YOUR PRIVACY
Last updated: 28 September 2026
New Leaf Advisory Pty Ltd (ABN 11 161 204 762) (referred to in this Privacy Policy as “New Leaf Advisory”, “NLA”, “we”, “us” or “our”) respects your privacy and is committed to protecting the personal information you entrust to us.
As a Chartered Accounting and Advisory firm, we collect and use personal information to provide accounting, taxation and advisory services, manage our relationship with you, meet our legal and regulatory obligations, and operate and improve our business and website.
This Privacy Policy explains how we collect, hold, use and disclose personal information and how you can access or seek correction of the personal information we hold about you.
We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), where applicable.
1. What personal information we collect
The type of personal information we collect depends on how you interact with us and the services we provide.
This may include:
- your name and contact details, including email address, telephone number and residential or business address;
- date of birth and other identifying information;
- information about your business, employment, financial affairs, investments, taxation affairs, superannuation and other matters relevant to the services we provide;
- information relating to companies, trusts, partnerships, self-managed superannuation funds and other entities with which you are associated;
- information required to establish, verify and maintain your identity;
- information provided to us when you make an enquiry, complete a form, communicate with us or engage us to provide services;
- information contained in documents and records you provide to us;
- payment and billing information;
- information relating to your use of our website and interactions with our digital communications; and
- any other information reasonably necessary for us to provide our services or meet our legal and regulatory obligations.
Where reasonably necessary for our functions or activities, we may collect sensitive information with your consent or where its collection is otherwise permitted or required by law. We do not seek to collect sensitive information unless it is necessary for a particular service or legal obligation.
2. How we collect personal information
We generally collect personal information directly from you. For example, we may collect information when you:
- contact us by telephone, email or through our website;
- submit an enquiry or complete a website form;
- become a client or prospective client;
- provide information or documents to us in connection with our services;
- communicate with members of our team;
- subscribe to our marketing communications;
- interact with our website or digital communications; or
- otherwise deal with us in the course of providing or receiving services.
We may also collect personal information from third parties where appropriate and permitted by law. This may include information provided by your authorised representatives, related entities, professional advisers, government agencies, regulators, financial institutions or other service providers.
Where we collect personal information from a third party, we will take reasonable steps to ensure that the collection and use of that information is permitted under applicable privacy laws.
3. Why we collect, hold, use and disclose personal information
We collect, hold, use and disclose personal information for purposes including:
- providing accounting, taxation and advisory services;
- responding to enquiries and requests;
- establishing and managing client relationships;
- preparing and lodging taxation and other regulatory documents;
- providing technical, accounting and business advice;
- communicating with clients and prospective clients;
- processing payments, billing and managing our accounts;
- maintaining our records;
- meeting our professional, legal and regulatory obligations;
- verifying identity and conducting customer due diligence;
- identifying and managing risks relating to fraud, money laundering, terrorism financing and other unlawful activities;
- complying with requirements imposed by government agencies, regulators and professional bodies;
- improving our services, systems and website;
- analysing website usage and digital engagement;
- sending information, updates and marketing communications where permitted by law and in accordance with your preferences; and
- managing and protecting our business, systems, property and people.
We will not use or disclose personal information for purposes that are incompatible with the purpose for which it was collected, unless permitted or required by law.
4. Identity verification and AML/CTF requirements
New Leaf Advisory may be required to collect and verify personal information to meet our legal and regulatory obligations, including obligations under Australian anti-money laundering and counter-terrorism financing (AML/CTF) laws.
Depending on the services we provide and the circumstances of the relationship, this may include collecting information such as your full legal name, date of birth, residential address and other information necessary to establish and verify your identity.
We may use electronic identity verification services or other appropriate verification methods to assist us in meeting these obligations.
We may also be required to collect information about individuals connected with a client or entity, including directors, trustees, beneficiaries, beneficial owners, authorised representatives and other relevant persons.
In some circumstances, we may be unable to provide or continue providing certain services until the required identity verification or customer due diligence requirements have been completed.
Where required by law, we may also disclose information to government agencies or regulators, including the Australian Transaction Reports and Analysis Centre (AUSTRAC), and may be prohibited from notifying an individual about certain disclosures.
5. Marketing communications
We may use your personal information to provide you with information about our services, insights, events, publications and other communications that may be relevant to you.
Where required, we will obtain your consent to send direct marketing communications.
You can unsubscribe from marketing communications at any time by using the unsubscribe facility included in the communication or by contacting us directly.
Unsubscribing from marketing communications will not affect communications that we are required or permitted to provide for service, contractual, legal or regulatory purposes.
6. Website analytics, cookies and measurement
Our website uses cookies and similar technologies to help us understand how visitors use our website and to improve the website experience.
We use Google Tag Manager and Google Analytics 4, together with a website measurement layer provided and managed by Digibrand, to collect information about how visitors interact with our website.
The website measurement layer may record behavioural information such as:
- which pages a visitor views;
- how far a visitor scrolls down a page;
- which sections of a page come into view;
- which buttons or links are clicked;
- whether a visitor begins completing a form;
- the date and time of an interaction with our website;
- whether a form is submitted or abandoned; and
- how long a visitor remains on a page.
This information is collected as behavioural or analytical data and is used to understand patterns of website use, identify areas for improvement, and improve the performance and visitor experience of our website.
The website measurement layer:
- does not read information that visitors type into forms or fields;
- does not collect passwords, payment details or other form-field content;
- does not record or replay visitor screens;
- does not take screenshots; and
- does not intentionally follow identified individuals across sessions.
However, cookies and similar technologies may assign or use an online identifier that enables a browser or device to be recognised during a session or across multiple sessions.
