Privacy Policy

1. About this policy

This policy explains how NeoRise Consulting Pty Ltd ("NeoRise.ai") and NeoRise Advisory Pty Ltd ("NeoRise Advisory") handle personal information. In this policy, "we", "us" and "our" mean whichever of those companies collects or holds the information.

The two companies are separate legal entities with common ownership. Each is responsible for the personal information it collects and holds. We do not share your information between NeoRise.ai and NeoRise Advisory unless you authorise it in writing or the law requires or permits it (see section 8).

We handle personal information in line with the Privacy Act 1988 (Cth), including the Australian Privacy Principles (APPs), and the Privacy (Tax File Number) Rule 2015. We also follow the confidentiality obligations of our professional and regulatory frameworks, including the Tax Practitioners Board (TPB) Code of Professional Conduct for NeoRise Advisory and the APES 110 Code of Ethics for Professional Accountants.

This policy also covers our use of artificial intelligence (AI) and automated tools. Our AI & Data Use Policy gives more detail.

2. The personal information we collect

What we collect depends on how you deal with us and which services you engage us for.

Enquiries and contact

• Name, business name, role, email address, phone number and the content of your messages and calls.

Clients and their representatives

• Identity details such as full name, date of birth, residential address and copies of identity documents. We collect these when we need to verify your identity, for example for tax agent services, ATO authorisations or anti-money laundering obligations.
• Contact details and the details of directors, trustees, partners, beneficiaries, members and authorised representatives.
• Financial and business information, such as accounting records, bank statements, invoices, payroll records, tax records, budgets, forecasts and business plans.
• Tax file numbers (TFNs), collected by NeoRise Advisory only (see section 6).
• Details of your accountant, bookkeeper, lawyer, financial adviser, auditor or other advisers.
• Records of our advice, meetings, calls and correspondence.
• Billing and payment information. We do not store full card numbers; payments are processed by our payment providers.

Information about other people in your records
Your business records may include personal information about your employees, contractors, customers, suppliers, fund members or family members, such as names, contact details, wages, superannuation, bank details and TFNs. We handle this information only to provide the services you engage us for (see section 13).

Sensitive information
We do not seek sensitive information such as health information, racial or ethnic origin, religious beliefs or criminal records. It may sometimes appear in records you give us. For example, a payroll record may show workers' compensation or medical leave, or a tax return may include medical expenses. We collect sensitive information only with your consent and where it is reasonably necessary for our services, or where the law requires or authorises it.

Website visitors
Our website does not currently use analytics, advertising or tracking cookies. Our hosting provider may automatically record technical information, such as IP address, browser type and pages requested, for security and performance purposes. If we introduce analytics or marketing tools, we will update this policy and ask for consent where required.

3. How we collect personal information

We collect personal information:

• directly from you, such as when you email or call us, meet with us, or send or upload documents;
• from people you authorise, such as your current or previous accountant or bookkeeper, financial institutions, superannuation funds, auditors and other advisers;
• from government agencies, with your authority, such as the Australian Taxation Office (ATO) through the Tax Agent or BAS Agent Portal and Online services for agents, and the Australian Securities and Investments Commission (ASIC);
• from software you connect us to, such as accounting, payroll, bank-feed, practice-management and reporting platforms, under access you grant;
• from public sources, such as ABN Lookup, ASIC registers and company websites.

If we receive personal information we did not ask for and do not need, we destroy or de-identify it where lawful and reasonable to do so.

Dealing with us anonymously. You can make a general enquiry without identifying yourself or by using a pseudonym. We cannot provide professional services, act as your tax agent or verify your identity without your real details.

