Privacy policy

1. INTRODUCTION

1.1. Background and Purpose

Slater and Gordon is a leading Australian consumer law firm. As a trusted legal advisor, employer and incorporated legal practice we take the privacy and security of your Personal Information seriously.

In this Privacy Policy ‘we’, ‘our’ or ‘us’ means Slater and Gordon.

1.2. Application

This Policy applies to all our Employees and Contractors when handling Personal Information.

1.3. Definitions

Act means the Privacy Act 1988 (Cth).

Associated Entities has the meaning given to that term by section 50AAA of the Corporations Act 2001 (Cth).

Australian Privacy Principles means the principles described in Schedule 1 of the Privacy Act 1988 (Cth).

Client means a person who has engaged the legal services of Slater and Gordon or an Associated Entity.

Contractor means any third party contracted to provide goods or services to the Slater and Gordon.

Employee means any person performing duties on behalf of Slater and Gordon whether or not directly employed or contracted, regardless of whether they are permanent, part time, casual, fixed term, temporary, voluntary, agency contractors or consultants and includes directors and officers.

Primary Purpose means holding and using Personal Information for the purpose for which it was collected.

Secondary Purpose means the permissible use or disclosure of Personal Information for a purpose other than the Primary Purpose. Secondary Purpose may include, but is not limited to:

• where an individual has specifically consented to the Secondary Purpose;
• where an individual would reasonably expect their Personal Information to be used or disclosed for a Secondary Purpose that is directly related to the Primary Purpose;
• where it is required by law.

Slater and Gordon means Slater and Gordon Ltd (ACN 93 097 297 400) and its Associated Entities.

2. TYPES OF PERSONAL INFORMATION

Personal Information includes Sensitive Information, Health Information and Government Related Identifiers. For the purposes of this Privacy Policy, Personal Information, Sensitive Information, Health Information and Government Related Identifiers will be referred to together as ‘Personal Information’ unless identified separately.

2.1. Personal Information

Personal Information is information or an opinion about you, which is reasonably identifiable whether the information or opinion is true or not, and whether the information or opinion is recorded in a material form or not.

The main types of Personal Information we collect include:

• Names and contact details such as phone numbers, postal and/or residential addresses and email addresses;
• Information that can identify you such as date of birth, residence status, marital status, family situation, and photographs;
• Details about your occupation and employment history;
• Other personal information that you provide such as your signature, bank account details, financial and tax information;
• Supplier details and the details of their employees; and
• Information about our employees, former employees and contractors.

In some cases, you may need to give us Personal Information about other people, for example family members or work colleagues. In those cases, we rely on you to seek authorisation from those individuals prior to you giving us their Personal Information, and to let them know about this Policy.

2.2. Sensitive Information

Sensitive Information is information or an opinion about you, which includes but is not limited to:

• racial or ethnic origin
• political opinions, memberships or affiliations
• religious or philosophical beliefs
• membership of a professional or trade association or trade union
• sex, gender identity, sexual orientation or practices
• criminal record
• biometric information and biometric templates.

2.3. Health Information

Health Information includes physical and mental health diagnosis, symptoms, imaging, disabilities, medical treatment, medication usage, information about suitability to return to work and other health related information

2.4. Government Related Identifiers

Government Related Identifiers are numbers, letters or a combination of both assigned to you by a government authority, such as:

• Tax file number
• Medicare number
• Driver licence number
• Passport document number
• Centrelink customer reference number

3. COLLECTION AND USE OF PERSONAL INFORMATION

We collect Personal Information which is reasonably necessary to provide you with our services and to function as a business.

We will only use your Personal Information for the purpose for which you have provided it, as permitted by this Privacy Policy, or otherwise in ways consistent with the Australian Privacy Principles.

If you do not provide us with the Personal Information we request, we may not be able to supply you with our services.

3.1. Clients or Potential Clients

(i.e. individuals who have made an enquiry but did not instruct us to act on their behalf)

Collection of Personal Information

In most circumstances, we collect your Personal Information through interviews, telephone conversations, questionnaires and other forms which are completed by you. We also collect your Personal Information from other sources with your authority or within the scope of the instruction you have provided us, such as from:

• Family members
• Health professionals, financial advisors and accountants
• Australian Tax Office, Centrelink and other government agencies
• Insurance companies and claims managers
• Other legal parties and their legal advisors
• Statements from government or policing authorities and witnesses
• Current and former employers and colleagues and ex-colleagues
• Social media and marketing suppliers
• Publicly available government registers such as ASIC or ABR
• Referral Partners