Our website contact form operates separately from our website analytics. Information submitted through a contact form is stored within our website administration system. The behavioural analytics data and contact form submissions are not combined using an identifier controlled by us.
Google Analytics may collect information such as IP address, device and browser information, approximate location, pages viewed, session information and information about how a visitor arrived at our website. Google operates servers in multiple countries and information collected through Google services may be processed outside Australia.
We may also use Meta technologies, including the Meta Pixel, through Google Tag Manager, to collect information about interactions with our website. This may include information such as website visits, page views, interactions and other website activity. This information may be used for website measurement and analytics and, where applicable, advertising or audience-related purposes. Meta may process information collected through these technologies outside Australia.
We take reasonable steps, where required by the Privacy Act 1988 (Cth), to ensure that overseas recipients of personal information handle that information in accordance with applicable privacy requirements.
We may also use de-identified and aggregated information about how visitors use our website to identify broader patterns and improve our website, content and digital performance. This information does not include information that identifies an individual visitor.
Where we use cookies or similar technologies that require consent under applicable law, we will provide an appropriate mechanism for visitors to make and manage their choices.
7. Disclosure of personal information
We do not sell personal information.
We may disclose personal information where reasonably necessary for the purposes described in this Privacy Policy or where permitted or required by law.
Depending on the circumstances, information may be disclosed to:
- employees, contractors and professional advisers of NLA;
- software and technology providers that assist us to provide our services and operate our business;
- website, hosting, analytics and digital service providers;
- payment and billing providers;
- identity verification and customer due diligence providers;
- professional advisers, including lawyers and other specialist advisers;
- government agencies and regulators;
- professional and industry bodies where required or permitted;
- financial institutions or other organisations where necessary to provide services or complete a transaction; and
- other parties where you have authorised us to do so or where disclosure is otherwise permitted or required by law.
Where we engage third-party service providers to handle personal information on our behalf, we take reasonable steps to ensure that appropriate arrangements are in place for the protection of that information.
8. Overseas disclosure and storage
Some of the service providers we use may store or process personal information outside Australia.
For example, information collected through Google Analytics may be stored or processed on Google’s servers.
Where we disclose personal information to an overseas recipient, we will take reasonable steps to ensure that the disclosure and handling of that information complies with applicable privacy laws, unless an exception under those laws applies.
The countries in which overseas recipients may be located will depend on the service providers and technology platforms we use from time to time. Where practicable, we will identify relevant overseas recipients or countries in accordance with applicable privacy requirements.
9. How we hold and protect personal information
We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure.
Depending on the nature of the information and how it is held, security measures may include access controls, authentication, secure systems, encryption, service-provider security controls and internal policies and procedures.
Access to personal information is limited to people who require it for legitimate business, service delivery or regulatory purposes.
No method of electronic storage or transmission is completely secure. While we take reasonable steps to protect information, we cannot guarantee the security of information transmitted to us electronically.
10. Retention of personal information
We retain personal information for as long as reasonably necessary for the purposes for which it was collected, including providing services, maintaining appropriate business and professional records, resolving disputes and meeting legal, regulatory, taxation, accounting, AML/CTF and other record-keeping obligations.
Where personal information is no longer required and we are not required to retain it by law, we will take reasonable steps to securely destroy or de-identify it.
The retention period for website analytics information may differ from the retention period for client and business records and will depend on the relevant system and purpose.
11. Access to and correction of personal information
You may request access to personal information we hold about you.
You may also ask us to correct personal information if you believe it is inaccurate, incomplete, out of date or misleading.
To make a request, please contact us using the details provided below.
We may need to verify your identity before providing access to or making changes to personal information.
In some circumstances, we may be unable to provide access to particular information where an exception under applicable law applies. If this occurs, we will explain the reason where we are permitted to do so.
12. Privacy complaints
If you believe that we have not handled your personal information appropriately or have breached an Australian Privacy Principle, we encourage you to contact us first so that we can investigate and seek to resolve your concern.
Please contact:
Patrick McStay
New Leaf Advisory Pty Ltd
Email: contact@newleafadvisory.com.au
Phone: 02 8559 0100
We will acknowledge your complaint and seek to investigate and respond within a reasonable period.
If you are not satisfied with our response, or if you do not wish to contact us, you may contact the Office of the Australian Information Commissioner (OAIC).
Further information about making a privacy complaint is available from the OAIC at www.oaic.gov.au.
13. Anonymity and pseudonymity
Where it is lawful and practicable, you may choose not to identify yourself or to use a pseudonym when dealing with us.
However, this may not be possible where we are required by law or where it is impracticable for us to provide our services without establishing and/or verifying your identity. This will ordinarily apply where we need to identify you to provide professional services or to satisfy legal or regulatory requirements, including identity verification processes and/ or AML/CTF obligations.
14. Links to other websites
Our website may contain links to websites operated by third parties.
These links are provided for convenience and do not constitute sponsorship, endorsement or approval of those websites or their privacy practices.
We are not responsible for the privacy practices or content of third-party websites. We encourage you to review the privacy policy of any third-party website you visit.
15. Changes to this Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to our business, information handling practices, technology or legal and regulatory requirements.
The updated Privacy Policy will be published on our website and will take effect from the date stated at the beginning of the policy.
We encourage you to review this Privacy Policy periodically.
16. Contact us
If you have any questions about this Privacy Policy or how we handle personal information, please contact us:
New Leaf Advisory Pty Ltd
Email: contact@newleafadvisory.com.au
Phone: 02 8559 0100
Website: newleafadvisory.com.au