Who this policy covers
This policy applies to MDX Consultants Pty Ltd (ABN 30 699 163 669), a member firm of Chartered Accountants Australia and New Zealand and a registered tax agent. In this policy, "we", "us" and "our" mean MDX Consultants Pty Ltd.
It covers personal information we collect through this website, through our client portal, and in the course of providing accounting, tax, advisory and bookkeeping services. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
What we collect
What we collect depends on the work you ask us to do. In a typical engagement it includes:
- Identity and contact details, including your name, date of birth, address, email, phone number and the identity documents we are required to sight to verify who you are
- Tax file numbers, for you and for any entity or individual connected to the work
- Australian Business Numbers, ACNs and other registration identifiers
- Financial information, including income, deductions, bank account and transaction data, accounting records, payroll and superannuation details, loan and asset information
- Information about your business, its structure, its associates, and its dealings with the Australian Taxation Office
- Correspondence between us, including notes of meetings and calls
Tax file numbers
Tax file numbers get separate treatment here because the law gives them separate treatment. As well as the Privacy Act, they are governed by the Privacy (Tax File Number) Rule 2015 and by Part VA of the Income Tax Assessment Act 1936.
We collect and use tax file numbers only where a taxation, personal assistance or superannuation law authorises it, and only for the work you have engaged us to do. This includes preparing and lodging returns and activity statements, dealing with the ATO on your behalf, and meeting our own obligations as a registered tax agent.
We do not use a tax file number to identify you in our own systems, we do not use it as a filing or record-keeping reference, and we will not disclose it to anyone except where a taxation law requires or authorises it, or where you have asked us to. You are not obliged by law to give us your tax file number. If you choose not to, we can usually still act for you, but the work may take longer, cost more, or in some cases not be possible.
How we collect it
Most of what we hold comes directly from you through the enquiry form on this website, the client portal, email, phone calls or meetings.
We also collect information about you from third parties where that is a normal part of the work: from the ATO through the tax agent portal and pre-fill services, from ASIC, from your bookkeeper or previous accountant, from your bank or broker where you have authorised it, and from accounting software you have connected to us.
Where we collect your information from someone else, we take reasonable steps to make sure you know we have it and why, unless you would already expect us to.
Why we use it
We use personal information to:
- Provide the services you have engaged us for, and correspond with you about them
- Prepare and lodge returns, activity statements and other documents with the ATO, ASIC and other agencies on your behalf
- Verify your identity, as the Tax Practitioners Board requires us to
- Meet our professional obligations as a registered tax agent and as a CA ANZ member firm, including quality review and professional indemnity requirements
- Meet our own legal obligations, including record-keeping obligations
- Send you material you have asked to receive, such as our quarterly notes. You can unsubscribe at any time
Who we disclose it to
We do not sell personal information, and we do not disclose it for anyone else's marketing.
We disclose it where the work requires it or the law compels it. This may include the ATO, ASIC and other government agencies when acting for you; a lender, broker, solicitor, financial planner or other adviser where you have asked us to deal with them; our own professional advisers and insurers; a person conducting a quality review of our practice under CA ANZ or Tax Practitioners Board requirements; and a court, tribunal or regulator where we are legally required to.
We also disclose information to the providers of the software we use to run the practice and store records. Those providers are set out below.
Software and service providers
Our in-house email and practice management systems use databases hosted in Sydney. Depending on the engagement and the client's existing systems, we also use Xero, MYOB, QuickBooks and Payroller to provide accounting, bookkeeping and payroll services.
We may use approved artificial intelligence services through business accounts configured with zero data retention. Access is limited to authorised workers using the practice network.
Overseas disclosure
Some of our employees and contractors work from India and may access client information through the practice network when carrying out their work. Our in-house client databases remain hosted in Sydney, and those workers access information on the practice network rather than storing it locally.
How we protect it
We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification and disclosure. Those steps include restricting access within the practice to the people who need it for the work, and using the client portal rather than email for anything carrying a tax file number or bank details.
No system is perfectly secure. If a data breach occurs that is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.
The specific controls we maintain
Access to client information is limited to authorised workers using company-managed devices protected by multi-factor authentication. Client information and backups are encrypted both while being transmitted and while stored. Encrypted backups are created automatically, and restoration procedures are tested periodically. Our systems maintain audit logs showing who accesses or changes client information. Employees and contractors receive privacy and information-security training when they join the practice and periodically afterward. Overseas workers are not permitted to download or store client information locally.
How long we keep it
We generally retain client accounting, tax, identity and correspondence records for five years after an engagement ends. We may retain particular records for longer where required by law, professional or insurance obligations, or while a matter remains unresolved.
When the retention period ends and no law requires us to keep the information, we securely destroy it or de-identify it.
Accessing and correcting your information
You can ask for a copy of the personal information we hold about you, and you can ask us to correct it if it is wrong. Write to us at the address or email below. We will respond within a reasonable period, ordinarily 30 days.
There is no charge for making a request. If one takes substantial work to fulfil we may charge a reasonable cost for retrieving and copying the records, and we will tell you what that is before we start.
In limited circumstances we may refuse access, including where giving it would unreasonably affect another person's privacy or where the information relates to anticipated legal proceedings. If we refuse, we will tell you why in writing and explain how to complain.
This website
This website uses essential browser storage to remember functional choices. If you accept analytics cookies, we use Google Analytics 4 to understand which pages visitors use and which contact actions they take. It may collect page views, approximate location, device and browser information, referral information, and whether a visitor selected the booking, phone or email link. We do not send form contents, client files, tax file numbers or financial records to Google Analytics.
Google Analytics only loads after you accept it. We configure event-level analytics data to be retained for 14 months and do not use Google Analytics advertising features. Google may process analytics information outside Australia. You can decline analytics without losing access to the website and can reopen Cookie settings in the footer to change your choice.
Complaints
If you think we have mishandled your personal information, write to the Privacy Officer at hello@mdxconsultants.com.au or at the postal address below and explain what happened. We will acknowledge your complaint promptly and aim to provide a written response within 30 calendar days.
If you are not satisfied with our response, you can take the complaint to the Office of the Australian Information Commissioner at oaic.gov.au, or on 1300 363 992. The OAIC generally expects you to raise the matter with us first.
Contacting us about privacy
Email hello@mdxconsultants.com.au, or write to Office 4583, 470 St Kilda Road, Melbourne VIC 3004. Our phone number is 0475 988 044, mon to fri, 9am to 5:30pm melbourne time.
Changes to this policy
We update this policy when our practices or our obligations change. The current version is always the one on this page, and the date it took effect is shown at the top.
