Privacy policy.

SECTION 1

This policy applies to every interaction with Tax Tracker — whether you're a current client, a prospective client who has reached out, or a visitor browsing this website. It covers the entire firm and every staff member operating under our TPB registration. If any part of this policy is unclear, email privacy@taxtracker.com.au and we'll explain it without the legalese.

SECTION 2

From clients we collect everything reasonably necessary to prepare your tax work and meet our obligations to the ATO and TPB. That typically includes: · Your full legal name, date of birth, residential address and contact details · Tax File Number (TFN) and ABN where applicable · Identity documents required to verify you under the Tax Agent Services Act · Bank account details for refund deposits · Income records — PAYG summaries, business income, rental schedules, dividends, capital gains events · Expense records — receipts, invoices, vehicle logbooks, depreciation schedules · Records of dependants and spouse where relevant for offsets and rebates · Past correspondence with the ATO and any other accounting professionals For business clients we additionally collect company / trust / SMSF documents, employee payroll information, and bank or accounting-software exports. From website visitors who don't engage us, we collect only what's necessary to keep the site working: IP address, browser and device information, pages viewed, and referrer. We do not build advertising or marketing profiles from this data.

SECTION 3

Most information comes directly from you — when you sign an engagement letter, complete an intake form, upload to the client portal, or hand us paper records in our Melton office. Some information we collect from third parties on your behalf, with your consent: · The Australian Taxation Office, via the registered-agent portal, for pre-filled income data and lodgement history · Your prior accountant, via an ethical-clearance request between agents · Your employer, bank, super fund, or share registry where you've authorised us to obtain a specific document We never collect information about you from sources you haven't authorised.

SECTION 4

We use your information to: · Prepare and lodge your tax returns, BAS, IAS, financial statements and other engagements · Verify your identity under the Tax Agent Services Act 2009 and the Tax Practitioners Board's Proof of Identity guidance, and to meet our obligations under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) where it applies to a service we provide · Communicate with you about your engagement — by phone, email, SMS, or through the client portal, depending on what you've told us you prefer · Issue invoices, accept payment, and provide receipts for your records · Improve our services and run the firm responsibly We do not sell your information to anyone, ever. We do not use it to advertise unrelated products or services to you, and we never enrol you in marketing newsletters without your explicit opt-in. We do not enter joint-marketing arrangements and we do not share your information with business partners for marketing purposes.

SECTION 5

TFNs sit under tighter rules than ordinary personal information. The Privacy (Tax File Number) Rule 2015 limits how we may collect, use and disclose a TFN. We collect your TFN only when it's lawful and necessary for tax administration purposes. We use it only to identify you in dealings with the ATO and other authorised agencies. We never disclose it to anyone except where required or expressly permitted by law — for example, when lodging a return on your behalf. We store TFNs on encrypted Australian servers (see 'Storage and security' below) and on paper only inside locked storage. TFNs and identity documents are encrypted at rest separately from other personal information, with access logged.

SECTION 6

Before we lodge anything for you, we are required to verify your identity. This obligation comes from the Tax Agent Services Act 2009 and the Tax Practitioners Board's Proof of Identity guidance for tax-agent clients. We verify identity using government-issued documents (driver licence, passport, Medicare card or similar) at first engagement and again whenever your circumstances materially change. Where the law requires it (for example, AML/CTF customer due diligence on certain trust or company structuring work), we may also match information you provide against publicly available sources such as the Australian Business Register or the Document Verification Service. We keep a record that the verification took place and what documents were sighted, but where practical we do not retain a copy of the document itself beyond the period the law requires. We do not perform credit checks.

SECTION 7

We share your information only with parties who genuinely need it to deliver the work, or where the law requires it. Regulators and government bodies — Australian Taxation Office, Tax Practitioners Board, Australian Securities and Investments Commission (for company / trust matters), and the Australian Business Register. Information shared with these bodies is what's required by their lodgement, registration or compliance frameworks. Technology providers — we use a small set of carefully chosen services to run the firm: · Supabase (data hosted in the Sydney region of AWS) for the client portal, document storage and authentication · Resend for transactional email (booking confirmations, lodgement reminders) · Vercel for website hosting · Plausible Analytics or Vercel Analytics for privacy-friendly traffic analysis · Xero, MYOB or QuickBooks where we maintain bookkeeping on your behalf Each provider is bound by their own privacy and security commitments and only handles the minimum information needed for their role. Other tax agents — only with your written consent, and typically only as part of an ethical-clearance process when you switch firms. Legal disclosure — we will disclose information when compelled by Australian law (court orders, statutory notices, search warrants). If we receive such a request and we are legally permitted to tell you, we will. We do not disclose your information to overseas recipients. All third parties listed above process Australian client data on Australian infrastructure.

