Privacy Policy

Phan Campbell & Associates is committed to protecting the privacy and confidentiality of information entrusted to us.

This Privacy Policy explains how personal information is collected, held, used and disclosed by:

• Phan Campbell & Associates Lawyers Pty Ltd (ABN 34 667 793 197), which provides legal services and is referred to as PCA Lawyers; and
• Phan Campbell & Associates Pty Ltd (ABN 57 064 627 998), which provides accounting, taxation and business advisory services and is referred to as PCA Accounting.

PCA Lawyers and PCA Accounting are related businesses, but they are separate legal entities. A client of PCA Lawyers is not automatically a client of PCA Accounting, and vice versa. Each entity is responsible for the personal information it collects and holds.

We publish a joint Privacy Policy because the businesses operate from the same premises, share a website and use some common administrative and technology infrastructure. References in this policy to we, us or our mean the entity dealing with you or holding your information, unless the context refers to both businesses.

We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply, together with the other legal, professional and regulatory obligations relevant to our services. These include obligations concerning legal professional confidentiality and privilege, health information, tax file numbers, taxation information and anti-money laundering and counter-terrorism financing.

This policy should be read together with any specific privacy collection notice or terms of engagement provided to you.

1. What information we collect

The personal information we collect depends on who you are, your dealings with us and the services we provide.

We may collect information such as your:

• name, address and contact details;
• date and place of birth;
• identification documents and identity verification information;
• occupation and employment details;
• family and relationship information;
• financial information and bank details;
• property, asset and liability information;
• company, trust, partnership and business information;
• taxation information;
• beneficial ownership and control information;
• correspondence and communications with us; and
• other information relevant to the professional services we provide.

We also create records in the course of our work, including file notes, correspondence, calculations, research, advice, due diligence records and other professional records.

2. Sensitive and health information

Depending on the work we are asked to undertake, we may need to collect sensitive information. This can include information about a person's health, racial or ethnic origin, religious or philosophical beliefs, political opinions or associations, sexual orientation, criminal history and other information treated as sensitive information under privacy law.

Where the Australian Privacy Principles apply, we will generally only collect sensitive information where it is reasonably necessary for our work and you have consented to its collection, or where collection is otherwise permitted, required or authorised by law.

We may also hold health information, including medical reports, capacity assessments or other health related information relevant to a legal or professional matter. Health information handled in Victoria may also be protected by the Health Records Act 2001 (Vic) and the Health Privacy Principles.

3. Information collected by PCA Lawyers

The information PCA Lawyers collects will depend on the nature of the legal matter.

For example, we may collect information concerning property transactions, businesses and commercial arrangements, companies and trusts, loans and securities, employment matters, family relationships, financial circumstances, court proceedings, disputes, wills and estates, medical or capacity issues and other matters relevant to the legal services being provided.

Information held by PCA Lawyers may be subject to our professional duty of confidentiality and, where the legal requirements are satisfied, legal professional privilege.

4. Information collected by PCA Accounting

The information PCA Accounting collects may include information concerning taxation affairs, business activities, income and deductions, assets and liabilities, accounting records, payroll, superannuation, financial statements, business activity statements and company, trust or partnership affairs.

PCA Accounting may also handle tax file numbers and other government related identifiers where this is permitted by law.

Where PCA Accounting provides services as a registered tax practitioner, it is subject to professional obligations concerning the confidentiality of client information. This can affect how information is provided to third parties, including outsourced service providers, technology providers, cloud service providers and related businesses.

5. How we collect information

We usually collect personal information directly from you. This may occur when you contact us, make an enquiry, attend a meeting, complete a form or questionnaire, provide documents or instructions, communicate with us electronically, engage us to provide professional services or complete an identity verification process.

We may also receive information from other people or organisations where this is appropriate for the work we are doing. These may include:

• authorised representatives and family members;
• lawyers, accountants and other professional advisers;
• employers and employees;
• financial institutions;
• real estate agents and property managers;
• counterparties and their advisers;
• courts and tribunals;
• government departments and regulators;
• ASIC and other public registers;
• land registries and electronic conveyancing systems;
• identity verification and search providers; and
• other publicly available or lawful sources.

If you provide us with personal information about another person, you should only do so where you are authorised to provide that information or where it is otherwise lawful and appropriate to do so.

We may occasionally receive personal information that we did not ask for. Where privacy law requires us to do so, we will determine whether we could lawfully have collected that information. If not, and there is no legal basis for retaining it, we will take reasonable steps to destroy or de-identify it.

