Privacy policy

This policy explains how Druiven Legal (we, us or our) collects, holds, uses and discloses personal information. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles, and consistently with our professional duties of confidentiality as lawyers.

In this policy, personal information has the meaning given in the Privacy Act 1988 (Cth). In general terms, it is information or an opinion about an identified individual, or an individual who is reasonably identifiable.

What personal information do we collect?

The personal information we collect depends on how you deal with us. It may include:

• your name, organisation, position, email address, telephone number and postal address
• the details of your enquiry or legal matter, and the information you give us in the course of a matter
• information needed to confirm your identity, check for conflicts of interest, open a matter and bill for our services
• information about other people involved in a matter, such as employees, witnesses, other parties and their representatives
• records of our communications with you.

Some matters involve sensitive information, such as health information, information about union membership, or information relevant to a discrimination or workplace complaint. We collect sensitive information only with consent or where the law otherwise allows, and only where it is relevant to the work we are doing.

How do we collect personal information?

Where reasonable and practicable, we collect personal information directly from you, including when you complete our enquiry form, email or call us, meet with us, or provide documents and instructions.

We may also collect personal information from other sources where that is reasonable in the circumstances, including your employer or organisation, your authorised representatives and advisers, other parties to a matter and their representatives, witnesses, experts, courts and tribunals, and public records and searches.

What happens if you do not provide personal information?

You can make a general enquiry without identifying yourself. However, before we can act for you we need enough information to identify you, check for conflicts of interest and understand your matter. If you do not provide it, we may not be able to act for you, or our advice may not take account of all relevant circumstances.

Why do we collect, hold, use and disclose personal information?

We collect, hold, use and disclose personal information to:

• respond to enquiries and decide whether we can act
• check for conflicts of interest
• provide legal services, including advice, investigations, negotiation and representation
• administer our relationship with you, including engagement, billing and payment
• meet our legal, professional, regulatory and insurance obligations
• handle complaints and disputes
• manage and improve our practice and our website
• send you legal updates or invitations, but only where you have agreed to receive them.

We use and disclose personal information for the purpose for which it was collected, for related purposes you would reasonably expect, or as otherwise permitted or required by law. We do not sell personal information.

If you receive legal updates from us, you can ask us to stop at any time by replying to the message or emailing us. Any electronic marketing we send will comply with the Spam Act 2003 (Cth).

We do not use personal information to make decisions by computer program alone that could significantly affect your rights or interests.

Who do we disclose personal information to?

Information you give us in connection with a legal matter is confidential and may be protected by legal professional privilege. We disclose it only as needed to carry out your instructions, with your consent, or where the law requires or permits. Depending on the matter, we may disclose personal information to:

• courts, tribunals, commissions and other decision makers
• other parties to a matter and their lawyers or representatives
• barristers, experts, investigators, interpreters and other consultants engaged for a matter
• service providers who support our practice, namely Microsoft (Microsoft 365 email and document storage) and our website host, Netlify
• our professional indemnity insurer and professional advisers
• legal profession regulators and other authorities where required by law
• anyone else you authorise.

Where we use service providers, we take reasonable steps to ensure they protect personal information and use it only to provide their services to us.

Do we disclose personal information outside Australia?

We use Microsoft 365 for email and document storage. Microsoft may store and process that information in Australia and in other countries, and Microsoft and its service providers may access it from overseas, including the United States, to provide and support the service. Our website is hosted by Netlify, which may process website information, including enquiry form submissions as they are sent, on servers outside Australia. We take reasonable steps to ensure these providers handle personal information consistently with the Australian Privacy Principles.

If your matter involves people or organisations outside Australia, we may also need to disclose relevant personal information to them in order to carry out your instructions.

Our website and enquiry form

Our website does not use advertising or analytics cookies, and does not track you across other websites.

When you complete the enquiry form, we collect the details you enter: your name, email address, and, if you choose, your phone number and organisation, together with your outline of the enquiry. The form sends these details to us by email so we can respond. Please do not include confidential documents or detailed personal information in the form.

Like most websites, our website host (Netlify) automatically records technical information such as IP addresses, browser type and the pages requested. This information is used to operate and secure the website, including to prevent spam and misuse of the enquiry form.

Our website links to other websites, including LinkedIn. We are not responsible for the privacy practices of those websites, and we suggest you read their privacy policies.

How do we hold and protect personal information?

We hold personal information electronically and, occasionally, in paper form. We take reasonable steps to protect it from misuse, interference and loss, and from unauthorised access, modification or disclosure. These steps include password and access controls, secure cloud systems, and limiting access to those who need it.

We keep client files for as long as required by law and our professional obligations, generally at least seven years after a matter ends. Information from enquiries that do not proceed is kept only as long as reasonably needed, including for conflict checking. When personal information is no longer needed, we take reasonable steps to destroy or de-identify it.

No method of sending information over the internet is completely secure. If you are concerned, please contact us by phone before sending sensitive information.

What happens if there is a data breach?

If we suspect personal information has been lost or accessed without authorisation, we will act promptly to contain it and assess the risk of harm. If an eligible data breach occurs, we will notify affected individuals and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme.

How can you access or correct your personal information?

You can ask for access to the personal information we hold about you, or ask us to correct it, by contacting us using the details below. We will respond within a reasonable time, generally within 30 days.

We do not charge for making a request or for correcting information. We may charge a reasonable fee for providing access, and will tell you before doing so. In some cases we may refuse access, for example where giving access would breach legal professional privilege or confidentiality, or unreasonably affect another person's privacy. If we refuse a request, we will tell you why in writing.

How can you make a complaint?

If you are concerned about how we have handled your personal information, please contact us in writing with details of your concern. We will acknowledge your complaint, look into it, and respond within a reasonable time, generally within 30 days.

If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au (opens in a new tab) or on 1300 363 992.

Changes to this policy

We may update this policy from time to time. The current version will always be published on this page, with the date it was last updated.

Contact

For privacy questions, requests or complaints, please contact: