Privacy Policy

Who this policy covers

SP Consulting Pty Ltd provides strategy, operations and technology advisory services. This policy explains how we handle personal information — what we collect, why, who we share it with, how we protect it, and what you can ask us to do about it.
 

We apply the Australian Privacy Principles (APPs) in the Privacy Act 1988 (Cth) to everything we do, including where the Act's small business provisions would not strictly require it. Where we work under a Commonwealth contract, the Act applies to us directly. Where we work for a Victorian government agency, we may also be bound by the Information Privacy Principles under section 17 of the Privacy and Data Protection Act 2014 (Vic), through the agency's contract.
 

You can read the APPs at oaic.gov.au.
 

What we collect

• Contact and identity details — your name, role, organisation, email address, phone number and postal address.

• Engagement information — what you tell us about your organisation and the problem you want solved, correspondence with us, and records created during an engagement.

• Website information — anything you enter into our contact form, and technical information your browser sends, such as IP address, device and browser type, pages visited and referring site. 

• Marketing preferences — whether you have subscribed to updates, and whether you have opted out.

• We do not seek sensitive information — health, racial or ethnic origin, political opinions or affiliations, religious or philosophical beliefs, union membership, sexual orientation or criminal record. If sensitive information is ever needed for an engagement, we will ask for your consent first and use it only for the purpose you consented to, unless the law requires otherwise.

How we collect it

Wherever it is reasonable and practicable, we collect personal information directly from you — through our contact form, by email or phone, in meetings, and in the course of an engagement. We also collect it from your organisation when it engages us, and occasionally from publicly available sources such as a company website or LinkedIn. Where someone else gives us your information, we will take reasonable steps to let you know.
 

Dealing with us anonymously

You can ask us a general question anonymously or under a pseudonym. We will accommodate that wherever it is lawful and practicable. We cannot usually deliver an engagement without knowing who we are working with.
 

Why we collect it

We collect personal information to respond to enquiries, to deliver and administer our services, to invoice and keep accounts, to meet our legal and contractual obligations, and — where you have asked for it — to send occasional updates about our work. We may also use it for purposes directly related to these, where you would reasonably expect us to.

We do not sell personal information, and we do not trade in it.

Marketing

We only send updates to people who have asked for them. Every message includes a one-click unsubscribe, and you can also ask us to stop at any time by replying or emailing us. We will action it promptly and will not need a reason.

​

Who we share it with

We share personal information only where it is necessary, and only with:

• service providers who help us operate — our website host, email and file storage, scheduling, accounting and invoicing 

• our professional advisers, such as our accountant or lawyer, where needed

• anyone you have asked or agreed that we share it with

• anyone we are required or authorised by law to disclose to

We require our service providers to protect personal information and to use it only for the purpose we engaged them for.

Information sent overseas

Some of the services we rely on store or process data outside Australia. Before disclosing personal information overseas, we take reasonable steps to ensure the recipient handles it consistently with the APPs, as APP 8 requires.
 

Information we handle during engagements

During an engagement we often encounter personal information about our client's staff, stakeholders and customers. We treat that information as our client's, not ours. We handle it under the terms of the engagement contract and any privacy obligations that contract imposes — including, for Victorian government work, the Information Privacy Principles where we have been bound to them. We use it only for the engagement, keep it separate from our own records where practical, and return or destroy it when the engagement ends if the contract requires that.
 

How we protect it

We take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. In practice that means:

• reputable cloud services with encryption in transit and at rest

• multi-factor authentication on our email, file storage and website accounts

• access limited to people who need it for the work

• devices that are encrypted, password-protected and kept up to date

• confidentiality obligations on anyone we bring onto an engagement

• secure disposal of records we no longer need

If something goes wrong

If we become aware of a data breach, we will assess it promptly. Where a breach is likely to result in serious harm, we will notify the affected individuals and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act requires. Where the breach involves information we hold for a government client, we will also notify that client in line with our contract.

How long we keep it

We keep personal information only as long as we need it for the purpose we collected it, or as long as the law or a contract requires. Client engagement records are generally retained for at least seven years after the engagement ends, to meet tax, professional and contractual obligations. When information is no longer needed, we destroy it or permanently de-identify it.

Accessing and correcting your information
 

You can ask us for a copy of the personal information we hold about you, and ask us to correct anything that is wrong or out of date. 
 

We will respond within 30 days. There is no charge for making a request; we may charge a reasonable, non-excessive fee if a request takes substantial work to fulfil, and we will tell you before we do. We may ask you to verify your identity first. In the limited circumstances where the Privacy Act lets us refuse access or correction, we will explain why in writing and tell you how to complain.
 

Complaints

If you think we have mishandled your personal information, tell us. We will acknowledge your complaint within 5 business days, investigate it, and give you a written response within 30 days. If it will take longer, we will tell you why and when to expect an answer.
 

If you are not satisfied, you can take the matter to the Office of the Australian Information Commissioner at oaic.gov.au or 1300 363 992. If your complaint concerns information we handle for a Victorian government agency, you can also contact the Office of the Victorian Information Commissioner at ovic.vic.gov.au.
 

Cookies and analytics

Our website uses cookies that are necessary for it to function. We also use Google Analytics, which uses cookies to help us understand how people use the site, such as which pages are visited and how visitors found us. Google processes this information on our behalf.  You can opt out using Google's Analytics opt-out browser add-on. You can block or delete cookies in your browser settings, though parts of the site may not work as well.
 

Links to other sites

Our site links to other organisations' websites. We are not responsible for their content or their privacy practices, and we suggest you read their policies before giving them your information.
 

Changes to this policy

We update this policy as our practices or the law change. The current version is always on our website, with its version number and effective date at the top. Material changes will be noted here.