Use of Personal Information

We collect and use your Personal Information for the Primary Purpose of providing our legal service to you or performing our contractual obligations to you. This may include:

• To provide you with our legal services
• Assisting you to apply to a disbursement funder and/or litigation funder for a loan to cover the payment of disbursements incidental to the conduct of your matter
• Seeking consent in relation to publications of reviews and testimonials
• To provide and market our products or services
• Sending promotional information about third parties that we think may be of interest to you
• Secondary Purposes

3.2. Website Users

Collection of Personal Information

mobile applications and other online platforms via:

• Online forms
• Cookies
• Social media analytics
• Web beacons

Our website may contain links to other websites. We are not responsible for or liable for the protection and privacy of any Personal Information which you provide whilst visiting third party websites, and such third party websites are not governed by this Policy.

Use of Personal Information

We collect and use your Personal Information for the Primary Purpose of providing our legal service to you or performing our contractual obligations to you. This may include:

• Measurement, analytics and profiling to improve the effectiveness and distribution of business development and marketing activities, including direct marketing
• Making our websites, mobile applications and other on-line platforms more intuitive and personalised.
• Secondary Purposes

3.3. Prospective Employees

Collection of Personal Information

We collect your Personal Information in relation to employment opportunities via:

• Your CV, cover letter or application form
• Recruitment agencies
• In-person or online interviews
• Social media
• Reference checks
• Police and background checks

Use of Personal Information

We collect and use your Personal Information for the Primary Purpose of providing our legal service to you or performing our contractual obligations to you. This may include:

• To consider the suitability of prospective employees
• Recruitment and on-boarding;
• Employment of our personnel and providing internal services to our employees;
• Secondary Purposes

3.4. Social Media and Marketing

Collection of Personal Information

We collect your Personal Information if you interact with us on various social media platforms.

These social media entities collect your Personal Information in accordance with their own privacy policies.

Use of Personal Information

We collect and use your Personal Information for the Primary Purpose of providing our legal service to you or performing our contractual obligations to you. This may include:

• Communicating directly with you
• Communicating with the general public
• Market research, surveys, business development and marketing, including direct marketing
• Secondary Purposes

3.5. Goods and Service Providers

Collection of Personal Information

We collect Personal Information from you for the purposes of managing our business by way of:

• Tender documents
• Contracts and agreements
• Publicly available government registers such as ASIC or ABR
• Third party entities for reference checks

Use of Personal Information

We collect and use your Personal Information for the Primary Purpose of providing our legal service to you or performing our contractual obligations to you. This may include:

• Conducting the effective management of our business, such as invoicing and account management (including collections), internal record keeping, financial modelling and analysis;
• compliance with our legal obligations and for establishing, exercising or defending legal proceedings
• Secondary Purposes

4. DISCLOSURE OF PERSONAL INFORMATION

4.1. Disclosure of Personal Information to Third Parties

We may disclose your Personal Information to third parties for the purposes for which it was collected. These third parties may include:

• Courts, commissions, ombudsmen, tribunals and other regulatory authorities
• Other parties involved in your legal matter
• Medical service providers such as hospitals, medical clinics, mental health facilities, doctors and other allied healthcare providers
• State-based statutory insurance authorities
• Any person or entity that lawfully represents you
• Our insurance companies
• Litigation and disbursement funders
• Financial institutions, including debt collection and credit reporting agencies
• Consultants and service providers involved with ICT goods and services, marketing services, and other contractors required for running our business
• The Commonwealth Attorney-General or responsible Minister under the Act
• The Office of the Australian Information Commissioner
• Unions and professional affiliations
• Any third party with your express permission.

4.2. Disclosure of Personal Information as required by law

We may also be compelled to disclose your Personal Information by law, for example:

• Court orders or statutory notices to produce documents
• Responding to and dealing with a data breach
• Establishing or protecting our legal rights or defending against legal claims
• Responding to a complaint, enquiry or investigation by a statutory governing body
• Meeting the legal and regulatory obligations imposed on us
• Where we reasonably believe the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety.

If there is a change of control of our business, transition of service to another provider or a sale, transfer or securitisation of any of our business assets, we may disclose (as the case requires and to the extent permissible by law) any relevant user databases together with applicable Personal Information. We will only disclose your Personal Information in this way if we have contractual arrangements in place ensuring the protection of your Personal Information.

4.3. Disclosure of Personal Information outside of Australia

We do not generally transfer Personal Information to overseas parties, unless:

• Your legal matter involves international parties
• We engage international service providers, such as ICT vendors contracted to provide data hosting and other technological solutions
• We are required to do so by law or as part of enforcement activity, including when directed to do so while responding to data breaches
• Certain data analytics tools may require personal information collected through these tools to be stored on or processed by overseas servers.

