PRIVACY POLICY AND DISCLAIMER

PART A – PRIVACY STATEMENT

AFS & Associates Pty Ltd (ABN 51 061 795 337) and Andrew Frewin Stewart (ABN 65 684 604 390) collectively (‘AFS’, ‘we’, ‘our’, ‘us’) understands that privacy is important to you. Protecting your personal information is important to us.

This policy explains how AFS handles personal information and complies with the requirements of the Privacy Act 1988 (Cth) (‘Privacy Act’) and the Australian Privacy Principles (‘APPs’). The policy deals with AFS’s collection and handling of personal information that is covered by the Privacy Act. It does not cover personal information that is not covered by the Privacy Act.

What does personal information mean?

Personal information is information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, and whether it is recorded in a material form or not.

Collection of personal information

AFS collects and holds personal information from clients, customers, employees, contractors and other people. AFS collects and holds this information when it is necessary for business purposes.

Personal information which AFS collects includes but is not limited to the following:

Names and contact details (which includes but is not limited to addresses, phone numbers and email addresses)
Employment details, such as title and income
Information in identification documents, such as drivers licence and passport
Tax file numbers and other government related identifiers
Financial institution details
Shareholding balances and details of investments
Superannuation details
Personal information about your spouse and/or dependants.

In the course of providing tax, audit, accounting, business services, share registry and related services to our clients, we may collect and hold more detailed personal information, including financial information.

This information is generally provided to us either directly by our clients and other individuals such as job applicants, or through a listed or unlisted organisation (‘Issuer’) in relation to a share registry service we provide or a securities exchange or security broker. Personal information is obtained when we first deal with you. We may collect personal information during a phone call or in-person meeting or via an application or other form completed by you. We also collect personal information during subsequent face to face meetings, email messages, telephone conversations and from third parties. For instance, if you telephone us, we may keep a record of that contact.

Notification of collection of personal information

At or before the time we collect your personal information, or as soon as practicable afterwards, we will take reasonable steps to notify you, or otherwise ensure you are aware, of the following matters:

The identity and contact details of AFS as the entity collecting your personal information.
The purposes for which we are collecting your personal information.
The main consequences (if any) for you if you do not provide all or part of the information requested.
The types of entities or individuals to whom we usually disclose personal information collected, including our service providers, regulatory authorities, and other third parties as required or authorised by law.
Whether the collection of your personal information is required or authorised by or under an Australian law or a court/tribunal order, and if so, the details of that law or order.
The fact that our privacy policy contains information about how you may access and seek correction of your personal information held by us, and how you may complain about a breach of privacy and how we will deal with such a complaint.
Whether we are likely to disclose your personal information to overseas recipients, and if so, the countries in which such recipients are likely to be located if it is practicable to specify those countries.

We may provide this information to you by reference to this privacy policy or, where appropriate, in a separate collection statement at the point of collection.

How we use your personal information

AFS only uses your personal information for the purpose for which it was collected and to offer and provide related services that are connected to that purpose.  This includes, for example, providing Issuers with registry and registry-related services, or notifying you about other Issuer or AFS services.

The purposes for which we collect, hold, use and disclose personal information include:

to provide our services to you
to respond to your requests
to maintain contact with you
to keep clients and other contacts informed of the services we offer and industry developments and seminars that may be of interest to you
to administer your security holding
for general management and reporting purposes, such as invoicing and account management
for recruiting purposes
for purposes relating to the employment of our personnel and providing internal services to our employees
for other purposes related to our business, such as auditing, business planning, billing, record keeping, compliance with legislation, and for the purpose of potential legal proceedings.

We may collect, hold or use information about individuals to market our services, including by email. We may send you information about our services, industry updates and events where you have consented or where otherwise permitted by law. Every marketing email includes an unsubscribe link, and you can also opt out at any time by emailing afs@afsbendigo.com.au. We will action your request within five (5) working days.

