Privacy Policy

1. Introduction

Business Concepts Group Pty Ltd trading as Business Concepts Group (BCG, we, us or our) respects your privacy and is committed to protecting personal information. We are bound by the Privacy Act 1988 (Cth), the Australian Privacy Principles (APPs), tax file number privacy rules and other laws that apply to the handling of personal information.

This Privacy Policy explains how we collect, hold, use and disclose personal information in connection with our accounting, taxation, business advisory, superannuation, SMSF, corporate secretarial, bookkeeping, lending, consulting, events, website, administration and related services.

This policy is intended to apply to clients, prospective clients, website users, referrers, suppliers, professional advisers, job applicants, employees, contractors, officers, shareholders, directors, trustees, beneficiaries, beneficial owners, authorised representatives, guarantors and other individuals whose personal information we collect or handle.

2. Sharing information within our corporate group

BCG operates as part of a broader corporate group. In this policy, references to our corporate group and related entities include, where relevant, BCG Corporate Holdings Pty Ltd, Business Concepts Group Pty Ltd, FLP Licence Holdings Pty Ltd, FLP Financial Pty Ltd, Paperplane Bookkeeping and Administration Services Pty Ltd (Paperplane/PP), and any other related bodies corporate or associated service entities within the group.

We may share personal information with other members of our corporate group and associated service entities where reasonably necessary for client service delivery, administration, client onboarding, document preparation, accounting, bookkeeping, financial planning, compliance, AML/CTF customer due diligence, identity verification, risk assessment, internal governance, billing, quality assurance, technology support, record keeping, professional services coordination, complaints handling, dispute resolution, audit, insurance, legal obligations, or other purposes connected with the services provided to clients.

Members of our corporate group may access, use, hold and disclose personal information where they assist us to provide services, where we assist them to provide services, where services are provided jointly or in a coordinated way, or where sharing is required or authorised by law.

Where a client engages more than one group entity, information provided to one group entity may be used by another group entity where reasonably necessary for the services being provided, for related administrative or operational purposes, or for compliance, risk management, professional, legal or regulatory obligations.

Where personal information is shared within our corporate group, we take reasonable steps to ensure that it is handled in accordance with applicable privacy, confidentiality, information security and professional obligations.

3. What personal information we collect

The personal information we collect will depend on the nature of our relationship with you and the services requested. It may include:

·    name, date of birth, gender, contact details, occupation, employer, role or job title;

·    residential, postal, registered office and business addresses;

·    identity information, including information contained in passports, driver licences, Medicare cards, birth certificates, trust deeds, company records and other identity or authority documents;

·    tax file numbers, Australian business numbers, Australian company numbers, director identification numbers, Medicare numbers, passport numbers, driver licence numbers and other government identifiers where permitted by law;

·    financial information, bank account details, income, expenses, assets, liabilities, investments, superannuation, insurance, loan and credit information;

·    information about entities, structures, trusts, companies, SMSFs, partnerships, shareholders, unitholders, directors, officeholders, trustees, appointors, beneficiaries, members, beneficial owners and controllers;

·    information about your spouse, partner, dependants, family members, business associates, employees, contractors or other related persons where relevant to the services we provide;

·    source of funds, source of wealth, transaction history, business activities, ownership and control information, tax residency and other information relevant to financial crime, tax, regulatory or client risk assessment;

·    records of communications with us, including emails, letters, phone calls, meeting notes, portal messages, forms and documents you provide;

·    information collected through our websites, portals and online tools, including IP address, device information, usage information, cookies and analytics data; and

·    employment, contractor, personnel due diligence, qualification, police check, bankruptcy, sanctions, regulatory search, reference check and right-to-work information for staff, contractors, applicants and relevant personnel.

4. Sensitive information

We may collect sensitive information where it is reasonably necessary for our functions or activities, where you consent, or where the collection is required or authorised by law. Sensitive information may include health information, criminal history information, professional or trade association membership, financial hardship information, family circumstances, source of wealth or source of funds information, and other information relevant to the services we provide or to legal, professional, tax, financial services, credit, superannuation, AML/CTF or regulatory obligations.

We will only collect sensitive information where permitted by law and will handle it with additional care having regard to its nature and the circumstances of collection.

