Privacy Policy

Quick Summary

• We collect and use your personal information to provide the Services, Practice Work and to comply with our professional obligations.
• We only collect information where reasonably necessary, take steps to protect it, and do not sell it.
• You can contact us at any time to discuss this Policy, or access or correct your information.
• KD Legal values and prioritises open, transparent and reasonable management of personal information.

Overview

This Privacy Policy sets out how KD Legal manages personal information in the course of providing the Services in Western Australia and online, in accordance with the Privacy Amendment (Enhancing Privacy Protection) Act 2012, the Privacy Act 1988 (Cth), the Australian Privacy Principles, applicable Western Australian privacy and data protection laws, and other relevant legal and professional obligations.

As a legal practice, KD Legal are also bound by professional duties of confidentiality and conduct.

By instructing us, engaging our Services, or accessing our website at www.kdlegal.com.au, or otherwise communicating with KD Legal, you consent to the collection, use, handling and disclosure of your personal information as described in this Policy.

This Policy should be read in conjunction with our Artificial Intelligence and Date Use Policy and, if applicable, any terms of engagement we provide you.

Definitions

AML/CTF Act means the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth), as amended from time to time.

AML/CTF Information means the Personal Information that we collect and hold as part of complying with our AML/CTF Obligations, including (but not limited to) customer due diligence (CDD) related information.

AML/CTF Obligations means our obligations as a reporting entity enrolled with the AUSTRAC and in providing Designated Services, as set out in the AML/CTF Legislation.

AML/CTF Legislation means the AML/CTF Act and the Anti-Money Laundering and Counter-Terrorism Financing Rules 2025 (Cth), as amended from time to time.

AUSTRAC means Australian Transaction Reports and Analysis Centre.

APPs means Australian Privacy Principles.

Cookies (in the context of a website means a small text file that is saved onto your computer or other device to record use of a website.

Designated Services has the meaning given in section 5 of the AML/CTF Act.

KD Legal means KD Legal Pty Ltd (ACN 133 829 473) as trustee for the KD Legal Trust trading as KD Legal (ABN 31 747 913 038).

Personal Information means information or an opinion about an identified or reasonably identifiable individual.

Practice Work means any work product, advice, drafts, emails, documents, transcripts, recordings, document management or the like prepared or provided by KD Legal

Sensitive Information includes information such as health, criminal record, political or religious beliefs, and commercially sensitive data.

Services means the legal services and legal advice KD Legal will provide and includes any Practice Work provided or produced by KD Legal.

Suspicious Matter Report (SMR) means a report that we are required to submit to AUSTRAC if a suspicious matter reporting obligation arises as defined in section 41 of the AML/CTF Act.

Tipping Off means the criminal offence under section 123 of the AML/CTF Act, including a disclosure to a person that we have lodged, are required to lodge, or have prepared, an SMR to lodge with, AUSTRAC, where such disclosure would or could reasonably be expected to prejudice a criminal investigation and is not otherwise permitted under the AML/CTF Legislation.

Privacy Laws Privacy Amendment (Enhancing Privacy Protection) Act 2012, the Privacy Act 1988 (Cth), the Australian Privacy Principles, applicable Western Australian privacy and data protection laws, and other relevant legal and professional obligations.

this Policy means this privacy policy.

We, us or our means KD Legal.

What information we collect

We only collect personal information where reasonably necessary to provide the Services. This may include:

• name and contact details;
• identification information;
• financial and business information;
• information required by us to comply with our legal obligations (which include our AML/CTF Obligations); and
• communications and legal matter information.

We may also collect sensitive information or confidential information where necessary.

We may collect information about third parties where relevant. You must be authorised to provide it.

Some information may be subject to legal professional privilege.

How we collect personal information

We may collect personal information directly from you and indirectly from other sources in the course of providing the Services. KD Legal will collect personal information in a fair and lawful manner. In most instances, we will collect personal information from you unless it is unreasonable and impracticable to do so.

The collection of information may occur through meetings, telephone calls, video conferences, interviews, correspondence, emails, website enquiries, online forms, and other communications with you.

We may also collect personal information from third parties where reasonably necessary, including your authorised representatives, other solicitors or advisers, barristers, accountants, regulators, courts and tribunals, government agencies, public registers, search providers, counterparties, witnesses, and other persons involved in a matter. In some cases, personal information may be collected from documents and records you provide to us, publicly available sources, or information generated in the course of providing the Services.

If KD Legal receives unsolicited personal information that we know could have been collected from you, we will afford it the same privacy protection as if we had solicited this personal information.

Why we collect and use information

We use information to provide the Services, manage relationships, comply with law, manage risk, and operate our business.

This includes recruitment, insurance, and risk management.

We need personal information to provide Services and Practice Work to you. If you do not provide the required information, we may be limited in our dealings with you and we may be unable to act or may cease to act.

Identity verification

We may verify your identity using documents or electronic services.

Before onboarding you as a client, providing you with any Services, or producing any Practice Work, we consider it reasonably necessary to verify your identity and to collect the information, documents and the like reasonably required for that purpose.

We, at our sole discretion may use third party providers to assist with identity verification. By providing us with information or documents for that purpose, you consent to those third-party providers collecting, using, handling and disclosing that information to the extent reasonably necessary to verify your identity and to provide their verification services to us.

