Privacy Policy

This policy relates to Nexia’s collection and handling of personal information that is covered by the Privacy Act. It is not intended to cover categories of personal information that are not covered by the Privacy Act.

Collection of personal information

Nexia collects and holds personal information from clients, customers, employees, contractors and other individuals. ‘Personal information’ means information or an opinion about an individual whose identity is apparent or reasonably ascertained. We collect and hold this information when it is necessary for business purposes.

The main types of personal information Nexia collects and holds relate to the contact details and organisational roles of our clients, suppliers and other business contacts. Typically, this information includes names, birth dates, addresses, telephone numbers, e-mail addresses and job titles. In the course of providing professional services to our clients, we may collect and hold more detailed personal information, for example:

• where relevant to the services we are providing you, your financial information about your assets, occupation and income, bank account balances, account activities, payment history;
• government identifiers such as Tax File Number, drivers’ license, passport and Medicare numbers and visa/work permit status;
• shareholdings and details of investments;
• details of superannuation and insurance arrangements;
• educational qualifications, employment history and salary;
• Membership of a political association or membership of a trade union; and/or
• personal information about your spouse and dependents.

It may also be necessary, in some circumstances, for us to collect sensitive information in order to provide specific services or for recruiting purposes. Examples of the types of sensitive information that may be collected in such circumstances include professional memberships, racial or ethnic origin, criminal record and health information.

Whenever we collect information from you, we will do everything we can to let you know:

• how to contact us;
• why we are collecting the information;
• the organisation or types of organisations to which we usually disclose that kind of information;
• if we are required by law to collect the information;
• the consequences for you if the information is not provided;
• how you may access and correct the information;
• how to complain about a breach of the Australian Privacy Principles; and
• whether we will disclose your information to overseas recipients, and the countries in which such recipients are likely to be located.

We collect most information directly from individuals when we deal with them. The personal information we collect may be provided in forms filled out by individuals, face to face meetings, email messages, telephone conversations, when you use our websites, social media, digital apps or tools, or by third parties. If you contact us, we may keep a record of that contact. There may also be occasions when we collect your personal information from other sources such as:

• your employer where they are our client
• your family members
• your representatives
• agents or referral partners
• a related body corporate or business partner or associate of Nexia
• when you link or authorise the linking of third party services such as banking services to our digital apps or tools, and/or
• a publicly available record.

Because of the nature of our business, it is generally impracticable for us to deal with individuals on an anonymous basis or through the use of a pseudonym, although sometimes this is possible (for example, when seeking staff or client feedback generally).

Holding personal information

Nexia will generally hold your personal information as either physical record, records on our servers, and in some cases, records on third party servers, which in some instances may be located overseas. We take security measures to protect the personal information we hold including physical (for example, security passes to enter our offices and storage of files in lockable cabinets) and technology (for example, restriction of access, firewalls, the use of encryption, passwords and digital certificates) security measures. We also have document retention policies and processes. In some cases, Nexia engages third parties to host electronic data (including data in relation to the services we provide) on our behalf.

Accessing and correction of personal information

We will take reasonable steps to ensure that your personal information is accurate, complete, up to date, and relevant whenever it is used, collected or disclosed. You may request access to your personal information by contacting the Privacy Officer within your local state via the form below. Subject to any legal restrictions we would be happy to advise you what personal information we hold about you if you request this. When you make a request to access personal information, we will require you to provide some form of identification (such as a driver’s license or passport) so we can verify that you are the person to whom the information relates. We will respond to all requests within a reasonable period.

There may be some cost to you to cover the cost of retrieving and processing the information if it requires a significant amount of time to locate or collect your information or to present it in an appropriate form. We will let you know in advance if any charges will apply.

We rely on the accuracy of the information you provide to us. If you think that we may hold information about you that is incorrect in any way, please contact us and we will correct any errors or inaccuracies where required.

If you wish to have your personal information deleted, please let us know and we will take all reasonable steps to delete, de-identify or destroy it immediately (unless we need to keep it for legal or internal risk management reasons, or compliance with our professional obligations). Nexia will in any case destroy or de-identify personal information and records pertaining to you or services provided to you if the services have been completed or if the information or records are no longer required for any services, and provided that Nexia has no other legal or professional obligation to retain the information or records concerned.