For some general enquiries, it may be possible to deal with us anonymously or using a pseudonym. In most professional matters, however, we will need to know your identity so that we can conduct conflict checks, verify instructions, comply with professional obligations and, where applicable, meet taxation or AML/CTF requirements.

6. Why we use personal information

We use personal information for the purpose for which it was collected and for related purposes that are reasonably necessary to provide our services and operate our businesses.

For PCA Lawyers, this includes assessing whether we can act, conducting conflict checks, providing legal advice and representation, preparing and reviewing documents, conducting transactions and settlements, negotiating with other parties, undertaking searches and due diligence, instructing barristers and experts, appearing in or managing court and tribunal proceedings, making required filings and administering client matters.

For PCA Accounting, this includes providing accounting and taxation services, preparing financial statements, taxation returns and business activity statements, providing taxation and business advice, communicating with the Australian Taxation Office and other authorities and administering client engagements.

Both businesses may also use personal information for identity verification, billing and payments, record keeping, information security, quality assurance, professional supervision, risk management, insurance, complaints management, debt recovery and compliance with legal, regulatory and professional obligations.

We do not sell personal information or client mailing lists.

7. PCA Lawyers and PCA Accounting are separate businesses

Although PCA Lawyers and PCA Accounting share some administrative resources and technology, their substantive client files are not treated as a single combined client record.

Information held by one business may be provided to the other where:

• you have engaged both businesses and the disclosure is appropriate for the services you have requested;
• you have authorised the disclosure;
• limited access is required for an authorised shared administrative function;
• disclosure is required or authorised by law; or
• another lawful basis permits the disclosure.

Access to shared systems does not mean that all staff or personnel of each business are entitled to access the other business's client files. Access should be limited to what is required for an authorised purpose.

8. Confidentiality and legal professional privilege

PCA Lawyers does not disclose confidential or privileged client information to PCA Accounting simply because the businesses are related.

Any disclosure of confidential information by PCA Lawyers must be consistent with its professional obligations or otherwise be authorised or required by law.

Where information may be protected by legal professional privilege, PCA Lawyers will consider the effect of any proposed disclosure on that privilege before the information is disclosed.

Similarly, where PCA Accounting is subject to the confidentiality obligations applying to registered tax practitioners, client information will not be disclosed to PCA Lawyers or another third party unless the client has given the required permission or there is a legal duty to make the disclosure.

9. Anti-money laundering and counter-terrorism financing

Australian AML/CTF laws apply to certain services provided by lawyers, accountants and other professional service providers.

Where PCA Lawyers or PCA Accounting provides a service regulated under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), we may be required to collect and verify additional information about you and other people connected with the relevant transaction or arrangement.

This may include information about:

• your identity and residential address;
• people acting for you or on whose behalf you are acting;
• beneficial ownership and control;
• company, trust or partnership structures;
• the purpose and nature of a transaction or professional relationship;
• your business, occupation or source of income;
• source of funds or source of wealth;
• transaction activity;
• politically exposed person status;
• sanctions information; and
• other matters relevant to assessing and managing AML/CTF risk.

We may verify this information using documents supplied to us, electronic identity verification providers, public registers, screening services and other reliable and lawful sources.

Customer due diligence is not necessarily confined to the beginning of a matter. We may need to obtain further or updated information while we continue to provide a regulated service.

If information required for AML/CTF purposes is not provided, or we cannot satisfactorily complete required customer due diligence, we may be unable to commence or continue providing the relevant service.

When we collect information specifically for AML/CTF customer due diligence, we may also give you a separate privacy collection notice explaining that collection.

10. AML/CTF reporting

The AML/CTF legislation can require or authorise information to be provided to AUSTRAC.

There are circumstances in which we may be legally restricted from telling you about a suspicious matter report or certain other information relating to AML/CTF reporting or an investigation.

The AML/CTF legislation does not remove legal professional privilege. Where PCA Lawyers considers that information may be protected by legal professional privilege, it will assess the application of privilege and comply with the applicable statutory requirements.

11. Identity documents and government identifiers

Identification documents can contain a significant amount of personal information. We seek to collect and retain only what is reasonably required for the relevant purpose.

We may retain a copy of an identification document where there is a legal, professional, evidentiary or risk management reason for doing so. Where the document itself is no longer required and there is no other lawful basis for retaining it, we will take reasonable steps to securely destroy or de-identify it.

We may retain a record of how an identity was verified even if the underlying identification document is not retained.

