Privacy Policy
This privacy statement discloses the privacy practices of Roberts & Cowling Pty Ltd (ACN 120 309 006).
Roberts & Cowling Pty Ltd (ACN 120 309 006) is an accounting, taxation and business advisory firm based in Brisbane. This policy explains how we collect, hold, use and disclose personal information. It also explains how you can access that information, correct it, or complain about the way we have handled it.
We are bound by the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles. Three further sets of obligations apply to us and are dealt with separately below. We are a registered tax agent, so we are bound by the Code of Professional Conduct in the Tax Agent Services Act 2009 (Cth). We are a tax file number recipient, so we are bound by the Privacy (Tax File Number) Rule 2015. Since 1 July 2026 we have been a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth).
Personal information means information or an opinion about an individual who is identified, or who is reasonably identifiable. It does not matter whether the information is true. It does not matter whether it is written down.
This policy covers Roberts & Cowling Pty Ltd. It applies to information we hold about our clients, about people connected with our clients, about people who contact us, and about visitors to our website. Our handling of our own employees' records is generally outside the Australian Privacy Principles under section 7B(3) of the Privacy Act. That exclusion does not extend to tax file number information, which we handle for our own staff the same way we handle it for clients.
This policy takes effect on 22/09/2026 and replaces all earlier versions.
What personal information we collect
The information we collect depends on the work you ask us to do. In most engagements it includes:
- name, date of birth, residential and postal address, phone number and email address
- tax file number
- Australian Business Number, Australian Company Number and details of the entities you are connected with
- bank account details, including for refunds, payroll and payments we make on your instruction
- identity documents and the information recorded from them, collected to verify who you are
- income, deductions, assets, liabilities and other information needed to prepare your returns and financial statements
- superannuation fund details, member balances and contribution history
- payroll information, including salary, wages, leave and superannuation for people employed by our clients
- details of your business, its transactions and its accounting records
- our correspondence with you, including notes of meetings and phone calls
We also collect information from people who are not our clients. That is explained below.
If you contact us through our website or by phone without becoming a client, we usually collect only your name, contact details and the substance of your enquiry.
Sensitive information
Sensitive information is a defined category under the Privacy Act. It includes health information, criminal record, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sexual orientation, and biometric information.
We do not seek sensitive information as a matter of course. Some of our work means we receive it anyway. Health information can arise in medical expense claims, in work on total and permanent disability payouts, in applications to release superannuation early on compassionate or hardship grounds, and in requests to the Australian Taxation Office (ATO) based on serious hardship. Criminal record information can arise when we verify your identity or screen for anti-money laundering purposes.
We collect sensitive information only with your consent, or where the law requires or authorises us to. We use and disclose it only for the purpose you gave it to us for, or a purpose the law requires.
A tax file number is not sensitive information as the Privacy Act defines it. It is regulated separately and more strictly, and is dealt with in its own section below.
How we collect personal information
Where it is reasonable and practicable, we collect personal information from you directly. That happens when you complete our engagement and client detail forms, send us documents, email or phone us, meet with us, or submit an enquiry through our website.
We also collect personal information from sources other than you:
- accounting data files and bookkeeping systems we are given access to, which frequently contain information about people other than the client
- the ATO, through the tax agent portal and pre-fill reports
- the Australian Securities and Investments Commission (ASIC) registers and other public registers
- banks, superannuation funds, share registries and other institutions, where you have authorised us to obtain information
- your other advisers, including lawyers, financial planners, brokers and bookkeepers
- identity verification and anti-money laundering screening services
If we collect personal information about you from someone else, we take reasonable steps to make sure you are aware that we hold it and why. Often the most practical way to do that is through the client who gave it to us. Our engagement terms require our clients to have told the people in their records that their information may be given to us.
Information about people who are not our clients
Much of the information we hold is about people who have never dealt with us. When a business engages us, its accounting file usually contains personal information about its employees, its contractors, its customers and its suppliers. When we act for a trust or a company, we hold information about beneficiaries, directors, shareholders and their family members.
We treat that information the same way we treat our clients' own information. We use it only for the work we were engaged to do, we secure it the same way, and the rights set out in this policy apply to it.
If you believe we hold information about you because of our work for someone else, you can contact us using the details at the end of this policy. We will tell you what we hold, subject to our duty of confidentiality to the client who gave it to us, and we will correct anything that is wrong.
Why we collect, hold, use and disclose personal information
Our primary purpose is to provide accounting, taxation, bookkeeping, superannuation, business advisory and virtual chief financial officer services, and to meet the legal obligations that come with providing them. That includes preparing and lodging returns, activity statements and financial statements, corresponding with the ATO and ASIC on your behalf, verifying your identity, and keeping the records the law requires us to keep.
We also use personal information to administer our own business. That covers billing and collecting fees, managing our client relationships, meeting our professional and insurance obligations, resolving complaints and disputes, and improving our services.
We use and disclose personal information for a secondary purpose only where you would reasonably expect it and the purpose is related to the primary one, or where you have consented, or where the law requires or authorises it.