We may also be required by law under Australia’s Anti-Money Laundering and Counter Terrorism Financing (‘AML/CTF’) legislation to collect and verify certain personal information. If this certain personal information is not provided, we may be prohibited from providing services. Specifically, we collect know your client (‘KYC’) and know your business (‘KYB’) information as required by the AML/CTF Act which includes but is not limited to names, addresses, location, contact details, identification documents, beneficial ownership information, job titles, services and transactions offered. In the event we need to keep identification and verification records it will be for at least seven (7) years as required by the AML/CTF Act. We may be required to obtain information to conduct an assessment of your AML/CTF risk level and/or report information to AUSTRAC, and in some circumstances the law prohibits us from telling you that we have done so.

We understand the importance of protecting children’s privacy. Our website and related sites, such as Facebook, Instagram, LinkedIn or other social media pages are not designed for or directed at children.

Consequences of not being able to collect your personal information

If we are not able to collect your personal information, we will not be able to provide you with a full range of services. For instance, we will not be able to provide an Issuer or securities exchange with accurate and complete information about you. If you are a job applicant and we cannot collect personal information about you, we will not be able to consider your job application.

Due to the nature of the services AFS provides, and its business structure and size, it is impractical for us to deal with you anonymously.

Security of personal information

AFS only collects information in a way that is lawful, fair and is not unreasonably intrusive.

We will endeavour to take reasonable precautions to ensure the security of your personal information, whether electronically or in hard copy, from such risks as loss or unauthorised access, destruction, misuse, modification or disclosure. We hold personal information electronically in secure, access-controlled cloud systems, including Microsoft 365 and our document management system hosted in Australia, and in hard copy at our offices. We protect it with technical and organisational measures, including multi-factor authentication, encryption (including full-disk encryption of all staff devices), centrally managed and monitored devices, backups held in secure Australian data centres, role-based access, staff training and regular independent assessment against the Australian Signals Directorate’s Essential Eight. When your hard copy documents are no longer needed we either arrange for them to be destroyed securely or returned to you.

AFS aims to achieve industry best practice in the security of personal information which it holds. When personal information is no longer needed for any purpose permitted under the APPs and we are not required by law to keep it, we take reasonable steps to destroy or de-identify it. Some information may remain in secure backup copies, or in a secure, access-restricted legacy archive in Australia, until the applicable retention period ends. During that time it remains protected and is used only where required.

AFS implements and maintains practices, procedures and systems designed to ensure compliance with the Privacy Act and the APPs. This includes providing appropriate privacy training and guidance to our personnel, managing privacy risks and periodically reviewing our information handling practices and procedures to identify and address potential privacy issues.

How long we keep information

We generally keep client records for at least seven (7) years after our engagement ends, or longer where required by tax, corporations, AML/CTF or professional standards obligations.

Will we provide your personal information to anyone else?

AFS does not disclose personal information to other people or organisations unless:

use or disclosure is permitted by this policy
we believe it is necessary to provide you with a product or service which you have requested (or as an employee is necessary in managing you in your role at AFS)
you give consent
such disclosure is required by law, regulation, rule or professional standard. For example, under Chapter 2C of the Corporations Act 2001 (Cth), certain information about you as a security holder (including your name, address and details of securities you hold) must be included in the public register of the entity in which you hold securities, and this information will therefore be disclosed to anyone who requests to inspect it
we engage a third party to help us deliver our products and service to you.

AFS uses service providers to help us maximise the quality and efficiency of our services and business operations, and personal information may sometimes be disclosed to those contractors or service providers. For example, personal information may be disclosed to cloud software providers (including practice management, document management, accounting, audit and e-signature platforms), our managed IT service provider, an outsourced accounting support provider, off-site security storage facilities, debt collection agencies, print or mail services. We require our service providers, through contract terms and due diligence, to protect personal information and use it only to provide services to us.

We may also provide your personal information to third parties as a result of your express request, or to third parties where permitted under the Privacy Act. This includes your authorised representatives, your agent, lender and/or broker, specific third parties you have authorised, and government and regulatory authorities and similar organisations as required by law or as required as part of the services.

We do not sell to or trade personal information with third parties.

What is a Government identifier?

A Government identifier is a Commonwealth Government or Commonwealth Government agency designated identification number such as your Tax File Number (TFN).

Although at times AFS may request or hold details regarding certain Government assigned identification numbers we do not use such information as identifiers of our own.

We only use Government identifiers for purposes required by law, such as when we supply your TFN to the Australian Taxation Office.

We collect identification documents to verify your identity, including where required under AML/CTF laws, and tax file numbers only where permitted by taxation law. We handle tax file numbers in accordance with the Privacy (Tax File Number) Rule 2015 and keep identification records only for as long as the law requires.

Does your personal information leave Australia?

AFS uses cloud-based software and service providers to deliver our services. Our core systems, including Microsoft 365 and our document management system, store data in Australia, and our data backups are encrypted and held in secure data centres in Australia. Some providers store personal information outside Australia, most notably our practice management, tax and accounting platform (Xero), which stores data in the United States of America. In addition, we utilise outsourcing companies which are located overseas and accesses our systems via a virtual remote server.

AFS will take all reasonable steps to ensure that any overseas recipient to whom we disclose personal information, handles such information in accordance with the APPs.

Sensitive information

Some types of personal information are particularly sensitive and have special protection under the Privacy Act. Sensitive information is information about your:

racial or ethnic origin; or
political opinions; or
membership of a political association; or
religious beliefs or affiliations; or
philosophical beliefs; or
membership of a professional or trade association; or
membership of a trade union; or
sexual preferences or practices; or
criminal record; or
health information; or
genetic information; or
biometric information used for automated biometric verification or identification, and biometric templates.

AFS only collects, uses or discloses this information about you when it is necessary and as allowed by law and provided we get your consent, if required by law.

Website

AFS may also collect personal information from you via its websites, such as afsbendigo.com.au.

We use cookies on our online services to monitor your use of the Website, to measure usage sessions accurately and to provide you a more effective service. We may use both session cookies, which expire once you close your web browser, and persistent cookies, which stay on your computer until you delete them. Cookies are also used to improve the functionality of the Website. If you prefer not to enable us to use cookies most browsers have a facility that will allow you to disable cookies altogether, please refer to your browser’s help menu to find out how to do this. Doing so may affect your browsing experience and certain functions of the Website may not work. We use Google Analytics to understand how our website is used; Google may process this information outside Australia.

When you scan a QR Code, the third party that we engage to provide our QR Codes may collect certain information from your mobile device (such as your mobile device identifier and IP address). This information is used only for the purpose of providing anonymised statistical reports to us about users of our website and services.

A link to a third party’s website should not be construed as an endorsement by either AFS or that third party of the other or its products and services. AFS makes no representations or warranties regarding how user data is stored or used on third-party servers. We are not responsible for the privacy practices of those linked websites and we recommend that you review the privacy policy of each third-party site linked from our site to determine the security of your personal data.

Social media

You may wish to participate in social media platforms hosted by AFS or on which AFS participates. The aim of these social media platforms is to inform you of AFS news and events and allow you to share content. AFS is not responsible if you share personal information on social media platforms that is subsequently used, misused or otherwise appropriated by another user.

Our website includes links to social media platforms. These platforms are maintained on separate servers by individuals and organisations over which AFS has no control. For instance, AFS uses plugins (also known as buttons) of social media such as Facebook, X and LinkedIn. When you visit our website, these plugins are deactivated by default, i.e. without your intervention they will not send any data about you to social media networks. The plugins are activated by clicking on them. We have no influence on the scope of data that is collected by social networks through their plugins. The privacy policies of the social networks provide information on the purpose and extent of the data that they collect, how this data is processed and used, the rights available to you and the settings that you can use to protect your privacy.

CCTV

AFS uses closed-circuit television (CCTV) systems to record images to assist in the provision of a safe and secure environment for the benefit of those who work at and visit AFS’s offices.

CCTV cameras are located at strategic points on the ground floor to provide coverage of entry and exit points to our office building.

Access to CCTV footage is strictly controlled to authorised personnel who require it to investigate an alleged crime, security incident or operational matter.

We will only disclose CCTV data in compliance with the Privacy Act, this may include third parties under specific conditions, such as when required by law, or to police for the investigation of criminal activities.

Recordings are held securely, and we will take all reasonable precautions to protect this data from misuse, interference, loss, unauthorised access, modification or disclosure.

CCTV images will be retained for approximately thirty (30) days, any copies of recordings will only be retained for as long as necessary to fulfil stated purpose. Recorded materials will be deleted securely once the stated purpose has been fulfilled.

How we handle email

Emails are stored in our Microsoft 365 environment in Australia and retained in line with our record-keeping obligations.  Emails sent to or from us are routinely monitored for quality control, systems administration and legal compliance purposes.

Use of artificial intelligence (AI)

AFS has an AI Acceptable Use Policy. Staff may use only AI tools approved by AFS, principally Microsoft 365 Copilot, which operates within our secure, centrally controlled Microsoft 365 environment with restricted access. Unauthorised AI tools are not permitted, and staff review AI-assisted outputs before they are relied on.

Automated decision making

AFS may use computer programs to process personal information in the course of providing its services and conducting its business. AFS does not currently use computer programs to make, or substantially and directly support, decisions that could reasonably be expected to significantly affect an individual’s rights or interests. If this changes, we will update this Privacy Policy to describe the kinds of personal information used and the kinds of decisions made or supported, as required by the Privacy Act.

Data breaches

If a data breach occurs, we are required to comply with the notification of eligible data breaches provisions in Part IIIC of the Privacy Act or any other subsequent sections or legislation which supersede this section. We will follow the relevant notifiable data breach procedures in compliance with the Privacy Act and relevant laws.

If we have reasonable grounds to suspect that the data breach will result in serious harm to any persons involved, then if required pursuant to the Privacy Act:

We will take all reasonable steps to ensure an assessment is completed within thirty (30) days of becoming aware of the suspected breach;
If remedial action is successful in making serious harm no longer likely, then no notification or statement will be made; and
Where we have reasonable grounds to believe an eligible data breach has occurred, we will, as soon as practicable, provide a statement to each of the individuals whose data was breached or who are at risk. The statement will contain details of the breach and recommendations of the steps each individual should take. We will also provide a copy of the statement to the Office of the Australian Information Commissioner (‘OAIC’).

We will review the incident and take action to prevent future breaches occurring.

Access and correction of your personal information

AFS will take reasonable steps to keep any personal information up to date. Under the Privacy Act you may access information that we hold about you. There are some exceptions to this which are detailed in the Privacy Act.

When you request access to personal information, we will require you to provide some form of identification (such as a driver licence or passport) so we can verify that you are the person to whom the information relates. In some cases, we may also request an administrative fee to cover the cost of access. If your personal information has been archived, we may charge a fee for retrieval of your file.

You also have the right to ask us to correct information about you which is inaccurate, incomplete, irrelevant, misleading or out of date. In most cases, access to your personal information is available to you at no charge by contacting AFS on the following:

Phone: 03 5443 0344

In writing: The Privacy Officer, AFS & Associates Pty Ltd, PO Box 454, Bendigo, Victoria, 3552.

Email: afs@afsbendigo.com.au

If you are a security holder and your security holding is sponsored by a broker, you will need to contact your broker direct who will in turn arrange for access to or correction of the information, as the case may be.

Requests for access to personal information or corrections to personal information will be handled as quickly as possible and we will endeavour to process any request for access within thirty (30) days of having received the request, and provide access or make the requested correction, unless an exception under the Privacy Act permits or requires us to refuse. If we refuse your request, we will provide you with written notice of the reasons for our refusal, unless it would be unreasonable to do so, and explain how you may make a complaint about our decision.

If you have any questions or comments about this privacy policy, or you wish to lodge a complaint about the way we have handled personal information about you, please contact AFS’s Privacy Officer at the address listed above. Any complaint should be in writing. AFS’s Privacy Officer will consider the complaint, undertake an investigation to determine the nature of the breach, the reason it occurred, and endeavour to respond to the complaint within fourteen (14) days. If a breach is found to have occurred, our information and storage handling process will be reviewed and revised to prevent any further breaches. If you believe that AFS has breached the APPs or if you are not satisfied with AFS’s response to a complaint, you may contact the OAIC and lodge a complaint. The Commissioner’s details are:

Phone: 1300 363 992

Post: GPO Box 5218 Sydney NSW 2001.