Disclosure of personal information

We may disclose information to staff, advisers, courts, regulators, insurers, and service providers. We may also disclose where required by law Including the disclosure to external service providers for the purposes of complying with our legal and regulatory obligations including our AML/CTF Obligations (which may include lodging an SMR with AUSTRAC) independent evaluations of our AML/CTF program and audit.

We do not sell personal information.

Some providers may store data overseas.

KD Legal may transfer or store your personal information outside Australia if we engage with, or are required to send personal information to, an overseas entity to fulfil the purpose for which the personal information was collected (or a related or ancillary purpose).

If we do disclose personal information to an overseas recipient without your consent, we will take reasonable steps to ensure that this recipient does not breach the Privacy Laws or a similar applicable law in relation to that information.

KD Legal take reasonable steps to ensure compliance with this Policy but KD Legal is in no way responsible for:

• breaches of this Policy;
• or the handling of any personal information
• by third-parties.

Data security and retention

We implement safeguards to protect information.

We retain information as required by law including as required to comply with our AML/CTF Obligations and professional obligations.

KD Legal takes the security of your personal information very seriously. We have implemented measures and precautions to protect the personal information we hold (electronic and physical) from such risks as misuse, interference and loss, and from unauthorised access, modification or disclosure. We take reasonable steps to store, destroy or permanently de-identify any personal information no longer required.

No system is completely secure.

Data breaches

If we become aware of a suspected or actual data breach affecting personal information, we will take reasonable steps to identify, contain, assess and respond to the incident. This may include investigating the nature and scope of the breach, taking steps to mitigate potential harm, securing our systems and records, and notifying affected persons or relevant authorities where we consider it appropriate or where required by law.

If you become aware of a suspected or actual data breach affecting personal information or other confidential information provided to, by or through us in connection with the Services, you must notify us as soon as reasonably practicable and take reasonable steps to contain, investigate, mitigate and remediate the incident. You must also take reasonable steps to protect that information and to prevent unauthorised access, use, disclosure, loss or misuse.

Reporting Breaches of this Policy

If you believe that KD Legal has breached the Privacy Laws or this Policy, please contact KD Legal in writing. We will respond to you within 30 days. If you are not satisfied with our response, you may take your complaint to the Office of the Australian Information Commissioner.

If you believe you have breached this Policy you must inform us by writing as soon as is reasonable practicable.

Access and correction

You may request access to or correction of your information by writing to us.

Where possible, we will provide you with access to that information either by providing you with copies of the information requested, allowing you to inspect the information requested or providing you with an accurate summary of the information held by KD Legal.

If KD Legal were to refuse to:

• give access to the personal information, or in the manner requested; or
• correct the relevant information,

we will provide written notice of the reasons (unless unreasonable to do so, for example, so as not to engage in Tipping Off) and details should you wish to complain about the refusal. Generally, a refusal will only be in cases where denying such access is permitted under the Privacy Laws, AML/CTF Legislation or is otherwise lawful.

Marketing

Where KD Legal has collected information from you, we may use this information for the purpose of direct marketing, to conduct surveys, to notify of events, to seek your feedback and for any other business-related purposes.

KD Legal may use or disclose the personal information we hold about you for the purpose of direct marketing, such as articles that may be of interest to you, if there is a reasonable expectation that your personal information will be used for this purpose.

KD Legal will not directly market to you using information that is considered sensitive unless you have provided consent.

We may send you updates.

Website

When you visit any part of our website, we collect statistical data about that visit (e.g. what you looked at, the way in which you moved around the site, etc). We use this information to make our sites more useful and easily navigable.

We use Cookies and collect usage data for site improvement.

We may use external web services to display embedded content on our website, for example to display images, videos or feedback surveys. We cannot stop these services collecting information on your use of this embedded content.

Most web browsers give you the option to either allow or block cookies for selected sites or to delete the cookies that have already been recorded. Refer to the ‘Help’ section of your browser for instructions on how to do this. Please note, however, some site functionality may be affected if certain cookies are disabled.

Contacting KD Legal

All requests for access or correction to personal information, privacy complaints, requests for access to personal information, queries in relation to this Policy, or any other privacy-related matter, should be directed to us in writing using the following details:

KD Legal

Physical Address: Level 4, 105 St Georges Terrace, PERTH WA 6000

Postal Address: PO Box Z5383, St Georges Terrace, PERTH WA 6831

Phone: 08 6324 2933

Fax: 08 6324 2934

Email: admin@kdlegal.com.au

Our preference is to communicate by way of email.

Any enquiry you make may be directed to a member of our firm.

We will respond to your request within a reasonable time and in accordance with the requirements of the Privacy Laws.

Complaints

If you have made a privacy complaint and believe that KD Legal has not adequately handled your complaint, you may escalate your complaint to the:

Managing Principal of KD Legal;

Office of the Australian Information Commissioner:

Postal Address: GPO Box 5218, SYDNEY NSW 2001

Phone: 1300 363 992

Fax: 08 6324 2934

Email: enquiries@oaic.gov.au

Legal Practice Board Western Australia:

Physical Address: Level 6, 111 St Georges Terrace, PERTH WA 6000

Postal Address: PO Box 5720, PERTH WA 6831

Phone: (08) 6211 3600

Email: enquiries@lpbwa.com.

Changes

We may update this policy from time to time at our sole discretion to reflect our current privacy practices.