Privacy Policy
1. About this policy.
This policy explains how Aetos Law Pty Ltd (ACN 701 919 173, ABN 27 701 919 173) ("we" or "us") collects, holds, uses and discloses personal information, how this website handles information, and how you can see or correct your information or make a complaint. We are an incorporated legal practice in Sydney, Australia, and we give legal advice on commercial and corporate transactions, capital markets, credit, restructuring, and private wealth and succession. We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth), and as lawyers we also owe our clients a duty of confidentiality (see paragraph 14). Personal information is information or an opinion about a person who is identified, or who can reasonably be identified. We may update this policy, for example to reflect changes in the law, in how we work or in how this website operates. The current version will always be on this page with the date it was last updated, and you can ask us for a copy of an earlier version.
2. Contacting our Privacy Officer.
For any privacy question, request or complaint, please contact our Privacy Officer by email at law@aetos.com.au (please put "Privacy" in the subject line), by telephone on 02 9090 4851, or by post to Privacy Officer, Aetos Law Pty Ltd, Level 15, 1 O'Connell Street, Sydney NSW 2000. If you would like this policy in another form, such as a printed copy, please ask. There is no charge.
3. Information we collect when you contact us.
What we collect depends on how you deal with us. When you email, call or write to us, including by sending the email that our website's consultation form prepares, we collect your name and contact details, the area of law your enquiry is about, a short description of the topic and anything else you choose to tell us. If you contact us for an organisation, we also collect its name and your role. We collect the contact and business details of referrers, suppliers and contractors, and if you apply to work with us, we collect the information in your application.
4. Information we collect in matters.
Our clients include businesses, boards, lenders, funds, insolvency practitioners, directors, families and family offices. When we consider acting in a matter, or act in one, we may collect names, addresses, telephone numbers, email addresses, dates of birth, occupations and roles in organisations; identity documents and their details, such as a passport or driver licence; information about directors, shareholders, beneficial owners, trustees, beneficiaries and others connected with a client; the results of identity, sanctions and other screening checks, including checks the law requires; financial information, such as bank account details, assets, liabilities, income, transactions, and where funds or wealth came from; tax information, including a tax file number where a matter needs it and the law permits; information about the matter itself, such as the transaction, dispute, structure or family arrangement involved, and related correspondence, documents and file notes; and billing, payment and trust account records. During a matter we may also hold information about people who are not our clients, including the other parties to a transaction or dispute and their representatives, witnesses, family members, beneficiaries, directors and employees of our clients, barristers, experts and other advisers.
5. Sensitive information.
Some matters need sensitive information. Examples are health information, such as information about a person's mental capacity in succession planning; criminal record information, such as in director or due diligence checks; and religious or philosophical beliefs, such as in estate or philanthropic planning. We collect sensitive information only when it is reasonably necessary for the matter and you consent, or when the law requires or allows it, for example where it is needed to establish, exercise or defend a legal claim. Where the Health Records and Information Privacy Act 2002 (NSW) applies to health information we hold, we also handle that information in line with the Health Privacy Principles in that Act.
6. How we collect it.
We collect most personal information directly from you, for example when you email or call us, meet with us, send us documents or instructions, or send the email that our website's consultation form prepares. Where reasonable or necessary for a matter, we also collect personal information from other people and sources, including our clients and people acting for them, such as their other advisers; other parties to a matter and their lawyers or representatives; public registers and records, such as those of the Australian Securities and Investments Commission (ASIC), the Personal Property Securities Register, land title registries, courts and the Australian Financial Security Authority; identity verification and screening services; and referrers and publicly available sources. If we receive personal information we did not ask for, we check whether we could have collected it in the normal course of our work. If we could not have, we destroy it, or de-identify it so that it no longer identifies anyone, where it is lawful and reasonable to do so. If you give us personal information about someone else, please make sure you are entitled to do so and, where appropriate, let them know about this policy.
7. Dealing with us anonymously.
You can read this website without telling us who you are, and without giving us any information apart from the standard technical records of visits, such as your IP address, that our hosting provider's servers ordinarily keep (see paragraph 8). You can also ask a general question without giving your name, or by using a name that is not your own. To advise or act for you, though, we need to know who you are. We must check for conflicts of interest before we act, and in some matters the law requires us to verify your identity. If you do not give us information we ask for, we may not be able to act for you, or we may have to stop acting.
