1. About this policy

​

L & Co Chartered Accountants is the trading name of L&Co Pty Ltd (ABN 89 698 372 548) (L & Co, we, us), an accounting and advisory firm in Modbury, South Australia. This policy explains what personal information we collect, why we collect it, how we use, store and share it, and how you can see it, correct it or make a complaint. It covers our accounting, taxation, bookkeeping, payroll, business advisory and virtual CFO services, our website at www.l-co.com.au, and any other dealings you have with us.

 

We handle your personal information in line with the Australian Privacy Principles. As a registered tax agent and a firm of Chartered Accountants, we also owe our clients a duty of confidentiality under the Tax Agent Services Act 2009 and our professional standards. We hold tax file number information, so the Privacy (Tax File Number) Rule 2015 applies to us, and the Notifiable Data Breaches scheme applies to us for that information (sections 5 and 13).

2. What Personal Information We Collect

​

The information we collect depends on the services you use. It can include:

​

• your name, date of birth, address, email address and phone number

• identity documents, such as a driver’s licence or passport, which we must check before we act for you (section 6)

• your tax file number (TFN), ABN and other government identifiers needed for your tax affairs (section 5)

• financial information, such as income, expenses, assets, liabilities, bank account details, investments, superannuation, payroll and business records

• details of your business and its structure, owners, directors, employees and related parties

• employment and payroll details, where they are relevant to our work for you

• for some services, who owns or controls a company or trust, where funds come from, and whether a person holds a prominent public position

• your correspondence with us, including emails, messages and notes of meetings and calls

• website usage information, such as your IP address, browser type and the pages you view (section 15)
   

We collect sensitive information, such as health information, only with your consent and only where it is needed, for example to support a deduction or a hardship application.

​

If you give us information about other people, such as employees, family members or business partners, please let them know and tell them this policy is available.

​

3. How We Collect Personal Information

​

We collect most information directly from you or your authorised representative: at meetings, by phone and email, and through our onboarding forms, secure document links and, once it is available, our client portal.

​

We also collect information from others where you have authorised it or the law allows it. This includes the ATO and other government agencies, ASIC, your previous accountant, your bank or lender, your bookkeeper and your accounting software. We also use publicly available sources, including the ASIC and ABN Lookup registers.

​

Where it is practicable, we collect your information directly from you. If we receive information about you from someone else, we take reasonable steps to make sure you know we have it.

​

The contact form on our website collects your name, email address and phone number. If you contact us that way, or through social media, email or phone, we use the details you give us to respond.

​

You can make a general enquiry without telling us who you are. We cannot provide accounting or tax services without identifying you, because the law requires us to verify who our clients are.

​

4. Why We Collect, Hold, Use, and Disclose Personal Information

​

We use personal information to:

​

• provide the accounting, taxation, bookkeeping, payroll, business advisory and virtual CFO services you engage us for

• verify your identity, as the Tax Practitioners Board and the anti-money laundering law require (section 6)

• meet our legal and regulatory obligations, including under taxation law, the Tax Agent Services Act 2009 and the Anti-Money Laundering and Counter-Terrorism Financing Act 2006

• lodge returns, statements and forms with the ATO, ASIC and other agencies for you

• communicate with you about your engagement and your affairs, including invoices, reports, and reminders about lodgement and payment dates

• respond to your enquiries and tell you about our services

• run and improve our practice, including billing, quality reviews, insurance and handling complaints

• meet our professional and ethical obligations as members of Chartered Accountants Australia and New Zealand
   

We do not use your information for marketing without your consent (section 14), and we never sell, rent or trade it.

​

We will not use or disclose your personal information for a purpose other than the purpose for which it was collected, unless you consent, or the secondary use or disclosure is related to the primary purpose and you would reasonably expect us to use or disclose the information in that way.

​

5. Tax file numbers

​

The law that authorises us to collect your TFN. We are authorised to collect your tax file number under the Taxation Administration Act 1953, as a registered tax agent under the Tax Agent Services Act 2009. We handle it under the Privacy (Tax File Number) Rule 2015. Where we run your payroll and handle your employees’ tax file numbers, collection is authorised under Part VA of the Income Tax Assessment Act 1936.

​

Why we collect it. We collect your TFN only for a lawful taxation purpose: to prepare and lodge your returns, activity statements and related forms, and to deal with the ATO for you.

​

You do not have to give it to us. It is not an offence to refuse to give us your tax file number.

​

What happens if you do not. Without your TFN we may not be able to lodge for you or deal with the ATO on your behalf, and some of your income may be taxed at a higher rate.

​

How we handle it. We use and disclose your TFN only as taxation law allows. We do not use it to identify you in our records. Access is limited to the people who need it. We ask for it only through approved forms and secure channels, never by SMS or unencrypted email. We destroy it securely once we no longer need it.

​

6. Identity checks and anti-money laundering

​

Before we act for you, and from time to time afterwards, we have to check who you are. Depending on the services and your structure, this can include your name, date of birth and address, an identity document, who owns or controls a company or trust, where funds come from, and whether a person holds a prominent public position.