We may also receive government related identifiers such as passport or driver licence numbers. We do not adopt these identifiers as our own general client numbers and only use or disclose them where permitted by law.

12. Tax file numbers

PCA Accounting may collect tax file number information in connection with taxation and accounting services. PCA Lawyers may also receive tax file number information where it is relevant to a legal matter.

Tax file numbers are subject to specific legal protections. We do not use a tax file number as a general client identifier and will only collect, use or disclose TFN information where this is permitted by law.

Where we request a tax file number in circumstances governed by the Privacy (Tax File Number) Rule 2015, we will provide any information required by that Rule.

13. Who we may disclose information to

Depending on the matter and the services being provided, we may need to disclose personal information to third parties.

These may include:

• barristers, experts and other professional advisers;
• counterparties and their advisers;
• courts and tribunals;
• the Australian Taxation Office, ASIC, AUSTRAC and other government bodies;
• financial institutions;
• real estate agents and property managers;
• land registries and electronic conveyancing operators;
• insurers, auditors and professional indemnity providers;
• search and identity verification providers;
• electronic signature and document management providers;
• practice management, accounting and taxation software providers;
• information technology and cybersecurity providers;
• cloud hosting and data storage providers;
• communications, telephone and videoconferencing providers;
• approved artificial intelligence providers;
• marketing and email service providers;
• contractors and outsourced service providers; and
• other organisations involved in providing the professional services you have requested.

The information provided will depend on the purpose for which the third party is involved.

Where required by law or professional obligations, we take reasonable steps to protect personal information disclosed to service providers and obtain any consent or permission required before making the disclosure.

14. Technology and artificial intelligence

We use technology as part of the ordinary operation of our legal and accounting practices. This includes cloud based document and email systems, practice management and accounting software, identity verification services, electronic conveyancing and signing platforms, communication systems and other professional technology.

We select and use technology having regard to the nature of the information involved, confidentiality, security and our professional obligations.

Artificial intelligence

PCA Lawyers and PCA Accounting may use approved artificial intelligence tools to assist with professional and administrative work. This can include research, document review, analysis, summarisation, drafting, translation, information organisation and workflow support.

AI is an assistance tool. It does not replace the professional judgment or responsibility of our lawyers, accountants or other professional staff.

Work produced with the assistance of AI is subject to appropriate human review having regard to the nature and significance of the task.

We do not permit confidential client information to be entered into unapproved public or personal generative AI accounts for professional purposes.

Before client information is processed using an approved AI system, we consider whether the information is necessary for the task and whether appropriate safeguards are in place. Where practicable, identifying information may be removed or reduced where it is not required.

Where a professional obligation requires client permission before information is disclosed to a third party AI provider, that permission will be obtained separately.

Automated systems

We may use automated technology to assist with identity verification, fraud prevention, cybersecurity, sanctions and politically exposed person screening and AML/CTF customer due diligence.

These systems may use identifying information, business or occupation information, beneficial ownership information, transaction information and screening data to produce verification results, matches or alerts.

Those results may inform decisions about identity verification, compliance requirements and whether further enquiries or customer due diligence are required. They do not replace the professional judgment of our lawyers or accountants, and material decisions remain subject to appropriate human review.

15. Overseas disclosure and processing

Some of the technology providers, contractors and other service providers we use operate outside Australia or use overseas infrastructure.

Depending on the service, personal information may be accessed, stored or processed outside Australia.

Countries in which overseas recipients or service providers are likely to be located include:

• the United States;
• Canada;
• New Zealand;
• Vietnam;
• the Philippines;
• Indonesia;
• Singapore;
• the United Kingdom; and
• countries within the European Economic Area.

The locations used by technology providers can change as their infrastructure and subcontracting arrangements change. We review and update this information where appropriate.

Where the Australian Privacy Principles apply to an overseas disclosure, we take the steps required by Australian privacy law. Where separate client permission is required by a professional obligation, we will obtain that permission.

Information may also need to be sent to another country because of the particular circumstances of a legal, taxation or accounting matter. It may not always be practicable to identify those countries in advance.

16. Electronic communications and recorded calls

We communicate with clients and other people by email, telephone, videoconference, messaging platforms and other electronic means.

Electronic communications carry inherent risks, including interception, misdirection, fraud and unauthorised access. Where information is particularly sensitive, we may recommend or require a more secure method of communication or additional verification.

Telephone calls or online meetings may be recorded or transcribed where this is lawful and appropriate. Recordings and transcripts may be used to maintain accurate file records, confirm instructions, assist with file notes, supervise or train staff, investigate complaints or disputes and preserve evidence.