SECTION 8

Digital records are stored on encrypted servers in the Sydney region of Australia. Data is encrypted at rest using industry-standard AES-256 and in transit using TLS 1.2 or higher. Access to client data is restricted to firm staff who need it for their work, and every access is logged. Physical records are kept in locked storage and destroyed via a secure shredding service when their retention period ends. We keep client records for at least five years from the end of the engagement to which they relate, in line with the record-keeping requirements of the Income Tax Assessment Act 1936 and the Tax Agent Services Act 2009. Some records are kept longer where law or professional standards require it. If you start an enquiry or upload documents but do not engage us, we delete the information after 24 months unless you ask us to retain it sooner or longer. The same applies to incomplete tax returns prepared in our portal — if a return is started but not signed for lodgement, we delete the working data after the third tax season following commencement. No system is perfectly secure. If a data breach occurs that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner promptly under the Notifiable Data Breaches scheme.

SECTION 9

Under the Australian Privacy Principles you have the right to: · Ask what personal information we hold about you and receive a copy of it · Correct any information that is inaccurate, out of date, incomplete or misleading · Ask us to delete information we no longer need to hold (subject to our record-keeping obligations as a tax agent — some records we are required by law to retain) · Deal with us anonymously or under a pseudonym where the law allows it (rare in tax practice — you generally cannot lodge a return anonymously) · Lodge a complaint about how we have handled your information — see 'Complaints' below To exercise any of these rights, email privacy@taxtracker.com.au or write to us at 26 Basildon Crescent, Strathtulloh VIC 3338. We respond within 30 days. There's no fee unless your request is unusually large or repetitive, in which case we'll quote you in advance.

SECTION 10

We do not run mass-marketing campaigns. The only emails we send to clients are about your engagement — appointment reminders, lodgement updates, ATO correspondence, fee invoices and similar. We may occasionally send a small number of clients an opt-in newsletter covering tax-law changes that might affect them. You will only receive that newsletter if you have explicitly opted in. Marketing emails and SMS are sent only with your express consent and comply with the Spam Act 2003 (Cth) — every commercial message contains a functional unsubscribe link as required by section 18 of that Act. We do not enter joint-marketing arrangements and we do not share your information with business partners for marketing purposes.

SECTION 11

Our website uses two kinds of cookies. Essential cookies keep the client portal working — they remember that you're signed in and protect against cross-site request forgery. These cannot be disabled without breaking the portal. Analytics cookies — currently Plausible (or Vercel Analytics where it provides equivalent privacy guarantees) — give us aggregate traffic information so we know which pages are useful. They do not identify individual visitors and do not follow you to other websites. We do not use Facebook Pixel, Google Ads remarketing, or any third-party advertising trackers. You can disable analytics cookies in your browser settings without affecting site functionality.

SECTION 12

We don't engage with children under 16 as primary clients. Where a client's tax matters involve a dependent child (for example, family-tax-benefit reconciliation), we collect only the information necessary for that purpose, and only with the parent or guardian's authority.

SECTION 13

If Tax Tracker Pty Ltd is sold, merged, or has its assets transferred to another entity, your information may transfer to the buyer or successor entity on the same terms as this privacy policy. We will email all current clients at least 30 days before the transfer takes effect so you have an opportunity to ask questions or withdraw consent before the change. Any successor entity must be a registered tax agent or operate the data under an equivalent privacy framework.

SECTION 14

We review this policy at least annually and whenever our processes or technology providers change in a way that affects you. The latest version is always at taxtracker.com.au/legal/privacy with the 'last updated' date at the top. Material changes will be notified to current clients by email at least 30 days before they take effect. Continued use of our services after that date constitutes acceptance of the updated policy.

SECTION 15

If you believe we have mishandled your personal information, the fastest path is to email privacy@taxtracker.com.au with a description of what happened. We will acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you are not satisfied with our response, you may escalate to: · The Office of the Australian Information Commissioner (OAIC) — for privacy matters under the Privacy Act 1988. Visit oaic.gov.au or call 1300 363 992. · The Tax Practitioners Board (TPB) — for matters involving our conduct as a registered tax agent. Visit tpb.gov.au.

SECTION 16

Privacy queries: privacy@taxtracker.com.au General enquiries: info@taxtracker.com.au Postal: 26 Basildon Crescent, Strathtulloh VIC 3338 Phone: (03) 8732 2126 We are Tax Tracker Pty Ltd, registered with the Tax Practitioners Board as a tax agent under registration number 26321143. Liability is limited by a scheme approved under Professional Standards Legislation.