Who we disclose personal information to
We do not sell personal information and we do not rent or trade it. We disclose it to:
- the ATO, ASIC, the Australian Transaction Reports and Analysis Centre (AUSTRAC), and other government agencies, where the law requires or authorises it
- superannuation funds, banks and lenders, where we are supporting an application or transaction for you
- your other advisers, such as your lawyer, financial planner, broker or auditor
- the software providers listed below, whose systems we use to do the work
- our subcontractors, including the offshore providers described in the next section
- our professional indemnity insurer, our lawyers and our external quality reviewers
- any other third party you authorise us to deal with, from time to time
- anyone else where disclosure is required or authorised by law, including under a court order or a statutory notice
As a registered tax agent we are also bound by a duty of confidentiality under the Code of Professional Conduct. We do not disclose information about your affairs to a third party without your permission, unless we have a legal duty to do so.
Sending information overseas
We use an offshore provider, BackOffis, whose staff are located in India. They prepare work under subcontract to us, which is a common arrangement in the accounting profession. They work inside our own systems under our supervision, and they do not download or keep copies of your information on their own equipment or in India. Giving overseas personnel access to your information is still a disclosure under the Privacy Act, so we tell you about it here.
Some of the software we use is supplied by overseas companies or hosted outside Australia. On that basis your information may be accessible in the following countries:
- India, through our subcontracted preparation staff
- United States, through Anthropic, OpenAI, Dropbox, Docusign, Mailchimp and Google Analytics
- New Zealand, through Xero and Suitefiles
Before we disclose your information to an overseas recipient we take reasonable steps to ensure they do not breach the Australian Privacy Principles. Those steps include written contracts requiring them to protect your information, restricting access to what the work requires, and keeping the information in systems we control. Under the Privacy Act we generally remain accountable for what an overseas recipient does with your information.
If you do not want your information handled by our offshore staff, tell us and we will discuss what we can do. In some cases it will change our fees or the time the work takes.
Tax file numbers and government identifiers
We hold a tax file number for almost every individual client. Tax file numbers are governed by the Privacy (Tax File Number) Rule 2015 and by the Taxation Administration Act 1953 (Cth), which apply in addition to the Australian Privacy Principles.
We collect, record, use and disclose tax file number information only where taxation, superannuation or assistance agency law allows it. We do not use a tax file number as a way of identifying you in our own records. It is an offence to request, record, use or disclose another person's tax file number without authority.
You are not obliged to give us your tax file number. If you do not, we can usually still act for you, but we may not be able to lodge on your behalf and you may be taxed at a higher rate.
We do not adopt any government identifier, such as a tax file number, Medicare number or driver licence number, as our own identifier for you.
Anti-money laundering and identity verification
Since 1 July 2026 accountants who provide certain services have been reporting entities under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth). We provide some of those services, including setting up companies and trusts, and handling client money. As a result we must verify who you are before we act, keep that verification current, monitor transactions, and report certain matters to AUSTRAC.
To do that we collect your full name, date of birth, residential address, and information from identity documents such as a passport or driver licence. For companies, trusts and partnerships we also collect information about directors, trustees, partners, beneficial owners and anyone who controls the entity. We may use an electronic verification service to check these details against independent data sources.
We use EasyAML to carry out and record our customer due diligence. Where we take a copy of an identity document, it is held in EasyAML rather than in our own systems. Since 1 July 2026 the law no longer requires us to keep copies of identity documents, and asks instead for the information taken from them. Copies are kept only for as long as they are needed, and are then destroyed or de-identified.
If we report a matter to AUSTRAC we are prohibited by law from telling you. This is called a tipping off restriction and it overrides the rest of this policy.
If you do not give us the information we need to verify you, we cannot act for you.
Artificial intelligence and automated decisions
We use artificial intelligence tools to help us prepare and review work. The tools we use are Claude, supplied by Anthropic, and ChatGPT, supplied by OpenAI. Some of the specialist software we use also has artificial intelligence features built in.
No decision about you is made by a computer program. Everything these tools produce is reviewed by a member of our staff, and any advice, return or statement is formally authorised by a person before it goes anywhere.
Where we put client information into these tools we use accounts configured so the provider does not use your information to train its models. Both providers are located in the United States, so this is also an overseas disclosure and the section above applies.
Our website, cookies and analytics
When you visit robertscowling.com our web server records the usual technical information: your IP address, the pages you viewed, the time of your visit, the site you came from, and your browser and device type.
Our site loads Google Tag Manager, which we use to run Google Analytics. Google Analytics places cookies on your device and sends the information it collects to Google, which is based in the United States. We use it to understand how the site is used, not to identify you.
Most browsers let you refuse or delete cookies. If you do, parts of the site may not work as intended.
Our site links to other sites, including our social media pages. Those sites have their own privacy policies and we are not responsible for them.
Direct marketing
We occasionally send clients and contacts newsletters and updates about tax, superannuation and business matters. We send these through Mailchimp, which is operated by Intuit in the United States.
Every email we send carries an unsubscribe link. Click it and you will stop receiving marketing email from us. You can also ask us to stop by emailing admin@robertscowling.com. Either way we will action it promptly and at no cost to you.
Unsubscribing from marketing does not stop us sending you the emails we need to send to do your work, such as returns for signing, reminders about lodgement dates, and invoices.
We do not provide your contact details to other organisations for their marketing.
How we store and secure your information
We hold your information electronically, in the cloud services we use to run the practice. Those are Xero and Xero Partner Hub, MYOB, Class, NowInfinity, Seamless SMSF, ChangeGPS, EasyAML, Fathom, Brieff, Suitefiles, Dropbox, Docusign, Microsoft 365, the software supplied by Rapport Digital Pty Ltd, and the ATO and ASIC portals. We also use software we built ourselves, which runs in Microsoft Azure, is encrypted, and holds data in Australia only.
We take reasonable steps to protect your information from misuse, interference and loss, and from unauthorised access, modification or disclosure. Those steps include multi-factor authentication, encryption, restricting access to staff who need it for their work, written agreements with our suppliers and subcontractors, and training our staff in confidentiality and privacy.
No system is completely secure. Information you send us by email carries the ordinary risks of email, and we cannot guarantee its security while it is in transit. If you would rather not email something sensitive, call us on 07 3891 1888 and we will agree another way to get it to us.
How long we keep your information
We keep your information for at least as long as the law requires us to. The periods that usually apply are five years for records supporting a tax return under the Income Tax Assessment Act 1936 and 1997, five years for tax agent records under the Tax Agent Services Act 2009, seven years for company records under the Corporations Act 2001, and seven years for anti-money laundering records under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006.
Where the periods differ we apply the longest one that applies to the record. We also keep records for as long as we may need them to defend a professional claim.
When we no longer need information, and no law requires us to keep it, we take reasonable steps to destroy it or to de-identify it.
Ending your engagement with us does not mean we delete your file straight away. We still have to keep what the law requires.
quires us to. The periods that usually apply are five years for records supporting a tax return under the Income Tax Assessment Act 1936 and 1997, five years for tax agent records under the Tax Agent Services Act 2009, seven years for company records under the Corporations Act 2001, and seven years for anti-money laundering records under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006. Where the periods differ we apply the longest one that applies to the record. We also keep records for as long as we may need them to defend a professional claim. When we no longer need information, and no law requires us to keep it, we take reasonable steps to destroy it or to de-identify it. Ending your engagement with us does not mean we delete your file straight away. We still have to keep what the law requires.Data breaches
We have a written data breach response plan. Our response team is made up of our Operations Manager and the Directors of the firm.
If we suspect a data breach we contain it, then assess within 30 days whether it is likely to result in serious harm to anyone whose information was involved. If it is, we notify the affected individuals and the Office of the Australian Information Commissioner (OAIC) as soon as practicable, as the Notifiable Data Breaches scheme requires. Where the breach involves tax file numbers we may also have to notify the ATO.
If you think your information held by us has been compromised, tell us immediately using the contact details below.
Dealing with us anonymously
You can make a general enquiry without telling us who you are, and we will answer it if we can.
Once you engage us we need to know who you are. We cannot lodge with the ATO, act on your behalf with ASIC, or meet our anti-money laundering obligations for someone we cannot identify. So we cannot act for you anonymously or under a pseudonym.
Accessing and correcting your information
You can ask us for the personal information we hold about you. Put the request in writing to our Privacy Officer using the details below, and tell us what information you want. We may ask you to verify your identity first.
We will respond within 30 days. We do not charge for making a request, and we do not charge for giving you access.
There are limited situations where we can refuse access. They include where giving access would have an unreasonable impact on someone else's privacy, where the information relates to anticipated legal proceedings, or where the law requires or authorises us to refuse. If we refuse, we will tell you why in writing and explain how to complain about it.
If information we hold about you is wrong, out of date, incomplete or misleading, ask us and we will correct it. If we disagree that a correction is needed, we will tell you why in writing, and you can ask us to attach a statement to the record saying you believe it is wrong.
Making a complaint
If you think we have mishandled your personal information, tell our Privacy Officer in writing. Complaints are dealt with by the Directors of the firm.
We will acknowledge your complaint within 5 business days and give you our response within 30 days. If we need longer we will tell you why and agree a new date with you. There is no charge.
If you are not satisfied with our response, or we have not responded within 30 days, you can take the complaint to the Office of the Australian Information Commissioner:
- Online: oaic.gov.au
- Phone: 1300 363 992
- Post: GPO Box 5288, Sydney NSW 2001
Complaints about our conduct as a registered tax agent can also go to the Tax Practitioners Board at tpb.gov.au.
Contact us
Our Privacy Officer is David Cowling, Director.
- Email: admin@robertscowling.com
- Post: Privacy Officer, Roberts & Cowling Pty Ltd, PO Box 3389, Norman Park QLD 4170
- Phone: 07 3891 1888
Changes to this policy
We review this policy at least once a year, and whenever our practices or the law change. The current version is always on our website at robertscowling.com/privacy-policy.
Version 1.0, effective 22/09/2026.