5. How we collect personal information

We usually collect personal information directly from you. We may collect information when you:

·    contact us by phone, email, post, online form, portal, video conference or in person;

·    engage us or one of our related entities to provide services;

·    complete an application, questionnaire, checklist, authority, consent, engagement document, identity verification process or onboarding form;

·    provide documents, records, financial information, tax information, identification documents or access to accounting, banking, superannuation, government, investment or other systems;

·    attend a meeting, event, webinar, seminar or training session;

·    subscribe to newsletters, updates or marketing communications;

·    use our websites, client portals, online tools, secure document exchange platforms or cloud-based systems; or

·    apply for employment, contracting, work experience or other roles with us.

We may also collect personal information from third parties where permitted by law, including from related entities, authorised representatives, spouses or family members, employers, employees, contractors, professional advisers, lawyers, finance brokers, banks, lenders, insurers, superannuation funds, investment platforms, software providers, ASIC, the ATO, AUSTRAC, government agencies, public registers, credit reporting bodies, verification providers, sanctions and politically exposed person screening databases, adverse media databases, fraud prevention services, law enforcement agencies, courts, tribunals and other regulators.

6. Anonymity and pseudonymity

Where practicable, you may deal with us anonymously or using a pseudonym. However, in many cases we are required to know who you are so that we can provide services, verify identity, comply with legal and professional obligations, administer our relationship with you and meet taxation, corporate, superannuation, financial services, credit, AML/CTF and other regulatory requirements.

If you do not provide information that we reasonably require, we may be unable to provide services, continue acting, process a request, meet legal or regulatory obligations, or allow access to particular systems or services.

7. Why we collect, use and disclose personal information

We collect, use and disclose personal information for purposes including:

·    providing accounting, taxation, business advisory, bookkeeping, corporate secretarial, superannuation, SMSF, lending, consulting, financial planning referral, administrative and related services;

·    establishing, managing and administering client relationships and engagements;

·    identifying clients, representatives, beneficial owners, controllers and other relevant persons;

·    preparing, lodging, managing and retaining documents, returns, reports, applications, minutes, resolutions, workpapers and records;

·    communicating with you, your authorised representatives and third parties involved in providing services;

·    conducting internal administration, billing, debt recovery, quality assurance, training, file reviews, professional supervision, audit, insurance and risk management;

·    managing conflicts, independence, client acceptance, client continuation and professional obligations;

·    complying with laws and regulatory obligations, including taxation, corporations, superannuation, financial services, credit, AML/CTF, sanctions, privacy, employment and record-keeping obligations;

·    responding to enquiries, complaints, disputes, subpoenas, notices, investigations, audits, regulator requests and legal claims;

·    conducting marketing, events, educational updates and client communications, subject to your opt-out rights;

·    maintaining and improving our websites, systems, cyber security, client portals, online tools, business processes and service delivery; and

·    any other purpose for which you have consented or that is otherwise required or authorised by law.

8. AML/CTF, identity verification and financial crime compliance

Where we provide services that are subject to the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), AML/CTF Rules, sanctions laws or related financial crime obligations, we may collect, use and disclose personal information for AML/CTF and financial crime compliance purposes.

This may include collecting, using and disclosing personal information to:

·    identify and verify clients and their authorised representatives;

·    identify and verify beneficial owners, controllers, trustees, appointors, directors, shareholders, members, partners, beneficiaries and other relevant persons;

·    confirm authority to act for a person or entity;

·    conduct politically exposed person, sanctions, adverse media, fraud, insolvency, regulatory, law enforcement or other screening;

·    assess client, matter, service, transaction, delivery channel, geographic, structure and financial crime risk;

·    conduct source of funds and source of wealth enquiries where required or appropriate;

·    undertake ongoing customer due diligence, transaction monitoring, review, re-verification and risk reassessment;

·    determine whether we can commence, continue, limit, suspend or cease providing services;

·    make reports or disclosures to AUSTRAC, law enforcement agencies, regulators, courts, tribunals or government agencies where required or authorised by law;

·    maintain AML/CTF records and evidence of compliance; and

·    conduct personnel due diligence, role-based screening, training, monitoring and compliance controls for staff, contractors and relevant officers.

For AML/CTF purposes, personal information may be shared between members of our corporate group, including FLP Licence Holdings Pty Ltd, FLP Financial Pty Ltd and Paperplane Bookkeeping and Administration Services Pty Ltd (Paperplane/PP), where reasonably necessary to identify and verify clients and associated persons, conduct customer due diligence, assess risk, perform screening, monitor client relationships, maintain records, meet regulatory obligations or manage AML/CTF compliance across the group.

