Privacy policy

1. Who we are and what this policy covers

BEB Advisory is a registered Australian business name providing bookkeeping, BAS and payroll services from Sydney’s Northern Beaches, NSW. In this policy, “we”, “us” and “our” mean BEB Advisory.

This policy explains how we collect, hold, use and disclose personal information about people who visit our website or contact us; our clients and people at our clients’ businesses; people whose details appear in our clients’ financial records (for example staff, customers and suppliers); and our suppliers and contractors.

We handle personal information in line with the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth), whether or not the Act legally applies to us. Tax file numbers are handled under the Privacy (Tax File Number) Rule 2015.

2. How to contact us about privacy

To ask for access to or correction of your information, or to make a complaint, contact us by:

• Email: support@bebadvisory.com.au (or our contact form)
• Post: BEB Advisory, PO Box 417, Forestville NSW 2087

If neither method suits you, tell us and we’ll find another way to help. You can deal with us anonymously or using a pseudonym for general enquiries; we need your real details to provide services.

3. Personal information we collect

• Enquiries: name, business name, email, phone (optional), accounting software and anything you choose to tell us.
• Clients: contact and billing details, engagement records, correspondence, and access to your accounting software. We never ask for internet banking passwords.
• Information in client records: to provide our services we access clients’ accounting files and source documents, which can include details of a client’s staff, customers and suppliers. For payroll this includes employee pay, super and leave details.
• Website data: basic technical information such as IP address, browser type and pages visited.
• Tax file numbers: we collect, use and disclose TFNs only where tax or superannuation law authorises it (for example for payroll and reporting to the ATO) and as the Privacy (Tax File Number) Rule 2015 allows. We never ask for a TFN through this website or its contact form. You are not legally required to quote a TFN, though not quoting one can have consequences such as tax withheld at the top rate. We store TFNs securely and destroy or de-identify them once they are no longer needed.

Contact form: Our website does not store the details you submit through the contact form. They are passed securely to our Microsoft 365 mailbox (Australia), where we keep them for up to 12 months if the enquiry doesn’t become an engagement (see section 11 below). On the way, your details pass through Cloudflare’s global network, which may process them outside Australia (for example in the United States), but Cloudflare does not keep them for us.

4. How we collect it

Directly from you (through our website form, email, calls and documents you share); from our clients when they give us access to their accounting software and documents; from your accountant or agent if you ask them to share information; and automatically when you use our website.

5. Why we collect, use and disclose it

• To answer enquiries and work out whether we can help you.
• To provide our services: bookkeeping, BAS preparation and lodgement, payroll and reporting.
• To manage our business, including billing, record-keeping, insurance and complaints.
• To keep our systems secure and meet our legal obligations, including as a registered BAS agent.
• To send service updates and, with your consent, occasional marketing (with an unsubscribe option).

We don’t sell personal information. We don’t use client data to train AI models.

6. Who we disclose it to

Your accountant, tax agent or the ATO when you instruct us or the law requires; our software and service providers who store or process information for us; professional advisers and insurers; government bodies where the law requires or authorises it; and anyone else you agree to. We require our service providers to protect personal information.

7. Technology and automation

We use cloud software and automation tools (for example bank rules and receipt reading) to speed up our work. A person reviews the work before anything is final or lodged. We don’t make decisions that significantly affect anyone solely by automated means.

8. Overseas disclosure

Some of our software providers may store or process information outside Australia, including in the United States. These include Cloudflare (website hosting and our contact form, global network including the United States). Our business email and files are held in Microsoft 365, with data stored in Australia. Details you send through our contact form pass through Cloudflare’s global network and may be processed outside Australia on their way to our Microsoft 365 mailbox (Australia); our website and Cloudflare do not store them. Client accounting data stays in the client’s own accounting subscription (for example Xero, MYOB or QuickBooks), under that provider’s terms. We take reasonable steps to make sure they handle it in line with the APPs, and choose Australian data regions where we can.

9. How we keep it secure

• Multi-factor authentication on business systems.
• Advisor-level, least-privilege access to client files, removed when an engagement ends.
• Encryption in transit, and at rest where providers support it.

If we suspect a data breach, we will act quickly to contain and assess it, and notify affected people and the OAIC where required.

10. Cookies and analytics

This website does not currently use analytics or advertising cookies.

11. How long we keep it

Enquiries that don’t become clients: up to 12 months. Client records: for the engagement and then as long as required by law (generally up to 7 years), after which they are securely deleted or de-identified. Client accounting files stay in the client’s own subscription.

12. Access and correction

You can ask for access to, or correction of, the personal information we hold about you using section 2. We’ll respond within 30 days and may need to confirm your identity first. There is no charge to make a request.

13. Complaints

Please contact us in writing first. We’ll acknowledge your complaint within 5 business days and aim to resolve it within 30 days. If you’re not satisfied, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

14. Changes to this policy

We may update this policy from time to time. The current version will always be on this page.