Where required by law, or otherwise appropriate in the circumstances, participants will be notified that a call or meeting is being recorded or transcribed.

17. Website, cookies and analytics

When you visit our website, we may collect technical information such as your IP address, device or browser information, pages viewed, referral source and interactions with the website.

Our website may use cookies, analytics and similar technology to operate and secure the website, understand how it is used, improve our services and measure the effectiveness of our communications.

Most browsers allow you to control the use of cookies. Disabling cookies may affect some website functionality.

18. Newsletters and marketing

We may send clients, contacts and subscribers information about legal, accounting or taxation developments, invitations and information about our services where permitted by law.

A newsletter may contain information from both PCA Lawyers and PCA Accounting. If you subscribe to a joint newsletter, your contact information may be used by both businesses for that purpose. This does not make you a client of both entities and does not give either business access to the other's substantive client files.

We comply with applicable privacy and electronic marketing laws, including the Spam Act 2003 (Cth).

Marketing communications will include an appropriate way to unsubscribe where required. If you unsubscribe from marketing, this does not prevent us from contacting you about an existing matter, engagement, invoice, regulatory obligation or other professional relationship.

19. How we protect information

We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

The measures we use depend on the nature and sensitivity of the information and include appropriate access controls, authentication measures, cybersecurity protections, confidentiality obligations, staff training, secure document management and physical security.

Access to client information is restricted to people who require it for an authorised purpose.

No information system can be guaranteed to be completely secure. If a privacy or cybersecurity incident occurs, we will take reasonable steps to contain and investigate it and reduce the risk of harm.

Where the Notifiable Data Breaches scheme or another applicable law requires notification of a data breach, we will comply with those requirements.

20. How long we keep information

We retain information for as long as reasonably required for the purpose for which it is held and to meet applicable legal, professional, regulatory, taxation, insurance and risk management obligations.

Different records are subject to different retention requirements.

Legal files may need to be retained having regard to professional obligations, limitation periods, insurance requirements and the nature of the matter.

Accounting and taxation records may need to be retained for periods required by taxation laws and professional requirements.

AML/CTF records are also subject to statutory record keeping requirements. Certain AML/CTF records are generally required to be retained for seven years.

Information may be retained for longer where it is relevant to an actual or potential dispute, complaint, investigation, proceeding, audit or insurance matter, or where it is otherwise reasonably required to establish, exercise or defend legal rights.

When personal information is no longer required and there is no legal basis for continuing to retain it, we take reasonable steps to securely destroy or de-identify it.

21. Accessing or correcting your information

You may ask to access personal information we hold about you or ask us to correct information you believe is inaccurate, out of date, incomplete, irrelevant or misleading.

Requests should be directed to the business that holds the information. We may ask you to verify your identity before dealing with the request.

There are circumstances in which access may lawfully be refused or limited. These may include where access would affect another person's privacy, breach an obligation of confidentiality, prejudice legal proceedings or an investigation, disclose information protected by legal professional privilege or otherwise be restricted by law.

Where required by law, we will give reasons for refusing an access or correction request.

Health information held in Victoria may also be subject to rights of access and correction under the Health Records Act 2001 (Vic).

22. Complaints

If you have concerns about how we have handled your personal information, please contact us.

A complaint about information held by PCA Lawyers will be handled by PCA Lawyers. A complaint about information held by PCA Accounting will be handled by PCA Accounting.

Where a complaint concerns both businesses, they may coordinate their response where appropriate, while continuing to respect their separate obligations of confidentiality and privilege.

We will take privacy complaints seriously and investigate them within a reasonable period. We generally aim to provide a substantive response within 30 days. If a matter is particularly complex, we will let you know if additional time is required.

If you are not satisfied with our response and the Privacy Act applies, you may be entitled to make a complaint to the Office of the Australian Information Commissioner at www.oaic.gov.au.

Complaints concerning health information regulated by the Health Records Act 2001 (Vic) may also be made to the Victorian Health Complaints Commissioner.

23. Contact us

Privacy enquiries, access and correction requests and complaints should be directed to:

Phan Campbell & Associates
Level 1, Suite 12, 7-9 Leeds Street, Footscray VIC 3011
Telephone: (03) 8354 9541
Email: [email protected]

24. Changes to this policy

We may update this Privacy Policy from time to time as our services, technology, service providers and legal or professional obligations change.

The current version will be published on our website and will show the date it was last updated.