We collect and keep this information because the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 requires it. If you do not give it to us, we cannot act for you.

We keep identity and customer due diligence records for seven years after we stop acting for you (section 12). We are not required to keep scanned copies of your identity documents, and where we do not keep them we record that the check was done.

If we report a matter to AUSTRAC, the law may prevent us from telling you, and from giving you access to information connected with that report.

​

7. Who we disclose your personal information to

​

We disclose personal information only where it is needed for the purposes above. This can include:

​

• the ATO, ASIC, AUSTRAC, state revenue offices and other government agencies, where we act for you or the law requires it

• people you have authorised in writing, such as your bank, lender or broker, lawyer, financial planner, bookkeeper or new accountant

• the software and service providers listed in section 10

• the Tax Practitioners Board, Chartered Accountants Australia and New Zealand, quality reviewers, our professional indemnity insurers and our own advisers, where our professional standards or the law require it
   

We get your written authority before we disclose your information to anyone else. We never share your information with our other clients. Where the law requires us to disclose information, we disclose only what is required, and in some cases the law prevents us from telling you that we have made a disclosure.

​

8. How we use AI tools

 

We use artificial intelligence (AI) tools to help us work: to draft and summarise documents and correspondence, analyse information, check for errors and run administrative tasks. These tools include Claude, an AI assistant provided by Anthropic, the L & Co AI agents that run on it, and AI features built into our practice software (FYI, Xero and Microsoft 365).

These tools may process personal information about our clients and about other people who deal with us, including the content of emails sent to us.

A person reviews all AI output before we rely on it. AI tools do not give advice, send emails or lodge forms for us.
We use only tools whose terms or settings prevent your information being used to train AI models. Claude stores data in the United States (section 10).

If you are a client, we use Claude and our AI agents on your information only with your written permission, which we ask for in our engagement letter. You can ask us how AI was used on your work, and you can withdraw your permission at any time by contacting us.

AI features built into our practice software are part of how those systems work and cannot be switched off for individual clients.

 

9. Automated decisions

 

We do not use computer programs, including AI, to make decisions about you on their own, and we do not use them to carry out a step in making a decision that could reasonably be expected to significantly affect your rights or interests.

​

Computer programs do help us prepare work that can affect you, such as tax returns, activity statements, financial statements and payroll. They use the identity, tax and financial information described in this policy. In every case a qualified person reviews the result and makes the decision.

​

If that changes, we will update this section and tell you what the program does, what information it uses and what kinds of decisions it affects.

 

10. Where your information is stored

 

Some of our software providers store information outside Australia. Our providers hold your information in Australia, the United States and Ireland, and some of those providers are themselves based overseas: Wix is based in Israel, and Xero is a New Zealand group. We choose providers whose written terms require them to keep information confidential and secure and to tell us about a data breach, and we take reasonable steps to ensure those providers protect your information to a comparable standard.

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

 

We keep this list current and update it when we change providers or a provider changes where it holds information.

 

11. How we keep your information secure

 

We hold your records electronically. Original documents stay with you; we keep electronic copies. We take reasonable steps to protect the information we hold from misuse, interference and loss, and from unauthorised access, modification or disclosure.

 

These measures include:

• keeping client documents in our practice management system, with access limited to the people who need it

• multi-factor authentication, encryption and managed passwords for our systems and devices

• tighter access controls for identity documents and tax file numbers

• sharing documents that contain sensitive details through secure links, not as plain email attachments

• backups, and regular review of our security practices

 

When information is no longer needed for the purposes it was collected for, and the law does not require us to keep it, we securely destroy or de-identify it.

​

12. How long we keep your information

 

How long we keep information depends on what it is:

​

• Records of the tax agent services we provide to you: at least five years after the service is completed, as the Tax Agent Services (Code of Professional Conduct) Determination 2024 requires.

• Identity and customer due diligence records: seven years after we stop acting for you, as the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 requires.

• Everything else: for as long as it is needed for the purposes in this policy, and longer where another law requires it or where a claim is possible.

 

Identity documents collected only to confirm who you are are destroyed once we have recorded the check, unless the law requires us to keep them.

 

13. Data breaches

 

If your information is lost, or is accessed or disclosed without authority, we act straight away to contain it and assess the risk. Where we suspect a breach that the Notifiable Data Breaches scheme covers, we assess it within 30 days, and sooner where we can.

​

If the breach is likely to cause you serious harm, we will tell you and the Office of the Australian Information Commissioner (OAIC), as the law requires.

​

If you think information we hold about you has been lost or accessed without authority, please tell our Privacy Officer straight away (section 18).

 

14. Marketing and how to opt out

​

We may contact you about our services by email, social media message or phone. We send marketing only where you have consented, or where you are a client and would reasonably expect to hear from us about our services. Every marketing message we send identifies us and tells you how to stop receiving these messages.

​

You can opt out at any time: use the unsubscribe link, reply asking us to stop, or email info@l-co.com.au. We action opt-out requests within five working days.

​

We do not use the client information we hold for our accounting and tax work to market to you without your consent, and we never sell, rent or trade your information.