8. How this website handles information.
This website has no accounts, logins or databases, and it does not store anything you type. It does not set cookies or use any similar technology to recognise or track you, and it does not use analytics, advertising tools, tracking pixels, or social media buttons or feeds. Our fonts, images and video come from this website itself, so apart from our website hosting provider and the companies it uses to provide its service, loading a page does not send your information to any other company. Like most web hosts, our hosting provider's servers ordinarily keep standard access logs, which can include your IP address, your browser and device type, the date and time of your visit, and the pages and files requested. This information can sometimes be personal information. The logs help keep the website running and secure, and we do not use them to identify visitors unless we need to investigate a security problem or misuse of the site, or the law requires it. Our hosting provider handles the logs under its own privacy policy, keeps them for a limited period, and holds or processes them outside Australia (see paragraph 12). If we change how this website handles information, for example by adding analytics, we will update this policy at the same time.
9. The consultation form.
The form on this website does not send or store anything itself. When you press the button, your device opens your default email app, if one is set up, with a draft email addressed to law@aetos.com.au. The draft contains your name, your email or phone number, the area of law you chose and, if you added one, a one-line topic. Nothing reaches us unless you choose to send that email. Once you send it, it is an ordinary email, handled by your email provider and by ours, and your device or email app may also keep a copy of the draft. Please do not send confidential details until we confirm we can act for you. Contacting us does not, by itself, make you a client.
10. Why we collect, hold, use and disclose personal information, and automated decisions.
We do this to respond to your enquiry and arrange a consultation; check for conflicts of interest and decide whether we can act; verify identity and carry out screening checks, including the checks the law requires, before and while we act, including customer due diligence under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) where it applies to our services; give legal advice and provide our legal services, including preparing documents, negotiating, and acting in transactions and disputes; manage our agreements with clients, costs, billing, payments and money held in trust; meet our legal, regulatory and professional obligations, including keeping records, reporting to regulators and dealing with our professional indemnity insurer; run our practice, including managing our systems and keeping information secure; keep this website running and secure; and send you legal updates or invitations, if you have asked for them or the law otherwise allows. You can ask us to stop sending updates or invitations at any time. We may also use or disclose personal information for another purpose if you would reasonably expect it and the purpose is related to those above (for sensitive information, the purpose must be directly related), if you consent, or if the law requires or allows it. We do not sell personal information. We do not use computer programs to make decisions about you that could reasonably be expected to significantly affect your rights or interests, or to do anything substantially and directly related to making such a decision. Decisions about whether we can act for you, and about the work we do on your matter, are made by people, not software, and this website makes no decisions about you. If we start using computer programs in this way, we will update this policy to describe the kinds of personal information used and the kinds of decisions involved.
11. Who we may disclose it to.
Depending on the matter, we may disclose personal information to people involved in your matter, as you instruct or as the matter reasonably needs, including other parties and their lawyers, barristers, experts, financiers, insolvency practitioners and your other advisers; courts, tribunals, registries and government agencies, for example when we file or register documents; service providers who help us run our practice, including our email and IT providers, our website hosting provider, other key providers, for example practice management, document storage, accounting, identity verification and secure destruction services, and our banks; our professional indemnity insurer, and the auditors, trust account examiners and professional advisers who review or support our practice; regulators and law enforcement bodies, where the law requires or allows it, such as the Law Society of New South Wales, the Office of the NSW Legal Services Commissioner, the Australian Transaction Reports and Analysis Centre (AUSTRAC) and the Australian Taxation Office; and anyone else you authorise. When we use service providers, we take reasonable steps to ensure they protect personal information and use it only to provide services to us. Our website hosting provider is the exception for its access logs, which it handles under its own privacy policy (see paragraph 8). Some laws, including anti-money laundering laws, require us to report certain information to authorities, and some of those laws may also prevent us from telling you that we have done so.
