Privacy Policy

Effective date: 14 September 2026

Lume Corporate Accountants Pty Ltd (we, us, our) respects your privacy and is committed to handling personal information responsibly. This Privacy Policy explains how we collect, hold, use and disclose personal information and how you may access or correct your information or make a privacy complaint.

This policy is intended to operate consistently with the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply to us. It should be read together with any privacy collection notice or consent wording provided when we collect information from you.

1. Personal information we may collect

The information we collect depends on your relationship with us and the services you request. It may include:

• your name, date of birth, address, telephone number, email address and other contact details;
• identity and verification information, including information contained in identification documents where reasonably required;
• business, company, trust, partnership, superannuation, employment and professional information;
• taxation, accounting, financial, banking, asset, liability, income, expense and transaction information;
• information about directors, shareholders, trustees, beneficiaries, partners, employees, contractors, family members or other relevant persons where necessary for the services requested;
• communications, enquiries, instructions, documents and records you provide to us;
• payment, billing and transaction information, noting that card details may be processed by third-party payment providers rather than stored by us;
• technical information generated when you use our website, including IP address, browser or device information, cookies, analytics data and website activity; and
• other information that is reasonably necessary for us to provide services, comply with law, manage risk or respond to your enquiry.

We may occasionally collect sensitive information where it is reasonably necessary for our functions and permitted by law, including with your consent where required.

2. How we collect personal information

We generally collect personal information directly from you, including through our website, online forms, telephone calls, email, meetings, electronic portals, applications, engagement processes, accounting or practice-management systems and documents you provide.

Where appropriate and lawful, we may also collect information from your authorised representatives, advisers, employers, business partners, related entities, government agencies, regulators, publicly available records, referral sources, identity-verification providers, credit or information providers, and service providers.

If you provide personal information about another person, you should ensure you are authorised to do so and, where appropriate, make them aware that their information may be provided to us.

3. Why we collect, hold, use and disclose information

We may collect, hold, use and disclose personal information to:

• respond to enquiries and communicate with you;
• assess whether and how we can assist you;
• establish, administer and provide professional or related services;
• verify identity and satisfy legal, regulatory, professional, fraud-prevention and risk-management requirements;
• prepare documents, records, reports, applications, returns, registrations, accounts or other work requested by you;
• manage billing, payments, debt recovery and our client relationship;
• communicate with your authorised representatives and relevant third parties;
• operate, secure, analyse and improve our website, systems, services and client experience;
• maintain business records, conduct quality assurance, training, auditing and internal administration;
• comply with legal and regulatory obligations, lawful requests, court orders and professional requirements; and
• send service updates, educational material or marketing communications where permitted by law. You may opt out of marketing at any time.

4. Disclosure to third parties

We may disclose personal information where reasonably necessary to provide services or operate our business. Recipients may include related Lume businesses, professional advisers, accountants, lawyers, auditors, financial service providers, finance or insurance professionals, technology and cloud providers, identity-verification providers, payment processors, document-signing platforms, mailing and communications providers, contractors, government agencies, regulators and other persons authorised by you or permitted by law.

We do not sell personal information.

5. Overseas disclosure and cloud services

Some technology, cloud, communications, data-processing or professional service providers we use may store, process or access information outside Australia. The countries involved can change as providers and their infrastructure change. Where the Australian Privacy Principles apply, we will take reasonable steps in relation to overseas disclosures as required by law. If it is practicable for us to identify the countries in which overseas recipients are located, we will provide that information on request or update this policy as appropriate.

6. Storage and security

We may hold information electronically and, where necessary, in physical form. We take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure. These steps may include access controls, authentication, secure systems, backups, staff and contractor controls, and use of reputable technology providers.

No internet transmission or electronic storage system can be guaranteed to be completely secure. You should take reasonable care when sending confidential information electronically.

We retain information for as long as reasonably necessary for our business, legal, professional, taxation, accounting, dispute-resolution and record-keeping requirements. When information is no longer required, we take reasonable steps to destroy or de-identify it where appropriate and lawful.

7. Cookies, analytics and online advertising

Our website may use cookies, pixels, analytics tools and similar technologies to operate the website, remember preferences, understand website usage, measure marketing performance and improve our services. Some third-party providers may collect information about your device or browsing activity under their own privacy terms.

You may be able to control cookies through your browser or device settings. Disabling some cookies may affect website functionality.

8. Direct marketing

Where permitted by law, we may use your contact details to send information about our services, insights, events or related offerings that may be relevant to you. You may opt out at any time by using an unsubscribe facility in the message or contacting us. Service and transactional communications may still be sent where necessary.

9. Access and correction

You may request access to personal information we hold about you or ask us to correct information that is inaccurate, out of date, incomplete, irrelevant or misleading. We may need to verify your identity before acting on a request. In some circumstances, the law permits us to refuse access or correction. If that occurs, we will provide reasons where required.

10. Privacy complaints

If you have a privacy concern or complaint, please contact us using the contact details published on our website and identify the matter as a privacy complaint. We will review the complaint and respond within a reasonable period. If you are not satisfied with our response, you may have the right to complain to the Office of the Australian Information Commissioner.

11. Anonymity and pseudonyms

Where lawful and practicable, you may make a general enquiry without identifying yourself or by using a pseudonym. We will usually need accurate identifying information before providing professional services, establishing a client relationship, processing certain transactions or meeting legal and regulatory obligations.

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to law, technology, our services or our information-handling practices. The current version will be published on our website with its effective date.

13. Contact

For privacy enquiries, access or correction requests, or complaints, contact us using the contact details or contact form published on our website.