Website Privacy Policy

Information we collect

Depending on the service you request, we collect contact and account details; dates of birth and family or business information; income, deductions and financial records; correspondence, appointments and payment records; and documents and declarations you submit. Identity checks may require identification documents. Tax file numbers (TFNs) and refund-bank details are collected through the protected client information forms when needed.

We also collect technical information needed to operate and secure the website, such as IP addresses, browser information, access logs and account activity. Electronic signing records include the document, your signing details, confirmations and the signing date.

How and why we collect information

We collect information from you when you enquire, book, create an account, complete forms, upload documents, sign or communicate with us. With appropriate authority, we may obtain relevant information from the ATO, your representatives, previous advisers and connected accounting services.

We use it to respond to requests, verify identity and authority, assess and deliver agreed work, prepare and lodge authorised documents, manage appointments and payments, keep records, protect accounts and meet our professional and legal obligations. A submission or payment is not itself confirmation that a return has been lodged.

You may make a general enquiry without identifying yourself where practicable. We need sufficient accurate information and identity evidence to provide tax services. If you choose not to provide required information, we will explain any limits on the work we can do. Provide another person's information only when you have authority to do so.

TFNs, bank details and identity documents

McGregor Accounts Pty Ltd requests your TFN to identify your tax records and conduct your tax affairs as your appointed tax agent. Collection on your behalf is permitted under the Taxation Administration Act 1953, including section 8WA(1AA)(c), and handling is governed by the Privacy (Tax File Number) Rule 2015. It is not an offence to refuse to quote your TFN. If you do not provide it, we may be unable to access your ATO records or complete some tax services; we will discuss the available options with you. Access is restricted to those who need it for your tax affairs. We may disclose it to the ATO for that work.

Use the protected portal forms for TFNs and refund-bank details. Do not put them in ordinary enquiries, appointment notes or email. These details and uploaded identity evidence use additional encryption and restricted access. We use bank details for the authorised refund or accounting purpose; supplying them does not verify account ownership or authorise a payment.

Temporary identity-document copies are scheduled for deletion after 30 days and may be deleted earlier after review. We retain the identity-check record. Other records have different retention requirements.

Who may receive your information

Information is available to authorised practice personnel for their work. We may disclose relevant information to the ATO and other authorities, your authorised representatives, and providers supporting our hosting, sign-in, communications, accounting, payments and document services. Examples include Google Cloud and Firebase, Google Workspace, Xero and Stripe, where used for your service. We may also disclose information when required or authorised by law.

When a payment option is available, the payment provider handles card details under its own privacy terms. We receive the payment and transaction information needed to manage your purchase.

Storage, overseas processing and security

Our portal form records and protected document storage are configured for Sydney, Australia. This does not mean every connected service processes information only in Australia. Firebase Authentication processes sign-in information in the United States. Other Google and connected service operations may involve overseas processing or support.

See Firebase's privacy and processing locations and Google Cloud locations for provider information. Contact us if you need details about the providers and locations relevant to your work before supplying information.

We use access controls, encryption and activity records to protect information and take reasonable steps when engaging service providers. No online system is risk-free. Contact us promptly if you suspect unauthorised access. We assess security incidents and notify affected people and regulators where required.

Cookies, analytics and communications

Browser storage supports sign-in, website preferences and your cookie choice. Optional Google Analytics runs on supported public pages only after you accept analytics cookies and when analytics is configured. It is disabled on private portal pages. Declining optional analytics does not prevent you using the website.

You can clear website storage through your browser to reset your cookie choice; doing so may also sign you out. We use contact details for service communications. Visiting the website does not, by itself, give consent to marketing. You can unsubscribe from marketing or contact us to opt out; essential service messages may still be needed.

Optional AI assistance

When an AI assistant is enabled and you use it, the messages and any material you choose to submit to that tool are sent to Google's Gemini service to generate a response. This may involve overseas processing. Do not put TFNs, bank details, identity documents or confidential client information into the public website help chat. Use the protected forms or contact the practice instead.

AI assistance is optional. Contact us directly if you prefer a person to help. Provider handling depends on the service used; this policy does not promise that AI processing takes place only in Australia.

Retention, access and correction

We keep records for the period needed for the service, applicable tax and professional record-keeping requirements, and any lawful dispute or retention obligation. Closing your account does not automatically delete records we must retain. When information is no longer needed and retention is not required, we take reasonable steps to destroy or de-identify it.

Contact us to request access, correction or deletion. We may need to verify your identity and authority. We will explain any lawful reason we cannot meet a request and any available complaint options. Deletion requests are subject to record-keeping obligations.

Privacy enquiries and complaints

Contact McGregor Accounts Pty Ltd, ABN 46 651 037 099, at info@mcgregoraccounts.com.au, 02 9090 4748, or 136 Marrickville Road, Marrickville NSW 2204.

Please describe your concern without including TFNs, passwords or bank details in the email. We will investigate and aim to respond within 30 days. If more time is needed, we will explain why. If you are dissatisfied, you may contact the Office of the Australian Information Commissioner.

We update this policy when our practices or requirements change. The current version and its update date are published on this page.