4. Why we collect, hold, use and disclose personal information

We use personal information to:

• respond to enquiries and prepare proposals and engagement letters;
• provide the services you engage us for, including business advisory, Virtual/Fractional CFO services, reporting, systems, dashboard and AI assistant projects (NeoRise.ai), and accounting, bookkeeping, payroll, tax, BAS, SMSF and monitoring services (NeoRise Advisory);
• verify identity and meet our legal, regulatory and professional obligations, including under tax, corporations, anti-money laundering and counter-terrorism financing (AML/CTF) and privacy laws;
• communicate with you and with people you authorise;
• manage our relationship with you, including billing, payments, collections and complaints;
• maintain professional indemnity insurance and take part in professional quality reviews (for example by CPA Australia);
• protect the security of our systems and information;
• improve our services, using aggregated or de-identified information where practicable; and
• send you information about our services, if you have agreed or the law otherwise permits (see section 12).

We will not use or disclose personal information for another purpose unless you consent, you would reasonably expect it and it is related to the original purpose, or the law requires or permits it.

5. Our use of AI and automated tools

We use carefully selected AI and automated tools to help us work efficiently. Examples include summarising documents, drafting correspondence, categorising transactions, analysing financial data and flagging changes in your records for our team to review.

When we do, we follow these rules:

• Approved tools only. We use business or enterprise versions of AI tools whose terms prohibit the provider from using our clients' data to train its models, and which include appropriate security and confidentiality protections. We do not put client information into free or consumer AI tools.
• No training on your data. We do not use your personal information to train public or general-purpose AI models, and we do not sell or license it to others for that purpose.
• Minimum necessary. We limit the personal information processed by AI tools to what the task needs. We remove or mask identifiers where practicable. We do not enter TFNs, identity documents, passwords or banking credentials into AI tools.
• People stay responsible. A qualified member of our team reviews AI-assisted work before we rely on it, give advice or lodge anything. AI tools do not lodge returns, make or approve payments, or contact government agencies on our behalf.

Automated decision-making. We do not make decisions that significantly affect an individual's rights or interests solely through a computer program. Some of our tools use computer programs to do things related to our decisions. For example, automated checks may analyse accounting, bank, sales, payroll and tax records, including information about our clients' customers and employees, to flag overdue invoices, unusual transactions, payroll changes or upcoming obligations. A member of our team reviews every flag before deciding whether any action is needed.

For more detail, including how we build AI assistants for clients, see our AI & Data Use Policy. You can ask us which tools we use with your information and request that we do not use AI tools on your matters (see "Your choices" in that policy).

6. Tax file numbers

NeoRise Advisory collects TFNs only where it is lawful and necessary to provide tax, payroll, superannuation or SMSF services. We handle TFNs in line with the Privacy (Tax File Number) Rule 2015:

• we use and disclose TFNs only for purposes authorised by tax, personal assistance or superannuation law;
• we do not use TFNs to identify you for other purposes or to match records;
• we restrict access to staff who need it and store TFNs securely; and
• we securely destroy or de-identify TFN information when we no longer need it and the law no longer requires us to keep it.

NeoRise.ai does not request or need TFNs. Please do not send TFNs by ordinary email. We will tell you how to provide them securely.

7. Storage, security and retention

We hold personal information in secure cloud-based systems and, occasionally, in paper files. We take reasonable steps to protect it from misuse, interference, loss and unauthorised access, modification or disclosure. These steps include:

• multi-factor authentication and role-based access controls;
• encryption in transit and, where supported by our providers, at rest;
• giving staff and contractors access only where needed, under confidentiality obligations;
• vetting our service providers' security and privacy commitments; and
• secure disposal of records we no longer need.

No system is completely secure. Please help us protect your information by using the secure upload methods we provide and by not sending sensitive information, such as TFNs or identity documents, by ordinary email.

Retention. We keep records for as long as we need them to provide our services and as required by law. This includes at least five years for records relating to tax agent and BAS services, and up to seven years where other laws or our professional obligations require it. When we no longer need personal information and the law no longer requires us to keep it, we destroy or de-identify it.