If we are unable to provide you with access to your information, or make any amendments which you have requested, we will advise you of our reasons.

Use of personal information

The main purposes for which we collect, hold and use personal information are:

• to provide our services;
• to respond to an individual’s request;
• to maintain contact with clients;
• to keep clients and other contacts informed of the services we offer and industry developments that may be of interest to them, and to notify them of service offerings, seminars and other events we are holding;
• for general management and reporting purposes, such as invoicing and account management;
  for recruitment purposes;
• for purposes related to the employment of our personnel and providing internal services to our staff; and
• other purposes related to our business.
• to protect our rights or property and that of our users and, where appropriate, to comply with legal processes, which may include disclosures to law enforcement, regulatory or government agencies

If you choose not to provide us with personal information, we may be unable to do such things.

We may collect, hold and use personal information about individuals to market our services, including by email. However, individuals always have the opportunity to elect not to receive further marketing information from us by contacting the Privacy Officer within your local state via the form below . Alternatively, if we have contacted you by email, you may use the unsubscribe function in that email to notify us that you do not want to receive further marketing information from us by email.

If we collect, hold or use personal information in ways other than as stated in this policy, we will ensure we do so pursuant to the requirements of the Privacy Act.

Employee records are not generally subject to the Privacy Act and therefore this policy may not apply to the handling of information about employees by Nexia. For information about our practices relating to employee information, please contact us directly.

Disclosure of personal information

Generally, we will only disclose your personal information for a purpose set out above. We do not routinely disclose personal information to other organisations, unless:

• use or disclosure is permitted by this policy;
• we believe it is necessary to provide you with a product or service which you have requested (or, in the case of a partner, employee or contractor of Nexia, it is necessary for maintaining or related to your role at Nexia);
• to protect the rights, property or personal safety of any member of the public or a customer of Nexia or the interests of Nexia;
• some or all of the assets or operations of Nexia are or may be transferred to another party as part of the sale of some or all of Nexia’s business;
• you give your consent; or
• such disclosure is otherwise required or permitted by law, regulation, rule or professional standard.

We may also share non-personal, de-identified and aggregated information for research or promotional purposes. Except as set out in this policy, we do not sell to or trade personal information with third parties.

Nexia uses a range of service providers to help us maximise the quality and efficiency of our services and our business operations (including internal business requirements, such as recruitment and human resource requirements). This means that individuals and organisations outside of Nexia will sometimes have access to personal information held by us and may collect or use it from or on behalf of Nexia. This may include, but is not limited to, independent contractors and consultants, travel service providers, mail houses, off-site security storage providers, information technology providers, event managers, credit managers and debt collecting agencies.

We require our service providers to adhere to our privacy guidelines and not to keep, use or disclose personal information we provide to them for any unauthorised purposes.

If Nexia’s staff obtain products or services offered by a third party pursuant to an agreement or arrangement between that third party and Nexia, such as a credit card provider, we may provide your personal information to that third party, including information that relates to your use of such services.

Transfer of information outside Australia

In addition to disclosures permitted under this policy, we may disclose your personal information to other Nexia firms within the Nexia International (Nexia) network. For a list of where the Nexia firms are located, see Nexia member firm locations here.

Nexia and other Nexia firms with which we exchange information may also use overseas facilities or contractors to process or backup our information or to provide certain services to us. These Nexia firms, service providers and contractors may not be Australian entities or regulated by the Privacy Act, and may not be subject to privacy laws that provide the same level of protection as Australia’s. Nexia will however take steps reasonable in these circumstances to ensure the overseas recipient complies with the Australian Privacy Principles or is bound by a substantially similar privacy scheme unless you consent to the overseas disclosure or it is otherwise required or permitted by law.

You consent to the disclosure of your personal information to such Nexia firms, service providers and contractors on this basis.

Any such disclosure or transfer of information does not change any of our commitments to safeguard your privacy and the information remains subject to existing confidentiality obligations.

Privacy on our website sites and applications

This policy also applies to any personal information we collect via our websites, including nexia.com.au, and applications including mobile applications, in addition to personal information you provide to us directly – such as where you make a request or complete a registration form.

In order to properly manage our websites and applications, we may log certain statistics about the users of the facilities, for example the users’ domains and browser types. None of this information specifically identifies an individual and it is used solely to ensure that our websites and applications provide the best possible navigational experience for users.

