Privacy Policy

Positive Accounting Solutions Pty Ltd (ACN 145 978 025), as trustee for The Hopkins Practice Trust (ABN 70 134 898 527) ("we", "us", "the Firm"), is committed to protecting your privacy in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). This policy explains what personal information we collect, how we use it, and your rights.

If you would like more detail on how a specific engagement handles your information, see the Privacy and Confidentiality section of your engagement letter, which this policy supports.

1. What personal information we collect

In the course of providing accounting, taxation and business advisory services, we may collect:

• Name, date of birth, address, email address and phone numbers
• Tax File Number (TFN) and Australian Business Number (ABN)
• Occupation, qualifications and employment details
• Financial records, including income, assets, liabilities, insurance and superannuation information
• Details of related entities, family members or business connections relevant to your affairs
• Identification documents (e.g. driver licence, passport, Medicare card) where required for identity verification — see Section 5 (AML/CTF)
• Website visitor data (pages visited, dates and times) and cookies, where you browse positiveas.com.au

2. How we collect it

We generally collect personal information directly from you, or from your authorised representatives (e.g. a bookkeeper, financial adviser or related entity acting on your instructions). We may also collect information from the Australian Taxation Office, ASIC and other public registers where necessary to provide our services.

3. How we use and disclose your information

We use your personal information to provide accounting, taxation and business advisory services, and to meet our own legal and professional obligations. We may disclose your information to:

• the Australian Taxation Office, ASIC, and other regulators, where required to lodge returns, statements or applications on your behalf;
• AUSTRAC, where required under our AML/CTF obligations — see Section 5;
• the third-party service providers listed in Section 4, who process information on our behalf; and
• other parties with your express consent, or as otherwise required or authorised by law.

We do not sell personal information, and do not disclose it for direct marketing by third parties without your consent.

4. Software, systems and overseas disclosure

We use the cloud-based and outsourced services below to deliver our services, consistent with TPB(GS) 30/2017 (Cloud computing and the Code of Professional Conduct). Some of these providers may store or process data outside Australia. Where that occurs, we take reasonable steps to ensure the overseas recipient does not breach the Australian Privacy Principles, consistent with APP 8.

Use of AI-assisted tools

Our use of Claude (Anthropic) is governed by TPB(GS) 55/2026 (The use of Artificial Intelligence and the Code of Professional Conduct), TPB(GS) 26/2014 (Confidentiality of client information) and TPB(GS) 30/2017 (Cloud computing and the Code of Professional Conduct). The tool is used as a support tool only — it does not determine your tax position, communicate with you, or approve or lodge anything on your behalf. Where we connect it to your Xero accounting file, it reads the file on our instruction and may prepare journal entries as drafts for our review. No entry is posted to your ledger without a member of our team reviewing it first. A suitably qualified member of our team reviews all AI-assisted outputs and the underlying records; responsibility for professional judgments and our services remains with the Firm and the responsible registered tax agent.

We seek to minimise the personal information we process through AI tools and will not include sensitive identifiers unless reasonably necessary and handled under our approved controls. Where we use AI-assisted tools to pull entity details directly from our practice management system to prefill a firm document (such as an engagement letter), that information is used only to complete the specific field required, is not stored, logged or retained by the AI tool once the document is produced, and the completed document is reviewed by a registered practitioner before use. The details used in this way are your Australian Business Number and, where applicable, your Australian Company Number. Both are already published by the Australian Government — the ABN on the Australian Business Register at abr.business.gov.au, and the ACN on ASIC’s register — and are searchable by anyone. Tax file numbers are never accessible to these tools: our practice management system masks every tax file number before it can be read by any connected application, so no full tax file number is provided to, handled by, or visible to any AI-assisted tool at any point. This is a protection built into the system itself rather than a matter of our own procedure, and it applies whether or not any AI tool is involved. We will notify you if a materially different AI provider or use requires a change to this disclosure. We do not represent that use of an AI-assisted tool eliminates all confidentiality, security, availability, error or cross-border-processing risk.

5. Client identification and AML/CTF

As a registered tax agent, we verify client identity consistent with the TPB's client verification requirements. From 1 July 2026, the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) also applies to us as an AUSTRAC-enrolled reporting entity (enrolled as trustee for The Hopkins Practice Trust), where we provide a "designated service" — broadly, assisting with the formation, restructure, sale or transfer of a company, trust, partnership or other legal structure, or organising equity or debt financing for an entity.

Where a designated service applies, we collect and verify identification documents for you and any relevant beneficial owners who own or control 25% or more of the entity, directors, trustees or authorised representatives, and retain that information as set out in Section 6. We may also be required to report certain transactions or matters to AUSTRAC.

Confidentiality and reporting. Where we are required to report a suspicious matter or a threshold transaction to AUSTRAC, doing so does not breach our confidentiality obligations to you under the Privacy Act 1988 (Cth) or our professional obligations. Under the AML/CTF Act's "tipping-off" provisions, we are prohibited by law from telling you if such a report has been made.

6. How long we keep your information

We retain personal information for seven (7) years, consistent with our AML/CTF and taxation record-keeping obligations, unless a longer period is required by law or you request earlier deletion of information we are not legally required to retain (see Section 8).

7. Data security

We take reasonable steps to protect personal information from misuse, loss, and unauthorised access, modification or disclosure, including firewalls, secure cloud-based databases, access controls, and confidentiality agreements with our personnel and service providers. No method of electronic storage or transmission is completely secure, and while we maintain the safeguards described above, we cannot guarantee the absolute security of information transmitted to us or held on our systems or those of our service providers.

8. Your rights

Subject to our legal retention obligations (Section 6), you may request:

• access to the personal information we hold about you;
• correction of information that is inaccurate, out of date or incomplete;
• deletion of information we are not required by law to retain; and
• details of how your information has been used or disclosed.

To make a request, contact our Privacy Officer at info@positiveas.com.au. We aim to respond within 30 days, consistent with OAIC guidance for organisations under APP 12.4(b).

9. Data breaches

If we become aware of a data breach that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner (OAIC) as required under the Notifiable Data Breaches scheme in the Privacy Act 1988 (Cth).

10. Cookies and website data

Our website may use cookies and similar technologies to record visitor data such as pages viewed and time of access, to help us understand and improve the site. You can control cookies through your browser settings.

11. Complaints

If you have a concern about how we have handled your personal information, contact our Privacy Officer at info@positiveas.com.au in the first instance. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (oaic.gov.au).

12. Contact us

This policy was last updated 4 September 2026. It replaces all prior versions.

Liability limited by a scheme approved under Professional Standards Legislation.