whoever the relevant personal information belongs to.

2.The information we collect, and what kind.

Most of it comes directly from you. Some comes from people you have asked us to deal with on your behalf.

The personal information we collect about clients ordinarily includes:

• Identification and contact details. Name, address, date of birth, phone numbers, email addresses, and the identity documents required to satisfy anti-money-laundering obligations.
• Financial information. Income, expenses, assets, liabilities, superannuation balances, investment portfolios, tax position, and banking details for fee payments and platform deductions.
• Employment and career information. Employer, occupation, employment status, and history where relevant to retirement or insurance planning.
• Family information. Spouse or partner details, dependants, beneficiaries on superannuation accounts, and structures used in estate planning.
• Insurance information. Existing policies, sums insured, beneficiaries, claims history where disclosed.
• Government identifiers. Tax File Numbers (handled separately, see section 8) and where relevant Medicare numbers and similar identifiers required for product applications.

Where insurance advice is part of an engagement, we may collect health information from you or from your insurer. Health information is sensitive information under the Privacy Act and is handled with additional protections, described in section 7.

For website visitors who have not engaged us, we collect only what is necessary to respond to enquiries: typically a name, an email address, and the contents of a message sent through the contact form.

3.Collection, in practice.

We collect personal information directly from the person it concerns, except where doing so is impractical or where you have asked us to deal with someone else on your behalf.

Most personal information is given to us by clients during initial conversations, in fact-find documents completed at the start of an engagement, and in subsequent reviews. Some is provided by accountants, employers, life insurers, superannuation fund administrators, or other professionals you have engaged. In every case, the source of the information is recorded on file.

Where information arrives from someone other than you and we are using it to advise you, we will tell you what we have received and why, in your Statement of Advice or by separate written communication.

We do not buy mailing lists. We do not collect personal information from public scraping. We do not collect information about your movements on this website beyond what is described in section 10.

4.What the information is for.

The purposes are practical, not abstract. Each one is necessary for the work.

We collect, hold, and use personal information for:

• Providing financial product advice that is in your best interests, which requires understanding your circumstances in detail.
• Implementing the advice: opening accounts, applying for products, instructing platforms and custodians on your behalf.
• Ongoing management of the relationship: periodic reviews, fee disclosure and consent renewals, correspondence, and the file notes that record what was discussed and decided.
• Compliance with the Corporations Act, anti-money-laundering obligations, taxation laws, and the conditions of our AFSL.
• Internal record-keeping, training, and quality review.
• Responding to enquiries from prospective clients and to general correspondence sent through this site.

We do not use personal information for purposes unrelated to the financial services we have been engaged to provide. Where a new purpose arises that you would not reasonably have expected, we will ask before proceeding.

5.The other parties that see parts of your information.

Almost no advice is delivered by a single firm acting alone. Implementation, custody, reporting, compliance, and tax all involve specialist providers.

We disclose personal information, where reasonably necessary to provide the services you have engaged us to provide, to:

• Investment platforms and custodians. The wraps, IDPS providers, and master trusts through which transactions are executed and assets are held.
• Product issuers. Superannuation fund trustees, managed fund issuers, life insurance underwriters, and deposit-taking institutions whose products are recommended or held.
• Other professionals you have engaged. Accountants, lawyers, and mortgage brokers, where coordination is required and you have agreed to it.
• Service providers we use to run the firm. Practice-management software, secure document storage, email infrastructure, accounting software, and external compliance support. These providers act on our instructions and are bound by confidentiality obligations.
• Regulators and authorities. The Australian Securities and Investments Commission, the Australian Taxation Office, the Australian Financial Complaints Authority, AUSTRAC, and law-enforcement bodies, where required by law.

We do not sell personal information. We do not provide it to marketing networks. We do not disclose it to anyone for purposes unrelated to the financial services we have been engaged to provide.

6.When information leaves Australia.

The firm's primary records and communications sit on Australian-hosted systems. A small number of supporting services route data outside Australia.

Where a service we use stores or processes data overseas, the providers are typically located in the United States or the European Union. Examples include email infrastructure, document signing, and video-conferencing. We take reasonable steps to ensure those providers handle personal information in a way that is consistent with the Australian Privacy Principles, including by relying on contractual privacy obligations where the provider's standard terms do not satisfy us.

If you would prefer a particular item of correspondence be handled through an Australian-only channel, tell us and we will arrange it.

7.Sensitive information, treated separately.