12. Disclosure outside Australia.
Most of our work happens in Australia. Some personal information is held or processed outside Australia, and in some matters we are likely to disclose personal information outside Australia. Our website hosting provider is based outside Australia, and the access logs described in paragraph 8 are held or processed outside Australia. Our email and IT providers, and the companies they use, may store or process information outside Australia, for example to provide support, security and maintenance. Some matters involve overseas parties, assets, investors, registries or courts. Examples are cross-border capital raisings or families with members abroad. In those matters we may disclose personal information to lawyers, advisers, other parties, registries or authorities in the countries involved, usually on your instructions. Our service providers use data centres, networks and support teams in a number of countries, and those locations can change over time. The countries involved in a matter depend on that matter. For these reasons it is not practicable to list the countries in advance. If you would like to know whether your information is likely to go to a particular country, including through one of our service providers, please ask us using the details in paragraph 2. Before we disclose personal information overseas, we take reasonable steps to ensure the recipient handles it in line with the Australian Privacy Principles, unless the Privacy Act makes an exception. For example, an Australian law may require or authorise the disclosure; we may reasonably believe the recipient is bound by a law or binding scheme that protects the information in a substantially similar way, and that you can take action to enforce that protection; or, for a disclosure made on your instructions, we may ask for your consent instead, and if we do, we will first tell you that, if you consent, we will not have to take those steps.
13. How we protect personal information and how long we keep it.
We hold personal information electronically, in our email and document systems, and where needed we also hold paper files at our office. We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, change or disclosure. These steps include technical and organisational measures, such as multi-factor sign-in for email and systems, encrypted devices, access limited to people who need it, locked storage for paper files, and secure destruction. No way of storing or sending information is completely secure, and email in particular can be intercepted or sent to the wrong person, so if you would like to send us sensitive documents another way, please ask. If we become aware of a data breach, we will act promptly to contain it and assess it, and where the law requires, or where we otherwise consider it appropriate, we will tell the people affected and the Office of the Australian Information Commissioner. We keep personal information only as long as we need it for the purposes in this policy, or as long as the law requires. For example, where anti-money laundering laws apply to our services, records of identity checks and customer due diligence must generally be kept for seven years after the client relationship ends. Legal profession laws require us to keep trust account records and other practice records for set periods. We generally keep client files for seven years after a matter ends, and longer where the law requires it or where a legal claim about the matter could still be brought. We also keep original documents held in safe custody, such as wills or deeds, until they are collected or no longer need to be kept. When we no longer need personal information, and the law no longer requires us to keep it, we take reasonable steps to destroy it securely or de-identify it.
14. Confidentiality, and seeing or correcting your information.
As lawyers, we owe our clients a duty of confidentiality. We keep client information confidential and disclose it only with the client's permission, or where the law requires or allows it, and this duty continues after a matter ends. Many communications between us and our clients are also protected by legal professional privilege, which belongs to the client; we will not give it up without the client's instructions, and we will claim it on the client's behalf where appropriate. You can ask to see the personal information we hold about you, and ask us to correct it, using the details in paragraph 2. We will need to confirm your identity before we act on a request, and we will respond within a reasonable time, usually within 30 days. Making a request is free, but if giving access involves significant time or cost, we may charge a reasonable fee, and we will tell you before we do. We may refuse access, or give only part of it, where the law allows, for example where giving access would unreasonably affect another person's privacy, would breach a duty of confidentiality or reveal privileged information, or where the information relates to existing or expected legal proceedings between you and us and you could not get it through the court process, or where the law otherwise requires or authorises us to refuse. This means that if someone who is not our client asks for information we hold about them in a client's matter, we may be unable to provide it. If we refuse, or cannot give access in the way you asked, we will take any reasonable steps we can to give access in another way that meets both your needs and ours, for example through an intermediary we both agree on. We will tell you why in writing and explain how you can complain, but we may leave out the reasons where giving them would be unreasonable or unlawful. If you think information we hold about you is inaccurate, out of date, incomplete, irrelevant or misleading, please tell us, and we will take reasonable steps to correct it at no charge. If we do not agree to correct it, we will tell you why in writing, unless that would be unreasonable, and explain how you can complain; you can then ask us to keep a statement with the information saying that you believe it is wrong, and we will take reasonable steps to keep it in a way that anyone using the information will see it. If we correct information we previously gave to someone else, you can ask us to tell them, and we will, unless that is not practical or would be unlawful.
15. Complaints.
If you have a concern about how we have handled your personal information, please contact us first using the details in paragraph 2, preferably in writing, and tell us what happened, when it happened and what you would like us to do. We will acknowledge your complaint promptly, look into it, and aim to respond in writing within 30 days, and if we need more time, we will tell you why. You can complain to the Office of the Australian Information Commissioner (OAIC) if you are not satisfied with our response, or if we have not responded within 30 days. The OAIC generally expects you to complain to us first, accepts complaints in writing, and will consider whether it can deal with yours; you can contact it online at www.oaic.gov.au, by telephone on 1300 363 992, or by post to GPO Box 5288, Sydney NSW 2001.