Cookies and web beacons are used on this website.

Cookies are small text files that are placed on your computer by the websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site. If you are uncomfortable with the use of cookies, you can manage and control them through your browser, including removing cookies by deleting them from your ‘browser history’ (cache) when you leave the site. In most cases, you can refuse a cookie and still fully navigate the Nexia website.

A web beacon is a clear picture file used to keep track of your navigation through a website. Along with cookies, web beacons help us gain an understanding of how users of Nexia websites navigate through and process the content contained in those websites. On occasion Nexia will advertise on third party websites. As part of the tracking process for advertising campaigns we may at times use web beacons to count visitors who have come to our website after being exposed to advertising on a third party site.

We do not use this technology to access your personal information.

If you have registered an account with us, you will be identified by a user name and password when you log into our website or applications. The information we collect about members’ use of our websites may be used for measuring use and performance and in assisting to resolve any technical difficulties.

Because Nexia wants your user experience to be as informative and resourceful as possible, we provide a number of links to websites and embedded content operated by third parties that may also set cookies and web beacons. Nexia is not responsible for the privacy practices or policies of those sites. We encourage you to review each website’s privacy policy, especially if you intend to disclose any personal information via that site. A link to another non-Nexia website is not an express or implied endorsement, promotion or warranty of the products or services offered by or accessible through that site or advertised on that site.

Security of personal information

Depending on the purpose for which we have collected personal information (for example, registration for a Nexia event or a request for particular information or material), we may store some of the information electronically in our customer relationship management system. Some or all of this personal information may be available to partners and authorised staff of Nexia for use in accordance with this policy.

We require our employees and data processors to respect the confidentiality of any personal information held by Nexia.

Nexia endeavours to protect personal information in line with the terms provided by Australian Privacy Principle 11 (APP 11). This includes taking steps reasonable within the circumstances to ensure that the personal information it holds is protected from misuse, interference, and loss and from unauthorised access, modification or disclosure. We also endeavour to take all reasonable steps to keep secure any information that we hold about you, whether electronically or in hard copy, and to keep this information accurate and up to date.

Nexia has in place reasonable commercial standards of technology and operational security and takes all reasonable steps to ensure the security of personal information which it holds.

In accordance with Privacy Act 1988 (Cth), Nexia will destroy or de-identify personal information in circumstances where it is no longer required unless we are otherwise required or authorised by other laws to retain the information.

Data breach

A data breach occurs when personal information that an entity holds is subject to unauthorised access or disclosure, or is lost. Examples include:

• loss or theft of physical devices (such as laptops and storage devices) or paper records that contain personal information
• unauthorised access to personal information by an employee
• inadvertent disclosure of personal information due to ‘human error’, for example an email sent to the wrong person
• disclosure of an individual’s personal information to a scammer, as a result of inadequate identity verification procedures.

In the unlikely event of an ‘eligible data breach’ (where the access, disclosure or loss is likely to result in serious harm to any of the individuals to whom the information relates), Nexia will undertake the following steps (in accordance with their data breach response plan):

1. Contain the data breach to prevent any further compromise of personal information.
2. Assess the data breach by gathering the facts and evaluating the risks, including potential harm to affected individuals and, where possible, taking action to remediate any risk of harm.
3. Notify the individuals, the Commissioner (if required) and other entities depending on the categories of information involved in the data breach
4. Review the incident and consider what actions can be taken to prevent future breaches.

Protecting children’s privacy

We understand the importance of protecting children’s privacy, especially in an online environment.

In particular, our websites are not intentionally designed for or directed at children under the age of 13.

It is our policy to never knowingly collect or maintain information about anyone under the age of 13, except as part of a specific engagement to provide services which necessitates such personal information be collected or for the purposes of ensuring compliance with our auditor independence policies.

Questions and complaints

If you have any questions or concerns regarding your privacy, or if you would like to make a complaint about a possible breach of this Privacy Policy or the Australian Privacy Principles, you may direct your correspondence to the Privacy Officer within your local state via the form below.

We take all complaints seriously, and will respond to your complaint within a reasonable period.

If you believe that we have not adequately handled your complaint, you may complain to the Office of the Australian Information Commissioner.

Additional information

For further information about privacy and the protection of privacy, visit the Office of the Australian Information Commissioner’s website at www.oaic.gov.au.