In some circumstances, laws may prevent us from telling you that information has been collected, used or disclosed, or from explaining certain actions we have taken. This may include circumstances involving AML/CTF tipping-off restrictions, suspicious matter reporting, sanctions compliance, law enforcement requests, regulatory investigations or other legal restrictions.

9. Automated tools, electronic verification and screening providers

We may use third-party electronic verification, screening, risk assessment, workflow, artificial intelligence, automation and compliance tools to assist with identity verification, AML/CTF screening, sanctions screening, politically exposed person screening, adverse media screening, fraud risk assessment, document verification, data extraction, client onboarding and client risk profiling.

These tools may use information provided by you, information generated through the verification or screening process, and information held by government, commercial, public, regulatory or other data sources. The providers and systems we use may change from time to time.

These tools support our compliance and risk assessment processes. Decisions about whether we can commence, continue, limit, suspend or refuse services may involve human review, particularly where information is incomplete, inconsistent or indicates elevated risk.

10. Identity documents and data minimisation

We will only collect personal information that is reasonably necessary for our functions, activities and legal obligations. For identity verification and AML/CTF purposes, we may collect information from identity documents and, where necessary, temporarily collect or retain copies of identity documents for verification, evidentiary, professional, legal, risk management or operational purposes.

Where we do not need to retain a full copy of an identity document, we will take reasonable steps to delete, destroy, de-identify or securely limit retention of that copy once verification is complete and our legal, professional, regulatory and operational requirements have been satisfied. We may retain verification results, audit logs, reference numbers, partial details, records of checks performed and other information necessary to demonstrate compliance with our obligations.

11. Disclosure of personal information

We may disclose personal information to:

·    our employees, contractors, consultants, offshore team members, directors, officers and related entities;

·    your authorised representatives, including accountants, lawyers, financial advisers, finance brokers, bookkeepers, auditors, family members, executors, attorneys, guardians, trustees or other nominated persons;

·    software, cloud hosting, client portal, document management, electronic signature, payment, verification, screening, workflow, communication, storage, back-up, cyber security and IT service providers;

·    banks, lenders, insurers, superannuation funds, investment platforms, product providers, government agencies, registries and professional service providers where relevant to the services we provide;

·    the ATO, ASIC, AUSTRAC, the Tax Practitioners Board, CPA Australia, external dispute resolution bodies, courts, tribunals, law enforcement agencies, regulators and other government agencies;

·    auditors, insurers, legal advisers, consultants, compliance reviewers, external file reviewers and professional advisers;

·    debt collection agencies, payment providers and parties involved in billing or recovering amounts owed to us;

·    third parties involved in a business sale, merger, restructure, financing, insurance or transfer of part or all of our business or assets; and

·    any other person or organisation where you have consented, where disclosure is reasonably expected in connection with the services, or where disclosure is required or authorised by law.

12. Offshore team and overseas disclosure

We use offshore administrative and support team members based in the Philippines as part of our normal service delivery model.

Our Philippines-based team will be involved in the delivery of services to clients and will have access to personal information where this is reasonably necessary for their role. This may include access to client files, identification information, financial information, correspondence, documents, workpapers, forms, client portal information and information held in our cloud-based systems.

Our Philippines-based team may assist with administration, client onboarding, document preparation, data entry, client service support, compliance processes, AML/CTF customer due diligence support, record keeping, workflow management, reporting and other tasks required to deliver services to clients.

Our Philippines-based team works under our direction and is subject to confidentiality, privacy, information security, training and access-control requirements. Access to personal information is provided on a role-based basis and is limited to what is reasonably required for the work being performed.

We may also store, process, back up, support or disclose personal information overseas through cloud platforms, software providers, verification providers, screening providers, IT support providers and other third-party service providers. The countries in which information may be accessed, stored or processed may vary depending on the provider and system used. Overseas recipients may include recipients located in the Philippines and other countries in which our service providers, their related bodies corporate, personnel, contractors, support teams, data centres or cloud infrastructure are located.

Where we disclose personal information to overseas recipients, we will take reasonable steps in the circumstances to ensure that the recipient handles the information in a manner consistent with the APPs, unless an exception applies under the Privacy Act or another law. These steps may include contractual obligations, confidentiality obligations, access controls, due diligence, staff training, system controls, vendor assessment and other safeguards appropriate to the nature of the information and the recipient.

13. Third-party software, cloud providers and applications

We use a range of third-party software, cloud hosting, document management, accounting, tax, financial planning, practice management, client portal, electronic signing, payment, verification, screening, communication, data storage, back-up, workflow, analytics, marketing and compliance service providers. These providers include, but are not limited to: