Website Privacy Policy

This Privacy Policy applies to all personal information collected by FS Spagnolo & Co (Aust) Pty Ltd (we, us or our) via the website located at www.spagnolo.net.au (Website).

1. What information do we collect?

The kind of Personal Information that we collect from you will depend on how you use the website. The Personal Information which we collect and hold about you may include:

We collect the following personal information from website users: full name, email address, phone number, business name, ABN/ACN, postal address, financial information relating to accounting and taxation services, business financial records and statements, superannuation fund details for SMSF clients, employment and payroll information for business advisory services, and any other information voluntarily provided through enquiry forms, consultation bookings, or during the provision of our accounting, taxation, and business advisory services.

We collect personal information only where it is reasonably necessary for our accounting, taxation, SMSF administration, and business advisory functions. Before collecting each category of information, we document the specific service purpose requiring that information. We maintain procedures specifying which information is mandatory for each service type and which is optional, and we conduct annual reviews to ensure continued necessity of all collected information categories.

We obtain your express written consent before collecting personal information, specifying the data categories (including financial records, SMSF details, and payroll information) and collection purposes. Clients acknowledge collection of specific data types through signed engagement letters or online consent forms at service commencement, with consent documentation maintained including date, authorized data categories, and client confirmation.

2. Types of information

The Privacy Act 1988 (Cth) (Privacy Act) defines types of information, including Personal Information and Sensitive Information.

Personal Information means information or an opinion about an identified individual or an individual who is reasonably identifiable:

(a) whether the information or opinion is true or not; and
(b) whether the information or opinion is recorded in a material form or not.

If the information does not disclose your identity or enable your identity to be ascertained, it will in most cases not be classified as “Personal Information” and will not be subject to this privacy policy.

Sensitive Information is defined in the Privacy Act as including information or opinion about such things as an individual’s racial or ethnic origin, political opinions, membership of a political association, religious or philosophical beliefs, membership of a trade union or other professional body, criminal record or health information.

Sensitive Information will be used by us only:

(a) for the primary purpose for which it was obtained;
(b) for a secondary purpose that is directly related to the primary purpose; and
(c) with your consent or where required or authorised by law.

3. How we collect your Personal Information

(a) We may collect Personal Information from you whenever you input such information into the Website, related app or provide it to Us in any other way.

(b) We may also collect cookies from your computer which enable us to tell when you use the Website and also to help customise your Website experience. As a general rule, however, it is not possible to identify you personally from our use of cookies.

We will obtain your explicit consent before placing non-essential cookies on your device, and you may withdraw consent or disable non-essential cookies through your browser settings or our cookie consent banner at any time.

(d) Where reasonable and practicable we collect your Personal Information from you only. However, sometimes we may be given information from a third party, in cases like this we will take steps to make you aware of the information that was provided by a third party.

(e) We implement role-based access controls to ensure only authorised personnel with documented business need may access your Personal Information, require multi-factor authentication for sensitive data categories, and maintain comprehensive audit logs of all data access including user identification, timestamps, and access purpose, which are reviewed monthly to identify unauthorised or suspicious access patterns.

4. Purpose of collection

(a) We collect Personal Information to provide you with the best service experience possible on the Website and keep in touch with you about developments in our business.

(b) We customarily only disclose Personal Information to our service providers who assist us in operating the Website. Your Personal Information may also be exposed from time to time to maintenance and support personnel acting in the normal course of their duties.

(c) We require all service providers and third parties who access Personal Information to enter into written agreements that mandate compliance with the Australian Privacy Principles, including obligations relating to data security, confidentiality, breach notification, and appropriate data handling procedures. We retain the right to audit third-party compliance and maintain records of all service provider relationships and their respective data access permissions.

(d) Service providers must maintain professional indemnity and cyber liability insurance with minimum coverage of $1 Million and indemnify us against losses, damages, and costs arising from their breach of data security obligations, negligence, or non-compliance with the Australian Privacy Principles. Service providers must notify us within 24 Hours of becoming aware of any data breach and maintain security standards including encryption, access controls, and incident response procedures.

(e) We conduct annual security audits of all service providers with access to Personal Information and maintain documented evidence of their compliance with data security obligations. Upon notification of any breach, we will investigate within 24 Hours, document findings, and determine client notification requirements within 24 Hours. Service providers handling sensitive financial records must implement enhanced security measures including encryption at rest and in transit, comprehensive access logging, and segregated storage systems.

(f) By using our Website, you consent to the receipt of direct marketing material. We will only use your Personal Information for this purpose if we have collected such information direct from you, and if it is material of a type which you would reasonably expect to receive from use. We do not use sensitive Personal Information in direct marketing activity. Our direct marketing material will include a simple means by which you can request not to receive further communications of this nature, such as an unsubscribe button link.

(g) We will only send direct marketing material if you have expressly opted in through a checkbox, email confirmation, or written request, and we will maintain records of all consents including the date, method, and material types authorized. You can withdraw consent at any time by clicking the unsubscribe link in marketing emails or contacting us in writing, and we will never use sensitive Personal Information for direct marketing without separate express consent.

5. Security, Access and correction

(a) We store your Personal Information in a way that reasonably protects it from unauthorised access, misuse, modification or disclosure. When we no longer require your Personal Information for the purpose for which we obtained in, we will take reasonable steps to destroy and anonymise or de-identify it. Most of the Personal Information that is stored in our client files and records will be kept for a maximum of 7 years to fulfill our record keeping obligations.

(b) We maintain category-specific retention schedules aligned with legal obligations: tax records for 5 years from end of financial year, SMSF records for 7 years from transaction date, and payroll records for 5 years from final payment. Upon expiry, we securely destroy Personal Information through certified methods and maintain documented audit trails of all destruction activities including date, method, and authorising personnel.

permit you to obtain access to the Personal Information we hold about you in certain circumstances (Australian Privacy Principle 12); and
allow you to correct inaccurate Personal Information subject to certain exceptions (Australian Privacy Principle 13).

(d) Where you would like to obtain such access, please contact us in writing on the contact details set out at the bottom of this privacy policy.

(e) We will respond to access requests within 5 business days and verify your identity using government-issued identification before providing access. To request corrections, submit written notice with supporting evidence; we will respond within 5 business days and provide information in your requested format unless Privacy Act exemptions apply.

6. Complaint procedure

If you have a complaint concerning the manner in which we maintain the privacy of your Personal Information, please contact us as on the contact details set out at the bottom of this policy. All complaints will be considered by Management & Partners and we may seek further information from you to clarify your concerns. If we agree that your complaint is well founded, we will, in consultation with you, take appropriate steps to rectify the problem. If you remain dissatisfied with the outcome, you may refer the matter to the Office of the Australian Information Commissioner.

We will acknowledge your complaint within 2 business days and provide an initial response within 10 business days. If your complaint is not resolved within 30 days, it will be escalated to management for review. We will maintain records of all complaints, investigation steps, findings, and remedial actions taken. Where a complaint remains unresolved after 30 days or involves a potential Privacy Act breach, we will inform you of your right to refer the matter to the Office of the Australian Information Commissioner.

Upon receipt of a complaint, we will document the complaint details, identify affected Personal Information, review relevant access logs and system records, and interview relevant personnel. Initial investigations will be completed within 10 business days; complex investigations requiring additional time will be escalated to management with an updated timeline provided to you. Where your complaint is substantiated, remediation may include data correction, deletion, access restriction, or compensation depending on the harm caused. We will provide written confirmation of investigation findings, remediation actions taken, and your right to escalate to the Office of the Australian Information Commissioner if dissatisfied. We will contact you 30 days after resolution to confirm remediation effectiveness and address any ongoing concerns.

7. Overseas transfer

Your Personal Information will not be disclosed to recipients outside Australia unless you expressly request us to do so. If you request us to transfer your Personal Information to an overseas recipient, the overseas recipient will not be required to comply with the Australian Privacy Principles and we will not be liable for any mishandling of your information in such circumstances.

8. How to contact us about privacy

If you have any queries, or if you seek access to your Personal Information, or if you have a complaint about our privacy practices, you can contact us through: fsspagnolo@spagnolo.net.au.

9. Data breach notification

If we suspect an eligible data breach has occurred, we will assess the breach within 24 hours and notify affected individuals without unreasonable delay where required under the Privacy Act. Notifications will include the nature of the breach, the type of information involved, steps we have taken to mitigate harm, and our contact details for further enquiries. We will also notify the Office of the Australian Information Commissioner where required and maintain records of all breach assessments and notifications.

10. Breach response procedures

Upon discovering a suspected data breach, we will immediately isolate affected systems, disable compromised accounts, and preserve evidence for investigation. We will complete an initial investigation within 24 hours to determine breach scope, assess the likelihood of serious harm to affected individuals, and document all findings including discovery date, affected data categories, number of individuals impacted, and notification decisions. We will implement corrective actions to prevent recurrence and notify affected clients of protective measures available, including credit monitoring services and password reset procedures where appropriate.