Last updated 15 October 2026
This policy explains how Hailstone Advisory Pty Ltd (ABN 89 690 953 747) collects, uses, stores and shares personal information. We are a Brisbane chartered accounting and advisory practice and a registered tax agent (registration number 26330641).
It applies to our clients, the people connected to them (such as partners, directors, trustees and beneficiaries), and anyone who contacts us or visits our website. In this policy, "we", "us" and "our" mean Hailstone Advisory Pty Ltd.
We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth), the Privacy (Tax File Number) Rule 2015, the Tax Agent Services Act 2009 (Cth) and our professional obligations as members of Chartered Accountants Australia and New Zealand.
We collect only what we need for the services you engage us for. Depending on that work, it can include:
We collect sensitive information only when a service needs it and you consent. An example is health information that affects a tax deduction or offset.
If you give us information about another person, such as your partner, please let them know about this policy.
You can make a general enquiry without identifying yourself. We cannot act as your tax agent or accountant unless you identify yourself.
Most of what we hold comes from you directly. We also collect information from others where it is needed for our work and you have authorised it or the law allows it:
If we receive personal information we did not ask for and do not need, we destroy or de-identify it.
We use personal information to deliver the services you engage us for and to meet our legal obligations. Specifically, to:
We do not sell personal information. We do not use or share it for any other purpose unless you consent or the law requires or allows it.
We collect your TFN only so we can lodge returns and deal with the ATO and super funds for you, as tax and superannuation laws allow. It is not an offence to withhold your TFN, but we cannot lodge your return without it.
Under the Privacy (Tax File Number) Rule 2015, we:
We share personal information only as needed for our work, with your consent, or where the law requires or allows it. This can include:
Anti-money laundering laws can require us to report to AUSTRAC. Where the law prohibits it, we cannot tell you that a report has been made.
We use the cloud service providers below to run our practice. Most of them hold data in the United States, so we are likely to disclose personal information to recipients in the United States and New Zealand.
| Provider | What we use it for | Where data is held |
|---|---|---|
| Microsoft 365 | Email, documents and file storage | Australia |
| Xero and Xero Practice Manager | Accounting ledgers, practice management and invoicing | United States (may also be processed in New Zealand and Australia) |
| Ignition | Engagement letters, billing and payments | United States |
| Stripe, through Ignition | Card and direct debit payments | Australia and the United States |
| Anthropic (Claude) | AI assistant for analysis, drafting and administration | United States |
| Wispr Flow | Dictation and meeting notes | United States |
We choose providers with recognised security standards and contractual privacy protections. We give them only the information they need to provide their service to us.
We use AI tools, currently Claude by Anthropic, to help with analysis, drafting and administration. We put your information into these tools only after you have agreed to it in your engagement letter.
We hold client records electronically, in the cloud systems listed above. We protect them by:
We keep records for as long as we need them and the law requires. In most cases that is at least 7 years after our work for you ends, to meet tax, anti-money laundering and professional record-keeping rules. After that, we securely destroy or de-identify them.
You can ask to see the personal information we hold about you, or ask us to correct it. Contact us using the details at the end of this policy.
We will respond within 30 days. Making a request is free. If providing access involves significant time or copying, we may charge a reasonable fee and will tell you first.
We may refuse access where the law allows, for example where it would breach someone else's privacy or a legal obligation. If we refuse, we will explain why in writing.
If information we hold is wrong, out of date or incomplete, we will correct it. If we disagree that a correction is needed, you can ask us to attach a statement to the record.
If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, as the Notifiable Data Breaches scheme requires. We will also tell you what we are doing about it and steps you can take to protect yourself.
Our website may use cookies and analytics tools to see how visitors use it. This information does not identify you, and you can turn cookies off in your browser. If you contact us through the website or by email, we keep your message and contact details so we can respond.
Email is not completely secure. For sensitive documents, ask us for a secure upload link.
Our website may link to other sites. We are not responsible for how those sites handle your information.
If you are concerned about how we have handled your personal information, contact our Privacy Officer using the details below. Please tell us what happened and how you would like it resolved.
We will acknowledge your complaint within 7 days and aim to resolve it within 30 days. If it will take longer, we will tell you why and when to expect our response.
If you are not satisfied with our response, you can complain to the OAIC at oaic.gov.au or on 1300 363 992.
We may update this policy from time to time. The current version will always be on our website, with the date it was last updated.
For privacy questions, requests or complaints, contact our Privacy Officer:
This policy was last updated on 15 October 2026.