Health information, and the small number of other categories the Privacy Act treats as sensitive, are handled with additional protections.

Sensitive information includes health information, and information about racial or ethnic origin, political opinions, religious beliefs, sexual orientation, or criminal record. In a financial advice context, the only category we ordinarily collect is health information, and only where it is needed to advise on personal insurance.

Where we collect health information: we collect only what is necessary for the insurance advice or application in question; we collect it with your express consent, recorded in writing; we disclose it only to the insurer or underwriter assessing the application, and only with your consent; we hold it with restricted access, separate from general client records; and we do not use it for any purpose other than the one for which it was collected.

Where the insurance application is complete and the policy is in force, we retain only the documentation we are required to retain under law and the relevant insurer's record requirements. The remainder is destroyed.

8.Tax File Numbers, handled under their own rules.

TFNs are subject to the Privacy (Tax File Number) Rule and provisions of the Taxation Administration Act. They are not held with general client information.

Where we collect a Tax File Number, typically to assist with superannuation, ATO correspondence, or fund reporting, it is held separately from other personal information, used only for the tax-related purpose for which it was collected, and disclosed only to the parties to whom you have agreed it may be disclosed (most commonly your superannuation fund or the ATO).

You are not required by law to provide your Tax File Number. If you choose not to, some superannuation and tax matters become more difficult to action efficiently, and tax may be withheld at higher rates by some product providers. We will explain the consequence at the time so the decision is yours to make with full information.

9.Where it lives, and for how long.

Records are held on professional-grade systems with restricted access, with paper files held securely at the office. Both have specific retention rules.

Digital records are stored on practice-management systems hosted in Australia, with access controlled by user authentication and audit logs. Where data is transmitted electronically, it is encrypted in transit. Backups are stored separately and tested.

Paper records are held securely at the office. Active client files are accessed only by the adviser and support staff working on the file.

We retain records for as long as we are required to under law. For most AFSL records, the minimum retention period is seven years from the date the advice was given or the relationship ended, whichever is later. Some records, particularly those involving superannuation, are kept longer where superannuation law requires. After the retention period, paper records are destroyed by secure shredding and digital records are permanently deleted.

Sensitive information, including health information, is held with additional access controls and is destroyed earlier than the standard retention period where it is no longer required for any lawful purpose.

10.What this website does, and does not do.

The site is intentionally lightweight. It does not run third-party analytics, does not run marketing or advertising pixels, and does not build a profile of you across other sites.

This site uses no third-party analytics tools and no advertising or marketing pixels. We do not share visitor information with social-media platforms or advertising networks.

If you complete the contact form, the information you send is delivered to us by email. It is not stored by the website itself.

Web server logs are kept for short periods to help us identify technical issues. They contain IP addresses, request times, and the page requested. They are not used to identify visitors and are not combined with any other dataset. Logs are deleted after thirty days unless retained as part of an investigation into suspected misuse of the site.

If a future version of the site introduces analytics, marketing pixels, or any other tracking technology, this section is the place where the change will be described, before it is enabled.

11.Your rights, and how to exercise them.

You may ask what we hold, ask us to correct it, or complain if you believe we have mishandled it. The first step in each case is the same: write to us.

Access and correction. To request access to the personal information we hold about you, write to us at email to be confirmed. We will respond within thirty days, ordinarily within ten. There is no fee for an ordinary access request, although for unusual or extensive requests we may charge a reasonable cost-recovery fee, which we will explain to you in advance. We may ask you to verify your identity before releasing information.

If we hold information that is out of date or wrong, tell us and we will correct it. If we disagree about whether the information is wrong, you may ask us to attach a statement of the disagreement to the file, which we will do.

In limited circumstances under the Privacy Act we may refuse access, for example where giving access would unreasonably affect the privacy of another person, or where the information relates to anticipated legal proceedings. Where access is refused, we will tell you why in writing and explain the options for review.

Complaints about privacy. If you believe we have mishandled personal information, write to us with the heading Privacy concern and tell us what has happened. We will acknowledge the concern within five business days and respond substantively within thirty calendar days. If a longer time is needed because the matter is complex, we will tell you and explain why.

If you remain unsatisfied with our response, you may take the concern to the Office of the Australian Information Commissioner, which oversees the Privacy Act: GPO Box 5288, Sydney NSW 2001, phone 1300 363 992, web oaic.gov.au.

For complaints about financial advice rather than privacy specifically, the appropriate path is described in our Financial Services Guide and on the Complaints page.