If we do transfer Personal Information overseas, we do so in compliance with the Act and Australian Privacy Principles.

By providing us with your Personal Information, you agree that you have no objection to your Personal Information being disclosed outside of Australia in this manner.

5. OUR WEBSITE

If you visit our websites, we and our internet service providers collect data to improve your experience. We use cookies to provide a better and more personalised service to you. Cookies do not collect or store your Personal Information, however in some circumstances, cookies can be used with other data to become Personal Information.

We use cookies to:

• Assign a unique number to your browser
• Customise the website for you
• Gather statistics
• Ensure security

The data we collect from you may include:

• Your anonymised IP address
• Third-party click identifiers (used for marketing measurement)
• The search terms and pages you visited
• The date and time pages were accessed
• Your geographic location
• Downloads, time spent on pages
• Device type, operating system, and browser information

If you wish to reject or delete cookies, you can adjust your browser settings. However, doing so may affect your access and useability of our website.

If you wish to be removed from our marketing campaigns, please visit our website at https://www.slatergordon.com.au/unsubscribe.

6. SECURITY OF YOUR PERSONAL INFORMATION

6.1. Security of your Personal Information

We endeavour to keep all Personal Information safe by taking all reasonable precautions to protect Personal Information from misuse, loss, unauthorised access, modification or disclosure.

Although Personal Information is encrypted where possible and efforts are made to protect your Personal Information, by utilising firewalls, secure data bases, anti-virus software, password protection and regular security sweeps, you acknowledge that we cannot guarantee the security of your Personal Information.

Our Employees and Contractors must comply with this Privacy Policy, in addition to other professional and contractual confidentiality and privacy obligations.

6.2. Storage of your Personal Information

Your Personal Information is stored in:

• Hard-copy paper-based files in secured onsite storage, or third-party storage providers
• Restricted access and password protected legal and other software and cloud-based systems.

We retain your Personal Information for as long as it is necessary to fulfil the Primary Purposes for which it was collected, any relevant Secondary Purpose and as otherwise required by law.

6.3. Deletions, Deidentification and putting Personal Information beyond use

If you are a Client, we are required by various state-based legislation to keep your legal file, including Personal Information, for a minimum of seven years after your case is finalised. In some instances, such as with a Will or if you were under 18 at the time you were a Client, we may need to retain Personal Information for a longer period.

When we are no longer required to retain your Personal Information, we will either destroy or de-identify it.

If we hold your Personal Information in a way that cannot be destroyed or de-identified without affecting or corrupting other critical data, we will take steps to put your Personal Information beyond use, which means:

• We will no longer use your Personal Information
• We will not disclose your Personal Information to any third party
• We will restrict internal access to your Personal Information
• We will take all reasonable steps to destroy your Personal Information in the future.

7. RIGHTS UNDER THE AUSTRALIAN PRIVACY PRINCIPLES

7.1. Access to your Personal Information

You or someone you have authorised can request a copy of your Personal Information we hold. We are obligated to satisfy ourselves that the request has come from you or your authorised agent.

If you wish to access your Personal Information, you must make a request in writing to the Privacy Officer.

7.2. Corrections to your Personal Information

If you believe that the Personal Information we hold about you is incorrect or out of date, please make a request for correction to the Privacy Officer.

7.3. Complaints about your Personal Information

If you have concerns about how we have handled your Personal Information, please contact the Privacy Officer and we will attempt to resolve your concerns.

If you are not satisfied with our handling of your complaint, you may make a complaint to the Australian Information Commissioner at the Office of the Australian Information Commissioner:

Office of the Australian Information Commission

GPO Box 5288

Sydney NSW 2001

Phone: 1300 363 992 

Website: www.oaic.gov.au

7.4. Deletion of your Personal information

If you wish to have your Personal Information deleted, please contact the Privacy Officer and we will take reasonable steps to delete it, unless we are required to keep it for compliance with our legal or professional obligations.

7.5. Request a copy of our Privacy Policy

You can download a copy of our Privacy Policy from our website, or by contacting our Privacy Officer.

7.6. Our rights under the Australian Privacy Principles

In certain circumstances, we are permitted to deny your request for access, correction or deletion of your Personal Information. If we do not comply with your request for any reason we will advise you in writing.

7.7. Unsolicited Personal Information

If we receive unsolicited Personal Information about you that we are not legally permitted to retain, or that you have not provided consent for, we will take steps to delete, de-identify, or otherwise put it beyond use, as long as it is lawful and reasonable for us to do so.