Website: https://www.oaic.gov.au/

We reserve the right to modify this Privacy Policy at any time by publishing an updated version of this Privacy Policy on our Website and taking any further action as required by law, after which, your continued use of the Website or your provision of any further personal information will indicate your acknowledgement to the modified terms of this Privacy Policy. This Privacy Policy is available to you, free of charge and in an appropriate form.

PART B – DISCLAIMER

This website and the articles on our website are not a substitute for independent professional advice. We do not warrant the accuracy, completeness or adequacy of the information or material on this website. All information is subject to change without notice. We and each party providing material displayed on this website disclaim liability to all persons or organisations in relation to any action(s) taken on the basis of currency or accuracy of the information or material, or any loss or damage suffered in connection with that information or material. You should make your own enquiries before entering into any transaction on the basis of the information or material on this website. Please ensure you contact us to dis

Quality of information – always check the information

Before relying on the information on this website, users should carefully evaluate its accuracy, currency, completeness and relevance for their purposes, and should obtain professional advice relevant to their particular circumstances. We and associated parties cannot guarantee nor assume any legal liability or responsibility for the accuracy, currency or completeness of the information or material.

Links to external websites

This website may contain links to other websites which are external to our website. It is the responsibility of the user to make their own decisions about the accuracy, currency, reliability and correctness of information contained in linked external websites.

Linkage to external websites should not be taken to be an endorsement or a recommendation of any third party products or services offered by virtue of any information, material or content linked from or to this website. Users of links provided by this website are responsible for being aware of which organisation is represented or providing the information or material on the website they visit.
Views or recommendations provided in linked websites do not necessarily reflect our views or recommendations, nor the views or recommendations of associated parties.

Security of our website?

Users of our website should be aware that the World Wide Web is an insecure public network that gives rise to a potential risk that a user’s transactions are being viewed, intercepted or modified by third parties or that files which the user downloads may contain computer viruses or other defects.

We and associated parties accept no liability for any interference with or damage to a user’s computer system, software or data occurring in connection with this website. Users are encouraged to take appropriate and adequate precautions to ensure that whatever is selected from this website is free of viruses or other contamination that may interfere with or damage the user’s computer system, software or data.

Notification

Notice of new or updated information or material available via our website may be emailed to our newsletter subscribers and clients.

PART C – EMAIL DISCLAIMER

This message may contain privileged and confidential information intended only for the use of the addressee named above.

If you are not the intended recipient of this message you are hereby notified that any use, dissemination, distribution or reproduction of this message is prohibited. If you have received this message in error please notify the sender immediately by return email and delete this email, any attachments and destroy any copies.

Any views expressed in this message are those of the individual sender and may not necessarily reflect the views of AFS.

We do not warrant that any attached files are free from computer viruses or other defects and we recommend that you scan this email and any attachment for viruses before opening.

The user assumes all responsibility for any loss or damage resulting directly or indirectly from the use of this email or the attached files.

PART D – CYBER RISK WARNING

Please be aware that there is a significant risk posed by cyber fraud, specifically affecting email accounts and bank account details.

Please note that our bank account details will not change during the course of a transaction and we will not notify you of any changes to our bank details via email.

Always independently confirm bank account details and transfer instructions with us in person or via a telephone call to a trusted and verified phone number.

We will never ask you for your passwords or authentication codes. We share documents with clients through our secure client portal, not as email attachments.

In the event of any loss of funds which is not due to the negligence of AFS, we will not be liable for any loss or damages that may be suffered directly or indirectly as a result of any money which belongs to you not being received by you in which we shall be released from all and any claims, loss or liability incurred.

©AFS & Associates Chartered Accountants 2026 | Privacy Policy & Disclaimer | Liability limited by a scheme approved under Professional Standards Legislation.