8. Who we disclose personal information to

We disclose personal information only as reasonably needed for the purposes in section 4. Recipients may include:

• government and regulators, such as the ATO, ASIC, the TPB, AUSTRAC, the Fair Work Ombudsman and state revenue offices, when we act for you or the law requires it;
• people you authorise, such as your accountant, bookkeeper, lawyer, financial adviser, broker, bank, super fund or SMSF auditor;
• our service providers, who support our operations under confidentiality and data-protection terms. These include cloud hosting and storage, email and collaboration, practice management, accounting and payroll software, e-signature, payment processing, IT support and AI providers;
• professional bodies, insurers and advisers, such as CPA Australia (for quality review), our professional indemnity insurer and our legal advisers; and
• a purchaser or successor of all or part of our business, under strict confidentiality, if that occurs. We would tell you beforehand where practicable.

Between NeoRise.ai and NeoRise Advisory. Although the two companies have common ownership, we treat them as separate organisations for privacy purposes. Neither company shares your information with the other unless you give written authority describing what may be shared and why, or the law requires or permits it. You can withdraw that authority at any time.

We do not sell personal information.

9. Overseas disclosure

Some of our service providers, including cloud, software and AI providers, may store or process personal information outside Australia. These locations may include [CONFIRM: e.g. the United States, the United Kingdom, the European Union, Singapore and New Zealand — list according to the providers actually used].

Where practicable, we choose providers and settings that keep data in Australia. Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs. Usually we do this through contractual privacy, security and confidentiality obligations, including prohibitions on using our data for model training. We remain accountable for that information as required by the Privacy Act.

10. Data breaches

We have a data breach response plan. If we suspect a data breach, we act quickly to contain it and assess the risk of harm. If an eligible data breach occurs under the Notifiable Data Breaches scheme, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) as required. Where the breach involves information our clients gave us about their own employees or customers, we will also work with those clients so they can meet their own obligations.

11. Access and correction

You can ask for access to the personal information we hold about you, or ask us to correct it, by contacting our Privacy Officer (section 15). We will:

• verify your identity before releasing information;
• respond within 30 days;
• not charge you for making a request, although we may charge a reasonable fee to cover the cost of providing access; and
• tell you in writing why, and how to complain, if the law allows us to refuse a request. For example, we may refuse if giving access would unreasonably affect someone else's privacy or would prejudice legal proceedings.

If we refuse to correct information, you can ask us to attach a statement to the record saying that you believe it is inaccurate, out of date, incomplete, irrelevant or misleading.

12. Marketing

We may send you updates about our services, events or relevant business, accounting and tax information where you have agreed to receive them, or where the Spam Act 2003 (Cth) and the Privacy Act otherwise permit. Every marketing email includes an easy way to unsubscribe, or you can contact us at any time to opt out. Opting out will not affect service communications about your engagement.

We do not use your client records, or information we access through your accounting systems, for marketing.

13. If you give us information about other people

If you give us personal information about another person, such as your employees, customers, family members, fund members or co-directors, you confirm that you are entitled to do so, and that you have told them, or they would reasonably expect, that their information will be shared with us for the services you engage us for. Where appropriate, please point them to this policy.

14. Links and third-party services

Our website may link to other websites, such as the TPB register or software providers. We are not responsible for their privacy practices. Please read their privacy policies.

15. Questions and complaints

Contact our Privacy Officer
Privacy Officer, NeoRise
Suite 501, South Tower, 1–5 Railway St, Chatswood NSW 2067
Email: [CONFIRM: privacy@neorise.ai, or support@neorise.ai marked "Attention: Privacy Officer"]
Phone: 1800 714 202

If you have a concern about how we have handled your personal information, please contact us first. We will acknowledge your complaint within five business days, investigate it and aim to respond in writing within 30 days.

If you are not satisfied with our response, you can contact:

• Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au · 1300 363 992
• Tax Practitioners Board: www.tpb.gov.au, for complaints about the conduct of NeoRise Advisory as a registered tax agent
• CPA Australia: www.cpaaustralia.com.au, for complaints about the professional conduct of a CPA member

16. Changes to this policy

We may update this policy from time to time, for example to reflect new services, technology or legal requirements. The current version will always be on our website with its effective date. If a change materially affects how we handle your information, we will tell our clients directly.