8. ARTIFICIAL INTELLIGENCE (AI) USAGE

8.1. AI Tools

We may use artificial intelligence (AI) tools, including generative AI and large language model tools, to help us provide legal services and conduct our business operations. This may include both internally developed tools and commercially licenced third party tools. We may use AI tools to assist with activities such as:

• file management;
• data analysis;
• customer service support;
• drafting assistance;
• extracting, organising and summarising information; and
• improving the efficiency, consistency and quality of our services.

The use of AI tools may also include the training and refinement of these tools, subject to the safeguards described below.

8.2. Use of Personal Information with AI tools

We may use AI tools to process Personal Information we hold about you for the purposes described in 8.1 and elsewhere in this Privacy Policy, or otherwise with your express consent.

We will only use Personal Information that has not been aggregated and de-identified or anonymised to train AI tools where:

• It is not reasonably practicable to first aggregate and de-identify or anonymise the relevant information;
• you have given your express and informed consent for your Personal Information to be used for AI training; and
• you have not subsequently withdrawn that consent or opted out under clause 8.4.

We may also include Personal Information in secure databases that may be accessed by AI tools to improve the quality and consistency of our legal services, provided that, where appropriate, that information will be de-identified, anonymised or deleted in accordance with clause 6.3.

8.3. Safeguards and Oversight

We will apply safeguards to govern the use of AI tools, which include Slater and Gordon’s policies on privacy, data governance, information security and artificial intelligence.

AI tools are used to support our work, they do not replace the professional judgement, supervision and responsibility of our Employees.

8.4. Your rights and AI

The rights you have under the Act and the Australian Privacy Principles also apply to our use of AI tools. If you do not agree to the use of your Personal Information with our AI tools, we may not be able to provide you with some or all of our services.

You may request that your Personal Information is not used for training purposes. To make this request, please advise your lawyer or contact the Privacy Officer.

9. EUROPEAN PRIVACY LAWS

We may be required to comply with the General Data Protection Regulations (GDPR) if you are located in the European Economic Area. Under the GDPR you have the following rights in relation to your Personal Information:

9.1. Access

Subject to certain exceptions, you have the right to request a copy of the Personal Information we are processing about you, which we will provide to you in electronic form.

9.2. Rectification

You have the right to require that any incomplete or inaccurate Personal Information that we process about you is amended.

9.3. Deletion

You have the right to request that we delete Personal Information that we process about you, unless we are required to retain such data to comply with a legal obligation or to establish, exercise or defend legal claims.

9.4. Restriction

You have the right to request that we restrict our processing of your Personal Information where:

• you believe it to be inaccurate;
• our processing is unlawful; or
• we no longer need to process such data for a particular purpose, but where we are not able to delete the data due to a legal or other obligation or because you do not want us to delete it.

9.5. Portability

You have the right to request that we transmit the personal data we hold in respect of you to another data controller, where this is:

• Personal Information which you have provided to us; and
• we are processing that Personal Information on the basis of your consent or in order to perform our obligations under contract to you (such as to provide legal services).

9.6. Objection

Where the legal justification for our processing of your personal data is our legitimate interest, you have the right to object to such processing on grounds relating to your particular situation. We will abide by your request unless we have compelling legitimate grounds for the processing which override your interests and rights, or if we need to continue to process the data for the establishment, exercise or defence of a legal claim.

9.7. Withdrawing Consent

If you have consented to our processing of your Personal Information, you have the right to withdraw your consent at any time, free of charge. This includes cases where you wish to opt out from marketing messages that you receive from us.

You also have the right to lodge a complaint with your local data protection authority if you believe that we have not complied with the General Data Protection Regulations.

10. COMPLIANCE

10.1. Agreement to Privacy Policy terms

By using our website and / or providing us with your Personal Information, you acknowledge that we will collect, use, hold and disclose your Personal Information as described in this Policy.

10.2. Amendments

This Policy may be amended, including with changes, additions and deletions, from time to time in our sole discretion and any such amendments will be notified to you by posting an updated version of the Policy on our website. If at any point we decide to use Personal Information in a manner materially different from that stated at the time it was collected we will notify you by email or via a prominent notice on our website, and where necessary, we will seek your prior consent.

10.3. Privacy Officer

For all privacy related matters please contact our Privacy Officer:

The Privacy Officer 

c/- privacyofficer@slatergordon.com.au

The Privacy Officer

Level 35, 530 Collins Street

Melbourne VIC 3000

10.4. Approval

This Policy was first approved and adopted by the Company on 16 November 2018.
Subsequent versions are detailed below.